10 min read · Jun 2026

Vishwaas.AI Guide to India’s Digital Personal Data Protection Act (DPDP), Rules 2025 and Emerging Compliance Priorities

B1 I1.png # Vishwaas.ai Guide to India's Digital Personal Data Protection Act (DPDP), Rules 2025 and Emerging Compliance Priorities

Overview

India's Digital Personal Data Protection Act, 2023 (DPDP Act) is the country's first comprehensive, dedicated statute for digital personal data privacy, enacted on 11 August 2023 and notified as Act No. 22 of 2023. It recognizes the fundamental right to privacy while enabling lawful, secure processing of personal data for innovation, governance, and national security. The Digital Personal Data Protection Rules, 2025 (DPDP Rules) operationalize the Act and were notified in November 2025 with a phased enforcement timeline running through May 2027.

For product companies, SaaS platforms, and digital businesses, DPDP is not just a legal requirement but a design principle-privacy by design, consent-centric experiences, and accountable data governance are now foundational expectations from users, regulators, and partners.

Legislative Genesis and Objectives

DPDP emerged from a multi-year policy debate following the Supreme Court's recognition of privacy as a fundamental right in Justice K.S. Puttaswamy v. Union of India (2017), and several draft data protection bills between 2018 and 2022. The Act's objectives can be summarized as:

Protecting individuals' right to protect their personal data, especially in the digital economy.
Providing a clear legal framework for lawful data processing by the State and private entities.
Establishing a specialized regulator-the Data Protection Board of India-to enforce the regime.

Scope: Who and What DPDP Covers

The Act applies to digital personal data processed within India and to processing outside India when it relates to offering goods or services to individuals in India. Personal data is defined broadly as any data about an individual who is identifiable by or in relation to such data. The Act primarily uses two role concepts:

Data Principal: the individual whose personal data is being processed.
Data Fiduciary: any entity (company, startup, government department) that determines the purpose and means of processing.

Data Processors act on behalf of Data Fiduciaries but remain bound by contractual and statutory obligations under DPDP and the Rules.

Seven Foundational DPDP Principles

Commentaries on the Act consistently highlight seven foundational principles underpinning DPDP's approach to privacy and governance:

Lawful, fair and transparent processing.
Purpose limitation (data is collected only for specific, clear purposes).
Data minimisation (only data necessary for the stated purpose).
Accuracy of personal data.
Storage limitation (retain only as long as necessary).
Integrity and confidentiality (security safeguards).
Accountability of Data Fiduciaries.

These principles are reflected across obligations in Sections 4–10 of the Act and corresponding operational requirements in the Rules.

Key Rights of Data Principals

DPDP strengthens individual control over personal data through a set of rights exercisable against Data Fiduciaries:

Right to access: receive a summary of what data is processed, purposes, categories of personal data and recipients.
Right to correction and erasure: request correction of inaccurate data, completion of incomplete data, and erasure when the purpose is served or consent is withdrawn.
Right to grievance redressal: access a structured mechanism for complaints and escalation to the Data Protection Board.
Right to nominate: appoint another individual to exercise rights in the event of death or incapacity.

The DPDP Rules require Data Fiduciaries to publish clear, accessible mechanisms-typically via websites or apps-for Data Principals to submit such requests, including identifiers to track and resolve them, and mandate resolution of grievances within a maximum of 90 days.

Core Obligations of Data Fiduciaries

The Act's heart lies in Sections 4–10, which lay down how Data Fiduciaries must approach processing:

Grounds for processing: primarily consent, with specified legitimate uses by the State and certain entities.
Notice: itemized, plain-language notices explaining what data is collected, why, retention, rights, and contact channels.
Consent: free, specific, informed, unconditional, revocable; based on clear affirmative action.
General obligations: implement reasonable security safeguards, maintain accuracy, prevent unauthorized processing, and adopt privacy by design.
Children and persons with disabilities: obtain verifiable consent from parents or lawful guardians, avoid harmful processing such as behavioral monitoring and targeted advertising to children.
Significant Data Fiduciary (SDF): entities designated based on volume, sensitivity, and risk must meet enhanced obligations such as appointing a Data Protection Officer (DPO), conducting annual DPIAs, and independent audits.

DPDP Rules 2025: Operationalizing the Act

The Digital Personal Data Protection Rules, 2025 translate the Act's principles into concrete processes and controls across notices, consent, retention, breach response, and governance. Key operational themes include:

Detailed requirements for notices and consent, including communication links and itemized data category disclosures.
Registration, conditions, and obligations of Consent Managers (neutral platforms that help Data Principals manage and withdraw consents across services).
Standards for processing by the State and its instrumentalities, particularly for subsidies, benefits, and service delivery.
Reasonable security safeguards, breach notification workflows, and retention/erasure requirements, with sector-specific thresholds for e‑commerce, social media, and gaming platforms.
Special rules for processing children's and PWDs' data, focusing on verifiable consent and protection from harmful profiling.
Establishment and functioning of the Data Protection Board as a digital‑first regulator with defined powers, procedures, and appellate mechanisms.

Enforcement Timeline: 2025–2027

DPDP is being implemented in three phases to give organizations time to build compliance while gradually activating regulatory teeth:

Phase 1 – November 2025: Commencement provisions, core definitions, and establishment of the Data Protection Board come into force.
Phase 2 – November 2026: Enforcement powers and penalties regime (Sections 27–34) activate, along with registration and oversight of Consent Managers.
Phase 3 – May 2027: Full operational obligations-notice, consent, data‑principal rights, breach reporting, security safeguards, cross‑border transfer, SDF obligations-become mandatory.

By 13/14 May 2027, organizations processing digital personal data of individuals in India must be fully compliant with the DPDP Act and Rules.

