India's Digital Personal Data Protection Act 2023 (DPDP Act) is being brought into force in phases under the DPDP Rules 2025. The Data Protection Board has existed since 13 November 2025, consent-manager registration starts on 13 November 2026, and the main duties on businesses (notice and consent, security, breach reporting, children's data, individuals' rights and transfer rules) start on 13 May 2027. The Act reaches businesses outside India that offer goods or services to people in India. Sector rules apply already, notably the Reserve Bank of India's payment-data localisation rule and CERT-In's cyber security directions.
Who the DPDP Act covers and when it applies
The Act applies to digital personal data processed in India, and to processing outside India where it is connected with offering goods or services to individuals in India. A foreign group selling to Indian customers online is therefore inside its scope even without an Indian entity.
The Rules were notified in November 2025 with an 18-month window for phased compliance. Provisions setting up the Data Protection Board took effect on notification; the consent-manager rule takes effect one year later; and most operational rules, together with the Act's core obligations, take effect eighteen months after publication, on 13 May 2027.
In early 2026 the Ministry of Electronics and Information Technology (MeitY) consulted industry on shortening the 18-month window to 12 months. As at 18 October 2026 we found no notified amendment changing the dates, but businesses should plan on the possibility of an earlier deadline and check the Gazette before relying on May 2027.12345
Core obligations once the Act is fully in force
From May 2027, a business acting as a data fiduciary must, among other things, keep reasonable security safeguards, notify the Data Protection Board and each affected individual of a personal data breach, and answer individuals' requests for access, correction and erasure. Under the Rules the Board receives an initial notice followed by a detailed report within 72 hours, and rights requests must be dealt with within 90 days.
A child is anyone under 18. Processing a child's data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited, subject to exemptions set by the Rules. This is a much higher age line than many other regimes, and it affects education, gaming, social and consumer platforms in particular.
Penalties are set in the Schedule to the Act and are imposed by the Board: up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore for failing to notify a breach or for breaching the children's data duties, and up to Rs 50 crore for other breaches by a data fiduciary. Board orders can be appealed to the Appellate Tribunal (the Telecom Disputes Settlement and Appellate Tribunal) within 60 days.6789101112
Cross-border transfers and data localisation
The DPDP Act does not require approval or standard contracts for transfers abroad. Instead, the Central Government may restrict transfers to countries it notifies, and any other Indian law that gives a higher degree of protection or restricts transfers continues to apply. The Rules also allow the government to require significant data fiduciaries not to transfer specified personal data outside India, on a committee's recommendation.
Sector rules matter as much as the DPDP Act. For payments, the Reserve Bank of India requires the entire payment data of authorised payment system operators to be stored only in India; processing abroad is allowed, but the data must be deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier. Banking, insurance, telecoms and government work carry their own requirements that should be checked sector by sector.131415
Cyber security incident reporting
CERT-In, the national computer emergency response team, issued directions on information security practices and incident reporting on 28 April 2022 under the Information Technology Act 2000, effective 60 days later. They apply now, independently of the DPDP Act, and cover reporting of specified cyber incidents and keeping of logs. Incident response plans should treat CERT-In reporting and DPDP breach notification as two separate obligations with different recipients and content.16
| Date | What takes effect | Practical effect |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21; Act provisions establishing the Data Protection Board | Board constituted; no general business duties yet |
| 13 November 2026 | Rule 4 (consent managers) | Consent managers can register with the Board |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23; core obligations in the Act, including notice, consent, security, breach notification, children's data, rights and transfer restrictions | Full compliance and penalties apply |
Documents usually needed
- Data inventory and map showing what personal data is collected in India, where it is stored and who receives it
- Stand-alone consent notices that state each purpose of processing, and a method to record and withdraw consent
- Contracts with data processors and group companies covering security, breach notice and deletion
- Breach response plan covering Data Protection Board notification, notice to affected individuals and CERT-In reporting
- Retention schedule and procedure for handling access, correction and erasure requests within the time limits
Common mistakes
- Treating May 2027 as distant: rebuilding consent flows, notices and processor contracts for existing customers takes many months, and the government has consulted on bringing the deadline forward.
