What a business that handles personal data should be preparing under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. General legal information only.
Timeline
The DPDP Rules, 2025 were notified on 13 November 2025 with a phased rollout. The Consent Manager framework begins on 13 November 2026, and the main data-fiduciary obligations begin on 13 May 2027, unless the timeline is changed. Check the current position before relying on these dates.
Checklist
- Map your data: what personal data you collect, why, where it is stored and who receives it.
- Notice and consent: clear notices and valid consent for the stated purposes, with an easy way to withdraw.
- Rights of individuals: a process to handle requests to access, correct and erase data, and grievances.
- Security safeguards: reasonable technical and organisational measures.
- Breach response: a protocol for notifying the Data Protection Board and affected individuals.
- Children’s data: additional care and verifiable parental consent where children’s data is processed.
- Vendors and processors: written contracts that bind processors to your obligations.
- Retention: delete data when the purpose is served unless the law requires retention.
Enforcement
The Data Protection Board of India enforces the Act, and appeals lie to the Telecom Disputes Settlement and Appellate Tribunal. The Act provides for significant monetary penalties. See the DPDP practice page.
How can Wise & Partners help?
The firm can run a short readiness assessment and prepare notices, policies and vendor terms. No regulatory outcome can be promised.
Important disclaimer: This article is general legal information, not legal advice. It does not create a lawyer-client relationship and is not an advertisement or solicitation under Bar Council of India rules. Verify current statutes, rules and judgments before relying on it.
