DPDP Rules 2025: Timeline and Deadlines
The DPDP Rules, 2025 were published in the Gazette on 13 November 2025. They switch on in three stages. This page shows each date, the fixed time limits you must remember, and what a small company should do in each stage. This DPDPA 2023 course page explains timeline and deadlines in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Advertisement
The three dates (tap each step) (timeline and deadlines)
Tap or click a step to see exactly what to do.
–until Consent Manager rule (Rule 4)
–until core duties start
Dates are counted from the Gazette publication date of 13 November 2025. Confirm them on the MeitY website, and note that the main Act provisions apply together with these Rules.
Fixed time limits to remember
| What | Time limit | Where |
|---|---|---|
| Tell the Board about a breach (basic facts) | Without delay | Rule 7(2) |
| Detailed breach report to the Board | Within 72 hours (longer only if the Board allows on your written request) | Rule 7(2) |
| Tell each affected person about a breach | Without delay, through their registered account or contact method | Rule 7(1) |
| Warn a person before erasing their data (large platforms) | At least 48 hours before | Rule 8 |
| Erase data of inactive users (large e-commerce, gaming, social media) | After 3 years of no contact | Third Schedule |
| Keep logs and related data | At least 1 year | Rules 6 and 8 |
| Answer a grievance | A reasonable time, never more than 90 days | Rule 14 |
| Consent Manager keeps consent records | 7 years | First Schedule |
| Significant Data Fiduciary: DPIA and audit | Once every 12 months | Rule 13 |
| Board must finish an inquiry | 6 months (can be extended by up to 3 months with reasons) | Rule 19 |
| Appeal against a Board order | Digital appeal to the Appellate Tribunal (the Act sets 60 days) | Rule 22, Section 29 |
Advertisement
What a small company should do in each stage (timeline and deadlines)
Now to 13 November 2026
- Name one person as your privacy contact (you will publish the details later under Rule 9).
- Build a simple data inventory: what personal data, where, why, who sees it.
- List all vendors who touch personal data.
- Check three flags: do you handle children’s data, send data abroad, or have huge user numbers.
13 November 2026 to 13 May 2027 (timeline and deadlines)
- Rewrite your privacy notice and consent screens.
- Put the security controls in place (encryption, access control, logging, backups).
- Create the rights-request and breach-response procedures and test them once.
- Fix vendor contracts and set a retention schedule.
From 13 May 2027
- Run the processes. Keep an evidence folder.
- Review each quarter. Run a breach drill and a small internal audit every year.
Tip
Use the 90-day playbook to turn these stages into a checklist you can finish without a consultant.
Use the 90-day playbook to turn these stages into a checklist you can finish without a consultant.
Related guides (timeline and deadlines)
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.
Official sources for timeline and deadlines: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.