The update
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with a phased rollout. Most sources place consent-manager registration at one year after notification, around 13 November 2026, though commentary differs on this point.
Core obligations on data fiduciaries, including notices, security safeguards, breach intimation, retention and children's data, follow 18 months after notification, around 13 May 2027.
Why it matters
Businesses that process personal data in India have about seven months left to put consent, retention and breach-response processes in place.
Sources
Have a project like this in mind?
Talk To Our Team →
