DPDP Rules 2025: Startup Compliance Roadmap

If your startup collects names, phone numbers, email addresses, payment details or any other personal data about people in India, the Digital Personal Data Protection Act, 2023 applies to you. The Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, spell out what you must actually do. Most of the duties start on 13 May 2027, which leaves about six months to get ready.

This guide walks through the dates, the rules that matter for a startup, the penalties and a month-by-month plan. We read the Gazette text of the Rules (G.S.R. 846(E)) and used the commentary listed under Sources for the Act's penalty provisions.

Quick summary

The Rules were published on 13 November 2025. They switch on in three stages: immediately, after one year (Rule 4) and after 18 months (most business duties).
The duties for notice, security, breach reporting, retention, children's data and user rights apply from about 13 May 2027.
A personal data breach must be reported to the Data Protection Board without delay, with a detailed report within 72 hours.
Penalties can reach ₹250 crore, depending on the contravention.
No startup exemption has been notified so far, so plan for full compliance.

The timeline (Rule 1)

13 November 2025: Rules 1, 2 and 17 to 21 came into force on publication. These set up the Data Protection Board and how it works.
13 November 2026: Rule 4, on registration and obligations of Consent Managers, comes into force one year after publication.
13 May 2027: Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. These carry the main duties for businesses.

The Rules count from the date of publication in the Gazette. Some commentators count a day or two later, so treat 13 May 2027 as the date to plan for and build in a margin. The obligations that carry penalties begin when these rules start.

Who is covered

The law uses three terms:

A Data Fiduciary decides why and how personal data is processed. If you decide what customer data your app or website collects and why, you are one, however small the company.
A Data Principal is the individual the data is about, such as your customer, user or employee.
A Data Processor handles data on your behalf, such as a cloud host, payment gateway, CRM or email tool.

What the Rules require

Notice (Rule 3)

Your privacy notice must be understandable on its own, written in clear and plain language, and must include:

An itemised list of the personal data you collect.
The specific purpose of each use, and the goods or services it enables.
A link or other means for people to withdraw consent, use their rights and complain to the Board.

Old, generic privacy policies will not meet this standard.

Rule 4 sets up the registration of Consent Managers, who run platforms where people can give, manage and withdraw consent. To register, the applicant must be a company incorporated in India with a net worth of at least ₹2 crore. Most startups will not become Consent Managers, but you should know the concept if you plan to integrate with one.

Security safeguards (Rule 6)

You must take reasonable security measures to prevent breaches, including those by your processors. At a minimum:

Encryption, masking or tokenisation of personal data.
Access controls on the systems that hold it.
Logging and monitoring so that unauthorised access can be detected and investigated.
Backups so processing can continue if data is lost or compromised.
Retaining relevant logs and personal data for one year, unless another law requires longer.
Security terms in your contracts with processors.

Breach intimation (Rule 7)

When you become aware of a breach:

Tell each affected person without delay, in clear and plain language, through their user account or registered contact mode. Explain what happened, the likely consequences for them, what you are doing about it, what they can do to protect themselves and who to contact.
Tell the Board without delay, with a description of the breach, its nature, extent, timing, location and likely impact.
Within 72 hours, send the Board updated and detailed information: the facts and reasons behind the breach, the measures taken, findings about who caused it, steps to prevent recurrence and a report on the notices you gave to affected people. The Board can allow more time on a written request.

Reporting to the Board under these Rules is separate from any reporting you owe under other laws, such as CERT-In's directions on cyber incidents.

Retention, erasure and logs (Rule 8)

Certain large platforms must erase personal data after the specified period of inactivity. The Third Schedule lists e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh registered users and social media intermediaries with at least two crore registered users. The period is three years from the last interaction, or from the start of the Rules, whichever is later. They must warn the person at least 48 hours before erasure.
For all fiduciaries, Rule 8(3) requires retaining personal data, traffic data and processing logs for at least one year for the purposes in the Seventh Schedule, unless another law requires more.

Contact point (Rule 9)

Publish prominently on your website or app the business contact details of your Data Protection Officer, if you have one, or another person who can answer questions about how you process personal data. Repeat these details in every reply to a rights request.

Children's data (Rules 10 to 12)

Before processing a child's personal data, you must obtain verifiable consent from a parent and check that the person claiming to be the parent is an identifiable adult. Rule 12 and the Fourth Schedule exempt specified classes (such as clinical establishments and educational institutions) and specified purposes (such as creating an email-only account) from some of these duties, with conditions. If your product is used by under-18s, review this early.

