What Are the DPDP Rules and What Changed?
Key takeaways
- The Rules apply the 2023 Act's obligations in phases, and the consent manager, breach and grievance obligations for data principals are the phase that matters most to an Indian business from May 2027.
- A consent notice has to be clear, plain and available in English or any of the 22 scheduled languages, and it must list the purposes, the data categories, the retention period and the grievance contact.
- The 72-hour breach notification to the Data Protection Board and to affected data principals sits alongside CERT-In's separate 6-hour reporting duty, and the two are different obligations with different clocks.
- Every data fiduciary must have a grievance officer and a grievance process, with an acknowledgement within the time the Rules specify and a documented response to each complaint.
- Notice, consent and erasure duties are the part of the Act that a customer, a prospect or a regulator will actually test, so they should be built into the product rather than into a policy document.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What did the DPDP Rules 2025 actually change?
The Act of 2023 set out the shape of the regime: who is a data fiduciary, what notice and consent mean, what the data principal's rights are, and that the central government may notify a data fiduciary as significant. The Rules are what make that operable. They specify the content and language of the consent notice, the form of the notice, the channels through which a data principal can reach the data fiduciary, the operational steps for access, correction, erasure, grievance redress and nomination, and the reporting of breaches. For an Indian business, the change in practical terms is that obligations move from a legal concept to a checklist: a form, a channel, a response time and a record.
What are the phased commencement dates an Indian company must plan around?
The Rules are not one date. The obligations on data fiduciaries other than significant data fiduciaries, including the notice, consent and grievance-handling duties, are the ones that bite first for most businesses, and the 2025 notification set them out in stages with the data principal obligations running from May 2027. That gives a normal company roughly a year of runway to put notice, consent management, a grievance process and breach procedures in place. The significant data fiduciary obligations, including appoint-a-DPO, independent audit and Board reporting, are notified separately, and the phased calendar is worth recording in your compliance file.
How does the 72-hour breach notification work?
Under the Rules, a data fiduciary must notify the Data Protection Board and every affected data principal of a personal data breach without delay, and in any case within 72 hours of becoming aware of it. The notification carries specified content: what happened, the categories and approximate numbers of data principals affected, the likely consequences, and the measures taken or proposed. The 72-hour clock is different from CERT-In's 6-hour clock, and they run in parallel, so an Indian incident response plan has to serve both. The practical consequence is that breach assessment cannot wait for a complete forensic picture; the initial notification is made on what is known, and updated as facts settle.
What must a consent notice and a grievance process actually contain?
A consent notice has to be in clear and plain language, in English or one of the 22 languages in the Eighth Schedule, and it must state the purpose of the data, the categories of data and the data principal's rights, the contact details of the data fiduciary and the grievance officer, the retention period, and any provision for transferring data outside India. The grievance process needs a named officer, an accessible channel, a reasoned response within the timeline the Rules set, and a record of every complaint. The failure mode in Indian businesses is a privacy policy written once by a lawyer and never connected to the product, so the notices do not match what the app does.
| Obligation | What the Rules require | Artefact that proves compliance |
|---|---|---|
| Consent notice | Clear notice in English or an Eighth Schedule language, with purpose, data categories, rights and retention | Published notice and the in-product notice actually shown |
| Consent management | Free, informed and specific consent, with a withdrawal route | Consent records with timestamp, notice version and channel |
| Data principal rights | Access, correction, erasure, grievance redress and nomination | Request log with response dates and closure evidence |
| Breach notification | Notify the Board and affected data principals within 72 hours of awareness | Notification copy, timeline of awareness and updates issued |
| Grievance officer | Named officer, accessible channel, reasoned response | Published contact, ticket register and monthly closure report |
| Significant data fiduciary | DPO, independent audit and periodic Board reporting | Appointment letter, audit report and Board minutes |
What are the frequently asked questions?
Get a straight answer on this
Send us your current privacy notice and data flow, and we will return a DPDP gap map with the artefacts you are missing for each obligation.
Send us the details See pricing