The data protection law is already notified. Most of your duties start in 2027.

• The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology in November 2025
• Rule 1 puts some rules into force on publication, including those on the Data Protection Board
• Rule 4, on registration of Consent Managers, applies one year after publication, around November 2026
• Rules 3 and 5 to 16 and 22 and 23, which include notice, safeguards, breach intimation and rights, apply eighteen months after publication, around May 2027
• In January 2026 the press reported that the ministry was considering shortening some timelines; we have not found a notified change, and government statements since have described the eighteen-month schedule
• Check the MeitY website and the Gazette for the current position before you plan around any date

The Act's own provisions were brought into force on a matching timetable. Confirm the current notification with a professional.

• A Data Fiduciary is whoever decides why and how personal data is processed; a Data Processor handles it on its behalf; a Data Principal is the individual
• The Act applies to digital personal data, and to data collected on paper and later digitised
• Personal or domestic use by an individual is outside it
• The Act does not set a general exemption for small businesses
• It allows the Government to notify exemptions from some duties for particular classes, including startups; check whether any notification covers you
• Employee data is covered too, with employment-related uses treated as a legitimate use

A one-page list of what you collect, why, where it sits and who can see it is the most useful single preparation step, and nothing in the law prevents you from starting it now.

• Customer names, phone numbers, addresses, order histories
• Enquiry and registration forms, including on paper
• Staff and candidate records
• Photos, KYC copies and payment details
• Where each is kept: spreadsheets, accounting software, phones, cloud tools
• Which vendors handle each, and who in your business can open it

• Consent must be free, specific, informed, unconditional and unambiguous, by a clear affirmative action, and limited to the data necessary for the stated purpose
• A notice must accompany or precede the request, saying what data, for what purpose, how to exercise rights, and how to complain to the Board
• Rule 3 asks for a notice that is understandable on its own, in clear and plain language, with an itemised description of the data and the specific purpose
• People must be told how to withdraw consent, and withdrawal must be as easy as giving it
• Notices must be available in English or a language listed in the Eighth Schedule to the Constitution
• The business must be able to prove that notice was given and consent obtained
• The Act also lists legitimate uses, such as using data a person voluntarily gave for the purpose they gave it

• Rule 6 lists minimum safeguards, such as encryption or masking, access control, logs and monitoring, backups, and contract terms with processors, plus retention of certain logs for one year
• On becoming aware of a breach, a business must tell each affected person without delay, and tell the Board without delay and with more detail within seventy-two hours, or longer if the Board permits
• The Schedule to the Act sets maximum penalties, for example up to two hundred and fifty crore rupees for failing to take reasonable security safeguards and up to two hundred crore rupees for failing to give breach notice
• These are ceilings, not usual outcomes: the Board must weigh gravity, duration, mitigation and proportionality
• A breach plan on one page, and knowing who to call, is cheaper than any penalty

Penalty figures are from the Schedule to the Act and the Government's November 2025 explainer. Check the current text.

• Rights to access a summary of data, to correct and update it, to erase it, to grievance redressal and to nominate someone to act for them
• Rule 9 requires the business to publish a contact person for questions on processing
• Rule 14 requires the business to publish how to make a request and to respond to grievances within a stated period, which may not exceed ninety days
• Erasing data once consent is withdrawn or the purpose is served, unless another law requires you to keep it
• Telling your processors to erase it too

• A child is anyone under eighteen
• Verifiable consent of a parent or guardian is needed before processing a child's data
• Tracking, behavioural monitoring and targeted advertising directed at children are barred
• The Rules exempt some classes, such as certain clinics and educational institutions, for stated purposes
• Coaching centres, schools, sports academies and children's retailers should take advice