Rights and grievances (Rule 14)

Publish how a person can exercise their rights and what identifier you need to find their data. You must run a grievance redressal system and respond within a reasonable time that does not exceed 90 days.

Cross-border transfers (Rule 15)

Transfers of personal data outside India are allowed, subject to any requirements the Central Government may specify by order for making data available to a foreign state or its agencies. The Rules do not impose a blanket data localisation requirement.

Significant Data Fiduciaries (Rule 13)

The government can notify some fiduciaries as Significant Data Fiduciaries based on factors such as data volume and sensitivity. They face extra duties: a Data Protection Impact Assessment and an audit every twelve months, due diligence on their algorithmic systems, and possible restrictions on transferring specified data outside India. The Act also requires them to appoint an India-based Data Protection Officer and an independent data auditor. Most early-stage startups will not be notified, but a fast-growing consumer product could be.

Penalties

The Data Protection Board imposes penalties after an inquiry. According to the commentary we reviewed, the maximum amounts in the Schedule to the Act are:

₹250 crore: failing to take reasonable security safeguards to prevent a personal data breach.
₹200 crore: failing to notify the Board and affected people of a breach, and breaching the duties for children's data.
₹150 crore: breaching the additional duties of a Significant Data Fiduciary.
₹50 crore: any other breach of the Act or the Rules, such as consent, retention or rights requests.

The Board looks at the nature, gravity and duration of the breach and whether you took steps to reduce harm. These are maximums, not fixed fines, but they show why security and breach readiness should come first.

Is there a startup exemption?

Section 17(3) of the Act lets the Central Government exempt certain classes of Data Fiduciaries, including startups, from some provisions by notification. The Rules do not create a startup exemption, and the sources we reviewed say no such notification had been issued as of August 2026. Even if one comes, it would be partial. Consent, security safeguards, children's duties and breach notification would still apply. Plan for full compliance, and check the Gazette before relying on any exemption.

A roadmap to 13 May 2027

November 2026: map your data. List every place you collect personal data (forms, checkout, app, support, marketing tools, HR), where it is stored, who can see it and who your processors are.
December 2026: rewrite notices and consent flows. Replace generic policies with Rule 3 notices that itemise data and purposes. Make withdrawing consent as easy as giving it.
January 2027: fix vendor contracts. Add security and breach-cooperation terms for every processor, and confirm they can retain logs for the required period.
February 2027: strengthen security. Put in place encryption, access controls, monitoring, backups and a one-year log retention practice.
March 2027: prepare for a breach. Write a runbook covering who decides, how you alert affected people, and how you file the first notice and the 72-hour report. Run a practice drill. Publish your contact point and grievance process.
April 2027: retention and children. Set retention periods for each data type, and check whether any under-18 users need verifiable parental consent.
May 2027: final review. Train staff, test your rights-request process end to end and complete your checks before 13 May.

Frequently asked questions

Does the DPDP Act apply to a company with only a few customers?

The Rules we read set no minimum customer count for ordinary Data Fiduciaries. Size matters only for specific classes, such as the user thresholds in Rule 8 and the Significant Data Fiduciary designation.

Do we have to store data in India?

Not under a general rule. Rule 15 allows transfers abroad subject to government orders on specific countries or entities. Significant Data Fiduciaries may face restrictions for specified data.

Is 72 hours the whole breach process?

No. You must tell the Board and affected people without delay. The 72-hour deadline is for the updated and detailed report.

Do we need a Data Protection Officer?

Rule 9 requires you to publish the contact details of a DPO, if you have one, or of another person who can answer questions. The Act makes appointing an India-based DPO mandatory only for Significant Data Fiduciaries.

Which date should we plan for?

13 May 2027 for the main duties, with a margin of a few days. Rule 4 on Consent Managers starts on 13 November 2026 and matters only if you plan to build or use a Consent Manager.

This article is general information and not legal advice. The Rules may be amended or supplemented by government orders, so confirm the position for your business with a legal professional.

Want help preparing your notices, consent flows and breach process before the deadline? Talk to the StartupKaro team about your set-up.

Sources

Found this useful?

DPDP Rules 2025: The 13 May 2027 Deadline and a Compliance Roadmap for Indian Startups