DPDP Rules 2025: what your IT team has to build before 13 May 2027.

The facts

When do the DPDP Rules start to apply?

Personal data rarely sits in one system. It is in the CRM, the HR suite, mailboxes, file shares, backups and the logs of each. Rule 6 of the DPDP Rules covers personal data in a Data Fiduciary’s possession or under its control¹.

The Digital Personal Data Protection Rules, 2025 were published in the Gazette as G.S.R. 846(E), dated 13 November 2025¹. Their substantive duties apply from 13 May 2027¹. A commencement notification phases in the Act on the same dates².

One caveat. The Press Information Bureau’s backgrounder says the Rules were notified on 14 November 2025³. The Gazette PDF was digitally signed that morning¹. Counted from that day, each later date moves by one day. We plan to 13 May 2027, the earlier date.

The DPDP Act omits section 43A of the Information Technology Act, 2000 through its section 44(2)⁴. That sub-section is in the 13 May 2027 tranche, so section 43A is not omitted before then².

The facts

What has changed since the Rules were notified?

Two developments bear on the timeline, and neither has moved a date. On 23 January 2026, the Ministry of Electronics and Information Technology (MeitY) put proposals to industry, according to law firm S.S. Rana & Co.⁵. One was a 12-month window, not 18, for Significant Data Fiduciaries, which would bring their date forward to 13 November 2026⁵.

The firm’s note reports two more proposals. The cross-border rules, Rules 13(4) and 15, would be enforced at once⁵. The retention rules, Rule 8(3) and the Third Schedule, would apply within 90 days of an amendment being notified⁵. Comments were sought by 4 February 2026⁵.

That note, dated 15 April 2026, still describes these as proposals⁵. It leaves open whether the retention change would reach every Fiduciary⁵. We have not found a notified amendment as of 8 October 2026.

The second is the Board. It has existed in law since 13 November 2025², but as of 1 August 2026 it had no Chairperson and no Members⁶. In a Lok Sabha answer on 12 August 2026, MeitY said the Chairperson and four Members are to be appointed through a Search-cum-Selection Committee⁷. The posts were advertised in the Employment News on 6 June 2026⁷.

The facts

What does Rule 6 require, clause by clause?

Rule 6(1) lists what a Data Fiduciary’s reasonable security safeguards must include “at the minimum”¹. They also cover processing done on its behalf by a Data Processor¹.

The Act’s Schedule sets the ceiling for a breach of the safeguards duty in section 8(5): the penalty “may extend to” ₹250 crore⁴. For failing to give notice of a breach under section 8(6), it may extend to ₹200 crore⁴. How either would apply is for counsel.

The facts

What has to be ready to send the 72-hour report?

Rule 7 has two audiences¹. Each affected Data Principal must be told “without delay”, in plain language, through their user account or a registered contact¹. The notice covers what happened, the likely consequences, what you are doing to mitigate risk, what they can do and who to contact¹.

The Board gets a description of the breach without delay¹. Then, “within seventy-two hours of becoming aware of the breach”, it gets a detailed report, unless it allows longer on a written request¹. That report has six parts¹:

• Updated and detailed information on the first description
• The broad facts on the events, circumstances and reasons behind the breach
• Measures taken or proposed to mitigate risk
• Any findings on the person who caused the breach
• Remedial measures taken against a recurrence
• A report on the intimations sent to affected Data Principals

The CERT-In clock runs separately. The Directions of 28 April 2022 require listed cyber incidents to be reported to CERT-In within 6 hours of noticing them⁸. One incident can start both clocks.

The facts

How long must logs be kept, and when must data be erased?

Rule 8(3) sets a floor of one year. A Data Fiduciary must keep personal data, “associated traffic data and other logs of the processing” for at least a year¹. The year runs from the date of processing and covers its Data Processor too¹.

The Rule ties this retention to the Seventh Schedule’s purposes: use by the State and the assessment of Significant Data Fiduciaries¹. After the year, the data and logs are to be erased, unless another law requires longer¹.