- Applying a GDPR-style age of 13 or 16 for children: under the DPDP Act a child is anyone under 18.
- Assuming the DPDP Act alone governs transfers: RBI payment-data localisation and other sector rules can require storage in India regardless of the Act.
- Merging CERT-In incident reporting into the DPDP breach process: they are separate obligations that already apply under the IT Act framework.
- Ignoring the Act because there is no Indian entity: offering goods or services to people in India brings foreign processing into scope.
When the business crosses borders
- Foreign businesses that offer goods or services to individuals in India are covered for that processing, even if all systems are offshore.
- Transfers abroad are allowed unless the destination is restricted by government notification, but stricter sector laws continue to apply.
- Payment system operators may process abroad but must return the data to India within one business day or 24 hours, whichever is earlier.
- Significant data fiduciaries may be directed not to transfer specified data outside India once the relevant rules take effect.
Questions businesses ask
Do we have to comply with the DPDP Act now?
Most duties apply from 13 May 2027 under the current Rules. The Data Protection Board already exists and consent-manager registration opens on 13 November 2026. Because MeitY has consulted on shortening the timetable, planning should assume the date could move earlier.345
Can we host Indian customer data on group servers abroad?
Generally yes under the DPDP Act, unless the destination country is restricted by notification or you are a significant data fiduciary subject to a localisation direction. Sector rules can override this; payment system data, for example, must be stored only in India.131415
What are the maximum penalties?
Up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore for breach-notification failures or children's data breaches, and up to Rs 50 crore for other breaches, imposed by the Data Protection Board per breach after inquiry.10
What this guide does not yet confirm
These points need checking with a qualified local professional in India before you rely on them.
- We could not open an official CERT-In page stating the specific incident-reporting deadline and log-retention period in the April 2022 directions; these should be confirmed against the directions themselves.
- No significant data fiduciary designations, restricted-country notifications under section 16 or transfer restrictions under the Rules were confirmed as notified by 18 October 2026.
- Sources differ on whether the Rules were published on 13 or 14 November 2025, which moves the commencement dates by a day; the Gazette text should be checked.
- MeitY's proposal to shorten the compliance window had not been confirmed as notified; status may change at short notice.
- GST e-invoicing thresholds and other digital filing obligations were not verified and sit with the tax area.
- Sector-specific localisation (insurance, telecoms, government cloud, health) depends on the business and was not reviewed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The Digital Personal Data Protection Act 2023 applies to processing of digital personal data within India and to processing outside India if it is connected with offering goods or services to Data Principals in India. Central law. Section 3 of the Act; section 3 is among the provisions commencing on 13 May 2027.
Commencement date per India Code footnote (eighteen months after 13 November 2025).
The Digital Personal Data Protection Rules 2025 were notified in November 2025 with an eighteen-month period for phased compliance. Central rules made by MeitY under the DPDP Act.
The PIB backgrounder gives 14 November 2025 as the notification date; other sources and the commencement notifications are dated 13 November 2025.
Under rule 1 of the DPDP Rules 2025, rules 1, 2 and 17 to 21 took effect on publication (13 November 2025), rule 4 takes effect one year later (13 November 2026) and rules 3, 5 to 16, 22 and 23 take effect eighteen months later (13 May 2027). Central rules. Rule 4 concerns consent managers; rules 3 and 5 to 16 contain most operational duties of data fiduciaries.
Secondary source used because the MeitY and Gazette pages could not yet be checked. Consistent with the PIB 18-month statement and the India Code commencement footnotes.
Section 18 of the DPDP Act, which establishes the Data Protection Board of India, came into force on 13 November 2025, while the core obligations including sections 3, 8, 9, 16 and 29 commence eighteen months after that date. Central law; commencement by notification under section 1(2).
In January 2026 MeitY consulted stakeholders on shortening the DPDP compliance window from 18 to 12 months, which would move the main deadline to 13 November 2026; this was a proposal and had not been reported as notified. Proposal only. The same consultation proposed bringing significant data fiduciary transfer restrictions into effect immediately.
