.jpg){kind=link}
India’s data protection law is being brought in step by step. The Digital Personal Data Protection Rules, 2025, were notified by the Ministry of Electronics and Information Technology on 14 November 2025, according to Wikipedia, although some law-firm summaries give 13 November. The rules set an 18-month transition, so the full set of obligations takes effect around mid-May 2027, with 2026 treated as a year to build and test compliance.
The first phase took effect on notification. It covers the provisions on setting up the Data Protection Board of India, which is envisaged as a body that works online, with its proceedings conducted digitally. Search results say that the Board has four members and a head office in the National Capital Region, but the sources reviewed for this article give the details of its composition only in summary form.
A middle phase falls about a year after notification. An India Briefing timeline says that around 13 and 14 November 2026 the Board shifts towards active supervision. Another summary says that the rule on registration and functioning of consent managers comes into force on 13 November 2026, while a third timeline expected the consent manager ecosystem to become operational between June and August 2026. These accounts differ, so companies should check the official notification for the exact date.
Consent managers are a new kind of intermediary. They are meant to let people manage, review or withdraw their consent across many digital services from one place. The idea is to give individuals a single point of control, but it also creates a new set of regulated firms that will have to register.
The final phase is in May 2027. At around 13 and 14 May 2027 the transition ends and the Board gets its full adjudicatory power, including the power to impose penalties. The maximum penalty for major violations is Rs 250 crore, or about $26 million, according to India Briefing. Before then, the 2026 period is described as one in which enforcement is soft.
Some companies face extra duties. Significant data fiduciaries are described as those that process the data of more than five million residents, or have an annual turnover of Rs 250 crore or more, or process sensitive data such as health or financial data with AI profiling. By early 2027 they are expected to appoint a data protection officer based in India, commission independent audits and carry out data protection impact assessments. The thresholds are taken from one summary and should be checked against the rules.
Children’s data has special rules. Organisations have to put in place verifiable parental consent and age-verification systems before enforcement begins, and the Wikipedia summary of the rules refers to verifiable guardian consent for some processing. Privacy notices must be available in English or in any of the 22 languages in the Eighth Schedule to the Constitution when a user asks for it, according to India Briefing.
The rules also deal with cross-border transfers, saying that personal data can be transferred outside India under conditions and safeguards, with the central government keeping the power to specify countries or mechanisms. They also require notice of data breaches to the Board and to the people affected within specified timelines, which the sources reviewed do not spell out.
For companies, the message is that the period before May 2027 is the time to map data, update consent systems and prepare for breach reporting, while for ordinary users the changes will show up as clearer notices and more control over consent.
Featured image: Hitec City, Hyderabad’s technology district (file photo; a stand-in image for India’s IT sector). Photo by Syced, licensed under CC0, via Wikimedia Commons.