In the Rule’s illustration, a cloud provider hosts customer records¹. The Fiduciary must see that the provider also keeps the data and logs for at least a year¹. CERT-In asks for something different: logs of all information and communication technology (ICT) systems for a rolling 180 days, kept within Indian jurisdiction⁸.

The same Directions set the clock source. ICT systems must sync with National Informatics Centre (NIC) or National Physical Laboratory (NPL) time servers, or servers traceable to them⁸. Without that, logs from different systems will not line up in a 72-hour report.

Unless a law requires retention, the Act requires erasure when consent is withdrawn or the purpose is no longer served, whichever is earlier⁴. The Fiduciary must have its Processor erase too⁴.

Rule 8(1) adds a fixed period for three classes in the Third Schedule¹. Two are e-commerce entities and social media intermediaries with at least 2 crore registered users in India¹. The third is online gaming intermediaries with at least 50 lakh¹.

For those classes, data must be erased three years after the person last approached the Fiduciary or used a right¹. The three years run from no earlier than the Rules’ commencement¹. Two purposes are excepted: the person’s access to their account and to stored virtual tokens¹. The person must be told at least 48 hours before erasure¹.

What it means

What does this mean for the systems you run?

Most of these duties are engineering: searchable logs, access control, masking, backups that restore and erasure jobs. A policy can describe each one, but the evidence comes out of the systems.

Size log storage to the longer rule. Where a system processes personal data, keep its access and processing logs for at least a year¹. Keep every other ICT system’s logs for 180 days in India⁸. A single store in India, set to keep a year, is the simplest design that fits both rules.

Rights requests are an engineering task too. Rule 14(3) requires a published grievance response period of no more than 90 days¹. Answering an access or erasure request means finding one person’s records in every system on the data map.

What it means

What will Fiduciary customers ask of their processors?

The Act makes the Fiduciary responsible for processing done on its behalf⁴. It allows a Processor only under a valid contract⁴. A global capability centre (GCC), BPO or SaaS vendor should expect three requests: the Rule 6(1)(f) clauses, a year of logs under Rule 8(3) and breach notice fast enough for a 72-hour report¹.

One exemption may matter to GCCs. Section 17(1)(d) covers personal data of people outside India, processed by someone based in India under a contract with someone outside India⁴.

For that processing, Chapter III, section 16 and most of Chapter II do not apply⁴. Section 8(1) on responsibility and section 8(5) on security safeguards still do⁴. Ask your counsel whether your centre qualifies.

A processor may offer ISO/IEC 27701:2025 certification as evidence. It is now a standalone standard, no longer dependent on ISO/IEC 27001⁹. Its Annex A has 34 controller controls, 21 processor controls and 31 shared controls⁹. A certificate shows a working management system; it is not a finding under DPDP.

What it means

What should IT do between now and May 2027?

This is the order we would work in. Each step leaves evidence you can show.

1. List every system that stores or processes personal data, including SaaS tools, backups and log stores. Record the owner, the location and any processor for each.
2. Turn on access logging in each of those systems and send the logs to one store in India. Set retention to at least a year.
3. Point every clock at NIC or NPL time, or at a source traceable to them⁸.
4. Put single sign-on and MFA in front of each system. Remove shared and dormant accounts, then record an access review.
5. Encrypt personal data at rest and in transit. Mask it in test copies, exports and reports, and record where the keys live.
6. Restore one personal-data system from backup. Write down how long it took and what was missing.
7. Write the breach path: who decides a personal data breach has happened, who tells people and who drafts the six-part report. Rehearse it once against the 72-hour clock.
8. Build retention and erasure as scheduled jobs for each data set. Decide how deletion is handled in backups, and write that decision down.
9. Send each processor the security clauses, and ask for their log retention and breach notice terms in writing.

Our view

Why start with logging and the data map?

Limits

What does this article not cover?

Where we fit

Who can check where you stand before May 2027?

Our DPDP readiness review checks where your network, cloud and applications stand against the Rules’ technical duties, one control area at a time. The review is free, and the written findings are yours whether we work together or not. NetScale holds ISO/IEC 27701:2025 certification for its own privacy management. We do not give legal advice: applicability stays with your counsel.