If your product collects emails, phone numbers or payment details from people in India, the Digital Personal Data Protection (DPDP) Rules, 2025 apply to you, and the calendar matters. The Rules were published on 13 November 2025 with a staggered start. The next date, 13 November 2026, is less than two weeks away. The date that carries most of the work for a startup is 13 May 2027.
This guide separates what the Gazette text actually switches on and when from what founders tend to assume. It is an explainer built from the Rules as published and the government's own press note, not legal advice, and we re-read the sources on 31 October 2026.
The short answer
Three clocks run from the Gazette date of 13 November 2025. Rules 1, 2 and 17 to 21 took effect on publication. Rule 4, which sets up consent managers, takes effect one year after publication, so on 13 November 2026. Rules 3, 5 to 16, 22 and 23 take effect eighteen months after publication, so around 13 May 2027. Most of what a product team builds or rewrites sits in that last group: notices, security safeguards, breach reporting, retention, children's data and the contact point for questions.
So on 13 November 2026 your checkout does not suddenly need a new consent flow. What changes is that the consent manager framework opens. The real deadline for your own product is May 2027, and the sensible reading of that gap is that it is build time, not spare time.
What actually starts when
| Date | What the Rules switch on |
|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21, which cover the short title, definitions and the provisions around the Data Protection Board |
| 13 November 2026 | Rule 4: registration and obligations of consent managers |
| About 13 May 2027 | Rules 3, 5 to 16, 22 and 23: notice, safeguards, breach intimation, retention, contact details, children's data and more |
The commencement lines are in Rule 1 of the Gazette notification G.S.R. 846(E). The Act itself also commences in stages, and an October 2026 timeline from the compliance firm Network Intelligence reads the same three phases: Board and foundational provisions in November 2025, consent managers in November 2026, and the core compliance framework in May 2027. Treat that firm's summary as a secondary reading, and the Gazette as the authority.
What a consent manager is, and why it is not your problem yet
The government's press note describes consent managers as entities that help individuals manage their permissions, and says they must be Indian companies. Under Rule 4, a person who meets the conditions in Part A of the first schedule can apply to the Board for registration.
For a startup that collects personal data, this phase is mostly about watching. You are not required to become a consent manager and, as far as the Gazette text we read shows, you are not required to integrate with one on 13 November. Your own consent notice duties arrive with the later group of Rules. If you were planning to build a consent product, this is the date registration opens, and the eligibility conditions are in the Rules' first schedule.
What the May 2027 group asks of a product team
These are the obligations in the Gazette text that most directly shape a SaaS or app roadmap. Each is worded in the Rules at a level of detail that your counsel should read in full.
- Notice (Rule 3). The notice to the person must be presented on its own, understandable without other information, in clear and plain language. It must give an itemised description of the personal data and the specific purpose of each use, and say how the person can withdraw consent, exercise their rights and complain to the Board. The Rules also say withdrawal must be as easy as giving consent.
- Security safeguards (Rule 6). At a minimum: encryption, obfuscation, masking or virtual tokens; controls on access to the computer resources used; logs, monitoring and review to detect unauthorised access; backups so processing can continue after loss; retention of those logs for one year; processor contracts with appropriate security provisions; and technical and organisational measures to make all this work.
- Breach intimation (Rule 7). On becoming aware of a breach, you tell each affected person without delay, in plain language, and tell the Board without delay. Within 72 hours, or a longer period the Board allows in writing, you send the Board detailed information on causes, mitigation and the findings.
- Retention (Rule 8). Certain classes of data fiduciary must erase personal data once the specified purpose is over, and must warn the person at least 48 hours before erasure. Separately, personal data, traffic data and processing logs must be kept for a minimum of one year for the purposes in the seventh schedule.
- Contact point (Rule 9). Publish the business contact details of a data protection officer, if you have one, or of a person who can answer questions about processing, on your website or app and in every reply to a rights request.
- Children (Rule 10). Before processing a child's personal data you need verifiable consent from a parent, and you must check that the person claiming to be the parent is an adult. The Rules define an adult as someone who has completed eighteen years of age.
The press note adds that people can ask to access, correct, update or erase their data, and that requests must be answered within a maximum of 90 days.
What founders commonly get wrong
"The Rules are not in force, so we can wait." Parts are in force now, and the substantive group has a fixed start. Eighteen months is enough time to map data, rewrite a notice and test breach handling, and not much more.
"We are small, so this does not apply." The press note describes a facilitative regime for startups and smaller enterprises. It does not say startups are exempt. Do not plan on an exemption you cannot point to in a notification.
"Our logs are an engineering detail." Rule 6 and Rule 8 both turn on logs. If you delete application logs after seven days to save cost, you need to check that against the one-year requirement before May 2027.
"A security certificate covers it." Your ISO or SOC reports show good practice, but the Rules have their own notice, rights and breach requirements. Use the certificate as evidence for Rule 6, not as a substitute for the rest.
A 90-day plan for a small team
- Map personal data. List every place a name, email, phone number or payment reference lands: database, analytics, support desk, email tool, backups, logs.
- List your processors. For each vendor, check whether the contract has security provisions you can point to. Rule 6 expects them where processors are involved.
- Draft the notice. One page, plain language, each purpose stated separately, with a withdrawal route as easy as the sign-up route.
- Rehearse a breach. Write down who tells the people, who tells the Board, and who can compile the 72-hour report. Run it once.
- Check retention and logs. Set a retention rule per data type and keep access logs for a year.
- Name a contact. Pick the person or role who will answer privacy questions and publish the details.
- Decide on children. If under-18s can sign up, decide whether to block them or build verifiable parental consent.
If you handle payments, our guide to how a payment gateway works in India shows where card and UPI data sits and which part is the gateway's. For a method to check the security claims another startup makes before you share data with it, see how to check a startup's CERT-In empanelled audit claim.
Frequently asked questions
What happens on 13 November 2026?
Rule 4 takes effect, which opens the registration framework for consent managers. The notice, safeguards and breach Rules for your own product start later, around 13 May 2027.
Do I need a data protection officer?
Rule 9 asks you to publish a data protection officer's contact details "if applicable", or the contact of a person who can answer questions. The Rules as we read them do not require every startup to appoint a data protection officer. Significant data fiduciaries carry extra duties, and your counsel should check whether you could be designated one.
How fast must I report a breach?
Tell affected people without delay and tell the Board without delay. Detailed information goes to the Board within 72 hours of becoming aware, unless the Board allows longer in writing.
Can I keep logs for less than a year?
Rule 6 requires logs to be retained for one year for detecting and investigating unauthorised access, and Rule 8 sets a one-year minimum for personal data, traffic data and processing logs for the stated purposes, unless another law requires longer. Check both with counsel before shortening anything.
Are startups exempt?
Do not assume so. The press note calls the regime facilitative for startups and smaller enterprises, which is not an exemption. If a notified exemption applies to you, you should be able to point to it.
Sources checked on 31 October 2026
- Ministry of Electronics and Information Technology: The Digital Personal Data Protection Rules, 2025, Gazette notification G.S.R. 846(E), 13 November 2025
- Press Information Bureau: Government notifies DPDP Rules to empower citizens and protect privacy, 14 November 2025
- Network Intelligence: DPDP Act Compliance Timeline, 8 October 2026
This is general information and not legal advice. When your startup is ready for customers, you can list it on SuperLaunch and browse the startup perks directory for tools that help with launch costs.