This phased approach means the Board and parts of the regime are already live, while financial penalties up to ₹250 crore for certain violations become enforceable from November 2026.

Breach Notification and Incident Response

The Act defines a personal data breach as any unauthorized or accidental compromise of confidentiality, integrity, or availability of personal data, requiring prompt notice to the Board and affected individuals. The DPDP Rules build on this by requiring Data Fiduciaries to:

Notify the Data Protection Board without unreasonable delay, and generally within 72 hours of becoming aware of a breach, with a detailed incident report.
Communicate with affected Data Principals with clear information on the nature of the breach, possible consequences, steps taken, and actions they can take to protect themselves.
Maintain incident response plans, logs, and evidence to support regulatory investigations and follow‑up audits.

Sector guidance increasingly emphasizes coordination between DPDP obligations and other Indian regimes such as CERT‑In's six‑hour reporting rule, underscoring the need for integrated breach playbooks rather than siloed responses.

Data Retention and Erasure Expectations

Under DPDP, personal data should be erased when the specified purpose is no longer being served or when consent is withdrawn, subject to legal retention requirements. The DPDP Rules introduce more granular retention norms, including:

Mandatory retention of personal data, traffic data, and processing logs for at least one year from the date of processing for specified purposes in the Seventh Schedule.
Sectoral timelines requiring large e‑commerce, social media, and online gaming entities above certain user thresholds to delete personal data within three years of last interaction, with prior notification to individuals.
Structured workflows and communication requirements for erasure, including informing individuals before data is deleted.

These rules push organizations towards lifecycle‑based data governance-linking collection, use, retention, and destruction into a continuous, auditable process.

Children and Persons with Disabilities: Extra Safeguards

DPDP treats children's and certain PWDs' personal data as especially sensitive from a rights and harm perspective. The Rules specify operational requirements for verifiable parental or guardian consent, including:

Verifying that the person identifying as a parent is an identifiable adult using mechanisms like virtual tokens mapped to age and identity issued by authorized entities.
Restricting behavioral monitoring, tracking, and targeted advertising directed at children, with targeted exemptions for healthcare professionals, educational institutions, and child transport providers.
Providing a separate framework for consent to process personal data of certain PWDs who cannot make legally binding decisions even with support.

For product managers, this translates into deliberate design choices around default settings, age‑verification flows, content and advertising policies, and logging of consent evidence.

Significant Data Fiduciary (SDF) Obligations

Entities classified as Significant Data Fiduciaries must implement advanced governance and transparency measures proportionate to their scale and risk. The Rules elaborate that SDFs must:

Appoint a dedicated Data Protection Officer who reports to the Board or a senior leadership function.
Conduct annual Data Protection Impact Assessments (DPIAs) covering processing operations and risk mitigations.
Undergo annual independent audits of DPDP compliance and technical safeguards.
Perform due‑diligence to ensure their technical measures, including algorithms, do not pose risks to Data Principal rights, with expanded scope beyond just algorithmic software.
Implement enhanced controls over cross‑border transfers where restricted by the Central Government based on committee recommendations.

For large platforms, SDF designation effectively embeds privacy and algorithmic accountability into mainstream risk and compliance programs.

Cross‑Border Transfers and Localization Nuances

DPDP allows cross‑border transfers of personal data except to countries or territories that the Central Government may notify as restricted, based on several criteria. Commentary highlights that, unlike some earlier draft bills, the Act avoids blanket data localization but builds flexible restriction levers that can be activated through Rules and notifications. The DPDP Rules further contemplate committees and due‑diligence requirements for SDFs around such transfers and related traffic data.

Organizations with global architectures must therefore track country blacklists (if notified), contractual safeguards, and technical controls such as access governance, encryption, and segmentation when moving data outside India.

Emerging Themes and Recent Updates (2025–2026)

Since notification of the DPDP Rules, expert analyses and sector briefings have highlighted several emerging themes:

Stricter expectations around AI and algorithmic transparency, particularly for SDFs using profiling or automated decision‑making.
Heightened scrutiny of child‑data processing and online platforms offering high‑risk content or features for minors.
Increased regulatory focus on breach preparedness, incident drills, and timely dual reporting under CERT‑In and DPDP.
Government corrigenda and clarifications to the DPDP Rules, reflecting iterative refinement while retaining the core architecture.

Daily newsbriefs and practitioner blogs track enforcement trends such as bans, investigations, and sector‑specific guidance, underscoring that DPDP is a living regime that will evolve with technology and practice.[10][25]

What This Means for Product Teams and SaaS Platforms

From a product and engineering lens, DPDP demands embedding privacy and compliance into the lifecycle rather than treating it as a post‑hoc legal checklist:

Discovery and design: map personal data flows, define lawful grounds, and design consent UX that is granular, transparent, and revocable.
Build and deploy: implement role‑based access, encryption, logging, DPIA‑driven controls, and APIs for rights (access, correction, erasure, portability where applicable).
Operate and respond: maintain breach playbooks, retention policies, and governance dashboards aligned with DPDP metrics and Board expectations.

DPDP-aligned platforms such as consent management tools, breach response coordinators, and compliance orchestration products can help organizations operationalize these requirements at scale.

Conclusion

The DPDP Act and DPDP Rules mark a decisive shift in India's digital economy-from data extraction to data stewardship, from opaque tracking to accountable, rights‑based processing. With phased enforcement, organizations have a finite but clear runway to build privacy‑first capabilities across products, processes, and culture.

For SaaS teams, founders, and product managers, engaging deeply with DPDP is now core business work. Those who invest early in consent‑centric UX, robust security, and transparent governance will not only reduce regulatory risk but also build lasting trust with their users and partners in India's evolving data ecosystem.