Compliance checklist
DPDP Rules 2025 Compliance Checklist
By the Invield security team · Updated 7 October 2026
The Digital Personal Data Protection Act, 2023 (DPDP Act) became operational when the Government notified the Digital Personal Data Protection Rules, 2025 in November 2025. The Rules come into force in phases over 18 months, with most obligations applying from May 2027.
Use this checklist to see what you need to do, and by when. It is a practical summary, not legal advice.
Key points
- November 2025: the Data Protection Board of India provisions took effect.
- November 2026: Consent Manager registration opens (12 months after notification).
- May 2027: most Data Fiduciary obligations apply, including notices, consent, security safeguards, breach reporting and data principal rights (18 months after notification).
- Penalties go up to ₹250 crore per instance for failing to take reasonable security safeguards.
DPDP Rules 2025 timeline
| When | What applies |
|---|---|
| November 2025 (on notification) | Data Protection Board of India set up and its procedures |
| November 2026 (12 months) | Registration and obligations of Consent Managers |
| May 2027 (18 months) | Notices, consent, security safeguards, breach intimation, data retention and erasure, data principal rights, children's data, Significant Data Fiduciary duties |
DPDP compliance checklist
- Map your personal data: what you collect, why, where it is stored, who you share it with and how long you keep it.
- Confirm your role: are you a Data Fiduciary, a Data Processor, or both? Could you be notified as a Significant Data Fiduciary?
- Rewrite your notices: clear, standalone notices in plain language, listing the data, the purpose and how to exercise rights or complain to the Board.
- Fix consent: free, specific, informed and unambiguous, with withdrawal as easy as giving consent. Keep records.
- Set up rights handling: access, correction, erasure, grievance redressal and nomination, with response times published. Grievances must be resolved within a maximum of 90 days.
- Apply security safeguards: encryption, obfuscation or masking, access control, monitoring, backups, and keeping logs for at least one year.
- Prepare for breaches: inform affected people and the Board without delay, and send a detailed report to the Board within 72 hours.
- Set retention and erasure: delete data when the purpose ends, and give people 48 hours' notice before erasure where the Rules require it.
- Handle children's data: verifiable parental consent for users under 18, and no tracking or targeted advertising directed at children.
- Update contracts: data processing terms with every processor and vendor.
- Publish a contact: the business contact information of a DPO, or a person who can answer questions about processing.
- Train your people and test the breach playbook.
DPDP Act penalties
Penalties are set out in the Schedule to the DPDP Act and imposed by the Data Protection Board after an inquiry. The maximum amounts are:
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board and affected people of a breach | ₹200 crore |
| Breach of obligations for children's data | ₹200 crore |
| Breach of additional obligations of Significant Data Fiduciaries | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of duties by a Data Principal | ₹10,000 |
The Board considers the nature, gravity and duration of the breach, whether it was repeated and what was done to mitigate it.
Significant Data Fiduciaries and the DPO
The Government can notify an organisation as a Significant Data Fiduciary based on the volume and sensitivity of data it processes and the risk to people. Significant Data Fiduciaries must appoint a Data Protection Officer based in India who reports to the board, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and audit every year.
Other organisations do not have to appoint a DPO, but they must publish contact details of someone who can answer questions about how they process personal data. Many choose DPO-as-a-service: an experienced external privacy team that runs the privacy office, handles requests and keeps the programme current, alongside the person you name internally. See our DPDP Act compliance consulting.
Frequently asked questions
Get a DPDP gap assessment
Our DPDP compliance consultants map your data, find the gaps and give you a prioritised plan to the May 2027 deadline.