The DPDP enforcement timeline, explained for founders

India's Digital Personal Data Protection Act became law in August 2023, but a law of this kind only bites once its rules are in place. The DPDP Rules, 2025 were notified on 13 November 2025, and they switch the Act on in phases rather than all at once. For a founder, the useful question is simple: what do I have to do, and by when?

The three dates that matter

• 13 November 2025 — the Rules are notified. The provisions that set up the Data Protection Board of India take effect straight away.
• November 2026 — about a year in, the provisions for registering consent managers take effect.
• 13 May 2027 — eighteen months after notification, the bulk of the obligations on businesses take effect: notice and consent, reasonable security safeguards, and breach notification.

The 18-month gap is a preparation window, not a grace period for breaches that happen after it closes. From 13 May 2027, a personal data breach at your company has to be reported, and the Board can impose penalties if it isn't.

What "no minimum breach size" means

Some data protection laws only require you to notify when a breach is likely to cause harm. The DPDP Act doesn't set a threshold like that. A personal data breach is defined broadly: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.

In practice, a 20-person startup that leaks one customer spreadsheet has the same duty to notify as a large company that loses millions of records. Both must tell the Board and every affected person.

The penalties, in plain numbers

• Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach.
• Up to ₹200 crore for failing to notify the Board and affected people of a breach.

These are maximums, and the Board has to consider factors such as the nature and duration of the breach when it sets an amount. But they are separate heads: a company can be penalised both for weak safeguards and for failing to report.

What to do before May 2027

1. Know where personal data lives: which systems, which spreadsheets, which vendors.
2. Put reasonable safeguards in place, including a way to detect unauthorised access. You can't report a breach you never notice.
3. Decide who owns breach response, and write down the steps: who investigates, who informs the Board, who writes to customers.
4. Remember that CERT-In's 6-hour reporting rule already applies today, for cyber incidents of many kinds. DPDP adds to it; it doesn't replace it.