DPDP Rules notified; core data-protection duties apply from 13 May 2027

The Digital Personal Data Protection Rules were notified on 13 November 2025. Consent managers register from 13 November 2026 and core duties apply from 13 May 2027.

Effective or announced 13 November 2025Impact for foreign investors: high

What changed

MeitY notified the DPDP Rules on 13 November 2025 under the Digital Personal Data Protection Act 2023. The Data Protection Board started at once, consent managers register from 13 November 2026, and notice, consent and breach-reporting duties apply from 13 May 2027. Penalties reach ₹250 crore for failing to take reasonable security safeguards.

Who it affects

Any business processing personal data in India, including GCCs, SaaS providers, fintechs and online retailers.

What to do

Map personal data flows, update notices and consent processes, and set up breach reporting before 13 May 2027. GCCs should align group data agreements with the Rules.

Planning your move into India?

Talk to IMC about your entry structure, approvals, incentives, tax and the first year of compliance.

Book a discovery conversation