What India's DPDP Rules Require on Consent, Breach and Storage From 13 May 2027

India's Digital Personal Data Protection Act, 2023 now has operating rules, and they take effect in stages. The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, after a draft released on 3 January 2025.

The Data Protection Board starts first. Consent manager rules follow a year later. Most duties on companies that process personal data start 18 months after notification, on 13 May 2027, so founders and tech teams serving users in India need to map consent, breach response and storage against those dates.

The Three Dates in the Phased Timeline

Rules 1, 2 and 17 to 21 took effect on notification. They cover the Board's establishment, its powers, investigations and adjudications, and appeals to the Appellate Tribunal, according to Hogan Lovells.

Rule 4, on consent managers, applies on 13 November 2026. Consent managers have twelve months from notification to register with the Board and comply with their obligations.

Rules 3, 5 to 16, 22 and 23 apply on 13 May 2027. They cover notice and consent, security safeguards, breach intimation, retention, children's data, Significant Data Fiduciary duties, data principal rights and cross-border transfers. Teams that finish consent and breach work early will still have the 2027 date as the hard deadline for the core duties.

Consent Notices and Consent Managers

Bar and Bench notes that Section 5(2) of the Act requires a notice to data principals describing the personal data processed and the purposes. Sign-up flows, forms and in-app prompts that collect consent need that notice in place before 13 May 2027.

Consent managers are a separate category. Under Rule 4, they must register with the Board and run an accessible, transparent and interoperable platform for giving, managing, reviewing and withdrawing consent. According to Mondaq, they are solely responsible to the data principal, must be Indian companies with a minimum net worth of 2 crore rupees, and must keep consent records and notices for at least seven years.

Withdrawal has downstream effects. Personal data must be erased once its purpose is no longer served or consent is withdrawn, whichever comes first, unless another law requires it to be kept.

Breach Notice and the 72-Hour Window

Bar and Bench states that a breach must be reported within 72 hours, with a description of its nature, extent, timing, location and likely impact. The 72-hour report goes to the Board, and affected data principals must also be notified without delay.

Section 8(6) of the Act carries a ceiling of 200 crore rupees for failing to notify either the Board or affected data principals, according to Konfirmity. The pages read for this article give no separate deadline for notice to data principals, so that timing needs confirming against the Rules text before a runbook is finalised.

The Board has six months to complete an investigation, extendable by up to three months with reasons recorded, per Bar and Bench.

Storage, Retention and Cross-Border Transfers

The Rules require data fiduciaries to keep personal data, related traffic data and processing logs for at least one year from processing. Bar and Bench places this minimum in Rule 8(3), while Mondaq places the one-year rule for logs and personal data under Rule 6.

Where a processor handles the data, the fiduciary must ensure the processor keeps the data and logs for the same period. Mondaq also reports that data principals must receive notice at least 48 hours before erasure. E-commerce entities and online gaming intermediaries that meet specified user thresholds face a retention cap of three years from the data principal's last interaction for the purpose, or from commencement of the Rules, whichever is later.

On transfers, Mondaq reports that under Rule 15 the Central Government can restrict transfers of personal data to specified countries or territories outside India by notification. Under Rule 13(4), according to Bar and Bench, Significant Data Fiduciaries may not transfer traffic data relating to personal data flows outside India, and stricter sectoral laws still apply.

Penalty Ceilings Founders Should Map

Konfirmity lists the maximum penalties the Board can impose. The ceiling is 250 crore rupees for failing to take reasonable security safeguards under section 8(5). It is 200 crore rupees for section 8(6) breach notice failures and for children's data duties under section 9, and 150 crore rupees for Significant Data Fiduciary obligations under section 10. A residual band of 50 crore rupees covers breaches of any other provision.

Duties that fall on data principals carry a much smaller maximum of 10,000 rupees under section 15. The Board imposes penalties under section 33(1) after an inquiry and an opportunity to be heard.

A 500 crore figure circulating online has no basis in the Act, according to Konfirmity, which also says the 250 crore figure applies only to section 8(5) and not to every failure.

Engineering Changes to Plan For

Rule 6 lists security measures that include encryption, obfuscation, masking or tokenisation, access controls, logging and monitoring, backups, and contractual security obligations for processors, per Mondaq.

Consent work means storing consent records and notices, and making withdrawal trigger erasure jobs. Retention work means scheduling those erasure jobs, sending the 48-hour notice and keeping logs for at least a year.

Request handling has a clock too. Under Rule 14(3), responses to data principal requests are due within 90 days, according to Bar and Bench. Breach work means a runbook that captures the required description fields and can file within 72 hours.

Significant Data Fiduciaries carry extra duties under Rule 13: a data protection officer based in India, an independent data auditor, and a DPIA report to the Board at least once every 12 months, per Mondaq. The pages read for this article do not set out the criteria for designation.