India's data protection law is coming into force in three stages. Two have already started. The third carries almost every duty a company has towards its customers and employees, and it starts on 13 May 2027. That leaves about six months, and the first step, finding out what personal data you hold, often takes two or three of them.
Three dates
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. They set the timetable for the Act that Parliament passed in 2023.
- 13 Nov 2025Rules notifiedIn force
Definitions and the Data Protection Board provisions take effect.
- 13 Nov 2026Consent Managers can registerIn force
Indian companies with a net worth of at least ₹2 crore can apply to manage consent for others.
- 13 May 2027Main duties beginComing
Notice, consent, security, breach reporting, erasure, children's data and people's rights.
In January 2026, the Ministry of Electronics and IT (MeitY) consulted on shortening the 18 months to 12. Nothing has been notified. The date in force is still 13 May 2027.
Does the law apply to you?
Almost certainly. The Act covers digital personal data processed in India, including paper records that are later scanned or typed in. It also covers processing outside India when it is connected with offering goods or services to people in India, so a foreign company selling into India is covered too.
Personal data is any data about a person who can be identified: customers, prospects, employees, job applicants, your vendors' staff. A B2B company with no consumer customers still holds payroll records, CVs and a CRM full of names and phone numbers.
Employee data gets some relief. The Act lets an employer process personal data for employment purposes without asking for consent. The duties to keep it secure and to report breaches still apply.
What changes on 13 May 2027
The Act calls a company that decides why and how personal data is processed a Data Fiduciary. From May, a Data Fiduciary must meet these duties:
| Duty | What it means in practice |
|---|---|
| Notice | Tell people in plain language what data you collect and why, item by item |
| Consent | Ask for consent for a specific purpose, and make withdrawing it as easy as giving it |
| Security | Put reasonable safeguards in place, and keep logs and the related data for at least one year |
| Breach reporting | Tell affected people without delay, and tell the Data Protection Board without delay, with a detailed report within 72 hours |
| Erasure | Delete data once its purpose is served, unless another law requires you to keep it |
| Children | Get verifiable consent from a parent before processing the data of anyone under 18 |
| Rights | Let people access, correct and erase their data, and resolve grievances within 90 days at most |
Large platforms have one more duty. E-commerce and social media companies with 2 crore or more registered users in India, and online gaming companies with 50 lakh or more, must erase a user's data after three years of inactivity, with 48 hours' notice to the user.
Significant Data Fiduciaries
The government can notify some companies as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of the data they handle. These companies must appoint a Data Protection Officer based in India and an independent data auditor, and carry out a Data Protection Impact Assessment and an audit every year. If your business processes health, financial or children's data at scale, plan as if this could apply to you.
The penalties
| Failure | Penalty up to |
|---|---|
| Not taking reasonable security safeguards | ₹250 crore |
| Not reporting a breach to the Board or to affected people | ₹200 crore |
| Not meeting the duties on children's data | ₹200 crore |
| Not meeting the extra duties of a Significant Data Fiduciary | ₹150 crore |
| Breaching any other provision of the Act or Rules | ₹50 crore |
These are ceilings. The Data Protection Board sets the amount case by case, looking at the nature, gravity and duration of the breach, the type of data involved and what the company did to limit the harm.
The government advertised for the Board's chairperson and four members in May 2026. Some companies read the time taken to fill the Board as a reason to wait. The duties apply from 13 May 2027 whatever the state of the Board.
A plan for the next six months
- 1Map your personal data
What you hold, where it sits, why you hold it and which vendors touch it. Include HR and the CRM.
- 2Collect less
Stop collecting fields you never use, and set a retention period for each data set.
- 3Rewrite your notices
Plain language, item by item, with an option to read them in English or any language in the Eighth Schedule.
- 4Fix consent flows
Separate consent for each purpose, easy withdrawal and a record of every consent given.
- 5Set up a rights desk
Publish who to contact, and a process to answer access, correction and erasure requests and grievances.
- 6Rehearse a breach
Write the response plan, name who calls whom and practise the 72-hour report to the Board.
- 7Update vendor contracts
Cover security, breach reporting and deletion for every processor that handles your data.
- 8Check for children's data
If minors can use your service, plan how you will get verifiable parental consent.
Common mistakes
Reading 13 November 2026 as the deadline. That date was for Consent Managers, a new kind of registered company that manages consent on others' behalf. The duties that touch most companies start in May 2027.
Treating it as a cookie banner. Notice and consent matter, but most of the work sits behind the website: what you store, for how long, who can see it and what happens when something leaks.
Forgetting employees and vendors. HR systems, payroll providers, recruitment agencies and call centres all hold personal data on your behalf. Their mistakes become your breach.
Leaving it to IT. Marketing decides what is collected, HR holds the most sensitive records and legal owns the contracts. The work needs one owner with authority across all of them.