Secondary. A law-firm article updated 8 September 2026 still gave 13 May 2027 as the main commencement date. MeitY's 7 October 2026 Removal of Difficulties Order made only textual corrections to sections 9 and 10 and did not change dates (India Briefing). Pending change: check the Gazette.
On a personal data breach, a Data Fiduciary must notify the Data Protection Board and each affected Data Principal in the prescribed form and manner. Section 8(6) of the DPDP Act; in force from 13 May 2027.
The DPDP Rules require a Data Fiduciary to give the Board an initial description of a breach followed by a detailed report within 72 hours. Breach rules commence on 13 May 2027; the 72-hour period may be extended on written request according to secondary commentary.
Secondary source; the official PIB backgrounder mentions notice to individuals 'without delay' but not the 72-hour report. Confirm against the Gazette text of the Rules.
A child under the DPDP Act is an individual who has not completed eighteen years, and processing a child's personal data requires verifiable consent of a parent or lawful guardian. Sections 2(f) and 9; tracking, behavioural monitoring and targeted advertising directed at children are barred subject to exemptions prescribed by the Rules. In force from 13 May 2027.
Under the DPDP framework, Data Fiduciaries must address Data Principals' requests for access, correction, updating and erasure within ninety days. Rules provision on rights management; commences with the main Rules on 13 May 2027.
The Schedule to the DPDP Act sets maximum penalties of Rs 250 crore for failing to take reasonable security safeguards, Rs 200 crore for failing to notify a breach, Rs 200 crore for breaching children's data obligations, Rs 150 crore for breaching significant data fiduciary obligations and Rs 50 crore for other breaches by a Data Fiduciary. Imposed by the Data Protection Board after inquiry; penalties apply once the relevant obligations commence (13 May 2027).
A person aggrieved by an order or direction of the Data Protection Board may appeal to the Appellate Tribunal within sixty days of receiving it. Section 29 of the DPDP Act; the Appellate Tribunal is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Late appeals may be admitted for sufficient cause.
TDSAT identification from the PIB backgrounder of 17 November 2025.
The Data Protection Board of India consists of four members and operates as a digital body, with complaints filed and tracked online. Board established with effect from 13 November 2025.
The Central Government may by notification restrict the transfer of personal data by a Data Fiduciary for processing to countries or territories outside India that it notifies, and any other Indian law providing a higher degree of protection or restriction on transfers continues to apply. Section 16(1) and (2) of the DPDP Act; commences 13 May 2027. No restricted-country notification was confirmed as at 18 October 2026.
The Reserve Bank of India requires the entire payment data of authorised payment system operators to be stored in systems located only in India; processing abroad is permitted if the data is deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier. RBI circular DPSS.CO.OD.No 2785/06.08.005/2017-18 of 6 April 2018 and FAQs; applies to payment system operators, banks as operators or participants, and their third-party service providers.
FAQ page dated 26 June 2019.
The DPDP Rules require significant data fiduciaries to ensure that personal data identified by the Central Government on a committee's recommendation is not transferred outside India. Applies only to entities designated as significant data fiduciaries; commences 13 May 2027 under the current Rules. No identified data categories were confirmed as notified.
Secondary; the PIB backgrounder confirms in general terms that SDFs may have to follow government directions including local storage where needed.
CERT-In issued cyber security directions on information security practices and the reporting of cyber incidents dated 28 April 2022, effective 60 days after issue. Issued under section 70B(6) of the Information Technology Act 2000; apply to service providers, intermediaries, data centres, body corporates and government organisations. Specific reporting deadlines not confirmed from an official page.
Page loaded but showed only summary metadata (date and 60-day effect). The widely reported 6-hour incident-reporting deadline and 180-day log retention could not be confirmed on an official page; kept as research draft. Effective date computed as 60 days after 28 April 2022.
Questions on this topic
16 statements on data protection, cyber security and digital compliance in India, 1 not yet checked against a source
