The Board was established
The Data Protection Board of India was operationalised and the Rules were notified. Substantive obligations were not yet enforceable, but the Board could receive complaints and prepare its inquiry machinery.
India is now watching.
The Digital Personal Data Protection Rules were notified in November 2025. Substantive obligations become enforceable on 14 May 2027. This is what the Act and the Rules actually require, written for the people who have to ship it.
6 months to enforcementEight domains · Rule 3 to Rule 13
The enforcement timeline
Three phases, one window.
12 months6 months
You are here · 6 months left
14 Nov 202513 Nov 202614 May 2027
Consent Managers go live
Registration opens for consent intermediaries — India-domiciled, with a prescribed net worth and a seven-year audit retention. From here the runway to full enforcement is six months.
Substantive provisions live
Notice and consent, Data Principal rights, breach notification, processor agreements, SDF obligations and cross-border restrictions all become enforceable. The Board can issue penalties from this date.
The eight domains
What each one demands of the stack.
Mapped to the Act and the Rules
Notice & consent architecture
Rule 3 · standalone noticesConsent flows that are auditable and reproducible.
Data Principal rights
Act ss.11–14 · Rule 14(3) 90-day windowA request that reaches every system, not only the first one.
Record of Processing Activities
Section 8 · accountability documentationThe single most useful artefact in an audit defence.
Erasure & retention
Rule 8 · timelines for large platformsErasure that propagates to backups, warehouses and processors.
Reasonable security safeguards
Rule 6 · technical measures, one-year logsThe domain carrying the largest single penalty exposure.
Breach response readiness
Rule 7 · 72-hour detailed reportA runbook that has been rehearsed, not written.
Vendor & processor management
Act s.8(2) · Rule 6(1)(f)Your vendor’s deletion behaviour is your problem, not theirs.
Governance & accountability
Act s.8(9)–(10) · Rule 9Who answers, and what they can prove.
The penalty schedule
Maxima, and imposed per contravention.
- ₹250 Cr
- Failure to implement reasonable security safeguards
- Sec 8(5) · Schedule Sl. 1
- ₹200 Cr
- Failure to notify the Board or Data Principals of a breach
- Sec 8(6) · Schedule Sl. 2
- ₹200 Cr
- Non-compliance with the special provisions for children
- Sec 9 · Schedule Sl. 3
- ₹150 Cr
- Failure to fulfil Significant Data Fiduciary obligations
- Sec 10 · Schedule Sl. 4
- ₹50 Cr
- Other violations by a Data Fiduciary
- Various · Schedule Sl. 5
- ₹10,000
- Breach of Data Principal duties, including frivolous complaints
- Sec 15 · Schedule Sl. 6
The last row is drawn at the minimum legible width, not to scale — at true scale it is 1/250,000th of the bar above it and would not render at all. That is the point of the second panel.
2,50,000 ×₹10 K₹1 L₹10 L₹1 Cr₹10 Cr₹100 Cr
Five of the six maxima sit inside the final decade and a half. The sixth — the only penalty the Act places on an individual rather than an organisation — is five decades away. Read as a list, those six figures look like one descending range. They are two populations with a cliff between them.
One incident can trigger several of these in parallel. Early enforcement is expected to be measured — but the exposure exists from day one.
Significant Data Fiduciary
The tier most organisations assume does not apply to them.
Section 10 · Rule 13
Designation criteria
- Significant volume of personal data processed
- Data used for decisions that materially affect individuals — lending, hiring, insurance
- Financial, health, biometric or government-ID data
- Key information infrastructure under the IT Act
- Risk to electoral democracy, sovereignty or public order
A Data Protection Officer in India
Senior, India-based, reporting to the board or equivalent. An internal compliance manager does not satisfy this.
Annual DPIA and independent audit
At least once every twelve months, by an auditor independent of the internal audit function.
Algorithmic due diligence
Verification that software used to host, display, modify, transmit or store personal data does not put rights at risk — India’s first statutory hook for algorithmic accountability.
Localisation of specified categories
Categories notified by the Central Government may not leave India. The list has not yet issued.
The compounding trap
Each obligation is a separate contravention. An organisation that misses the DPO, the DPIA and the audit faces three parallel exposures, not one.
The breach clock
Rule 7, as a sequence.
No threshold — one record runs the same protocol as a million
- T+0
Detection
The clock starts when any responsible person becomes aware of unauthorised processing, disclosure, loss or alteration. No threshold applies.
- T+0
Intimation to the Board
Without delay: nature, extent, timing, location and likely impact. This is the alarm, not the report.
- T+0
Notice to individuals
Concise, plain-language notice through a registered channel — description, likely consequences, mitigation taken, and a contact for questions.
- T+72h
Detailed report
Facts and causes, mitigation taken or proposed, findings on responsibility, prevention steps, and a summary of the notifications sent. Audit-trail completeness sets the trajectory of any enquiry.
- T+30d
Post-incident review
Not statutory, but the Board weighs remediation and compliance history when setting penalty quantum.
3 of the 5 obligations fall before the clock moves at all. The other two are the only ones with room to plan in — and the last of them is not statutory.
If you already run GDPR
A starting point, not a finishing line.
DPDP · IndiaGDPR · EU
Scope of dataDigital personal data only, including offline data later digitised.All personal data, in any medium, including paper and verbal.
Sensitive categoriesNo sensitive category in the Act. Risk is handled through SDF designation, case by case.Explicit special categories with stricter consent and processing rules.
Lawful basesConsent and specified legitimate uses only. No legitimate-interests balancing test.Six bases, including contract, legal obligation and legitimate interests.
Breach thresholdNo threshold — every breach is reportable.Risk-based; only breaches likely to result in risk are reportable.
DPO requirementOnly for Significant Data Fiduciaries, and the DPO must be India-resident.Triggered by public body, large-scale special-category processing or core monitoring. No residency rule.
Maximum penalty₹250 crore per contravention, from a fixed schedule of maxima.€20M or 4% of global turnover, whichever is higher.
Cross-borderGenerally permitted; restricted only for categories the Government notifies.Adequacy decisions, SCCs and BCRs, with the Schrems jurisprudence behind them.
Security, breach infrastructure and rights workflows carry over. Lawful bases, the breach threshold and the Consent Manager concept do not.
Free, and no obligation
Where do you actually stand on these eight?
The AI-assisted self-assessment walks the same eight domains and returns an indicative position in about ten minutes. It is not a defensible position — only an assessment produces that — but it will tell you which domains to worry about first.
Next step
Twenty minutes, no slides.
We would rather have this conversation now, while there is still time to build calmly, than in the quarter everyone else discovers the deadline.