Quick Answer
India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025 as G.S.R. 846(E)) phase into force across three dates. Phase 1 (13 November 2025) brought the definitions and the Data Protection Board into force. Phase 2 (13 November 2026) activates the Consent Manager framework under Rule 4. Phase 3 (13 May 2027) switches on substantive obligations, enforcement powers, penalties, and appeals. For every foreign-owned Indian subsidiary processing personal data of individuals in India, the 13 May 2027 date closes the compliance window. Civil penalties under Section 33 reach INR 250 crore for failing to maintain reasonable security safeguards. The six-month audit period from November 2026 to May 2027 is the operational window for Board-approved compliance preparation.
Phase 1
13 November 2025 — Definitions and Data Protection Board
Phase 2
13 November 2026 — Consent Manager framework under Rule 4
Phase 3
13 May 2027 — Substantive obligations, enforcement, penalties
Why DPDP compliance matters for foreign-owned Indian subsidiaries right now
India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) applies to any Data Fiduciary processing the personal data of individuals in India, regardless of the Data Fiduciary’s own location. For a foreign-owned Indian subsidiary, that scope includes customer names, phone numbers, email addresses, payment details, employee records, photographs, booking records, and virtually every other category of personal data handled in the ordinary course of commercial operations. The Act has no general small-business exemption, though limited exemptions exist for specific classes.
For foreign counsel advising European, US, and other group parents whose Indian subsidiaries fall within the Act’s scope, the compliance preparation window is six months — November 2026 to 13 May 2027. The organisational work (data mapping, notice and consent redesign, breach response capability, Data Protection Officer appointment for Significant Data Fiduciaries) takes three to four months for a standard organisation and six to eight months for complex ones.
Section 1: The three-phase enforcement timeline
The DPDP Rules 2025, notified by the Ministry of Electronics and Information Technology on 13 November 2025 as G.S.R. 846(E), set out a three-phase commencement schedule.
Phase 1 — 13 November 2025 (in force)
The provisions governing definitions and the establishment of the Data Protection Board of India came into force. The Board was constituted with investigation and adjudication powers under Section 27 of the Act. No immediate operational burden was placed on Data Fiduciaries at this stage.
Phase 2 — 13 November 2026
The Consent Manager framework under Rule 4 of the DPDP Rules 2025 activates. A Consent Manager is a SEBI-regulated or MeitY-regulated entity that acts as a single point for individuals to give, manage, and withdraw consent to data processing. For Data Fiduciaries, this phase begins the operational framework through which consent must be collected and recorded going forward.
Phase 3 — 13 May 2027
The substantive obligations — Section 4 (grounds for processing), Section 5 (notice), Section 6 (consent), Sections 7-9 (processing without consent in specified categories), Section 11 (rights of Data Principals), Section 13 (grievance redressal), Section 14 (nomination), Section 15 (consequences of exercising rights), Section 16 (cross-border transfer), Section 17 (exemptions), Section 18 (duties of Data Fiduciaries), the Significant Data Fiduciary provisions under Section 10, and the penalty provisions under Sections 33 and 34 — commence. From 13 May 2027, the Data Protection Board of India begins exercising full enforcement powers.
Section 44(2) of the DPDP Act — the provision under which the DPDP Act supersedes Section 43A of the Information Technology Act, 2000 and the Sensitive Personal Data or Information Rules, 2011 — commences on 13 May 2027. Until that date, the SPDI Rules remain the operative law on personal data.
Section 2: What is switching on in November 2026 — the Consent Manager framework
Phase 2 is operationally significant for foreign-owned Indian subsidiaries that collect consent-based personal data at scale — e-commerce platforms, SaaS products, digital services, financial technology services, and consumer-facing applications.
From 13 November 2026, the Consent Manager framework under Rule 4 of the DPDP Rules 2025 is live. A Consent Manager is a MeitY-registered intermediary that:
- Provides a dashboard through which an individual (a “Data Principal” under the Act) can give, modify, review, or withdraw consent to data processing by one or more Data Fiduciaries
- Maintains an auditable record of consent events
- Operates under security and governance standards prescribed by Rule 4
For Data Fiduciaries, the practical consequence from Phase 2 forward is that consent collection and consent-withdrawal mechanisms must be interoperable with the Consent Manager framework. The specific technical and interoperability standards are being finalised through MeitY-issued guidance.
Section 3: What becomes enforceable on 13 May 2027 — the Phase 3 checklist
From 13 May 2027, the Data Protection Board can begin exercising its full powers under Section 27 to investigate complaints, issue directions, and impose penalties. Foreign-owned Indian subsidiaries approaching Phase 3 should audit their position against seven operational questions.
Can you demonstrate valid consent and a compliant notice?
Under Sections 5 and 6, every notice to a Data Principal must be itemised, standalone, and in plain language. Consent must be free, specific, informed, and unconditional. The mechanism for withdrawing consent must be as easy as giving it.
Can you detect a personal data breach and report it within the statutory window?
Under Rule 7 of the DPDP Rules 2025, a Data Fiduciary must give the Data Protection Board an initial breach alert “without delay” and a detailed report within 72 hours of becoming aware of the breach. The 72-hour window may be extended on written application. Affected Data Principals must also be notified without delay, and no severity threshold applies — the duty is triggered by any personal data breach. The breach-reporting duty commences with the other Phase 3 substantive obligations on 13 May 2027. This is distinct from the CERT-In six-hour cyber incident reporting duty under the Information Technology Act, which is already in force.
Can you honour Data Principal rights?
Under Section 11, Data Principals have rights of access, correction, erasure, and nomination. Under Section 13 of the Act read with Rule 14 of the DPDP Rules 2025, every Data Fiduciary and Consent Manager must publish a grievance redressal system that responds within a reasonable period not exceeding 90 days. A visible contact point and tracked process are operationally required.
Can you delete personal data when its purpose ends?
Section 8(7) requires erasure where the specified purpose is served or where consent is withdrawn. Fixed retention periods apply mainly to specified classes (e-commerce, online gaming, social media intermediaries). Automated deletion mechanisms are required where the Rules specify.
Can you demonstrate verifiable parental consent for children’s data?
Section 9 defines a child as any individual below 18 years of age. Processing of a child’s personal data requires verifiable parental consent, with narrow exemptions for specified categories.
Can you demonstrate reasonable security safeguards?
Section 8(5) requires reasonable security safeguards against personal data breaches. Rule 8 of the DPDP Rules 2025 prescribes encryption, access controls, logging and monitoring, with logs and traffic data retained for a minimum of one year (three years for entities specified in the Third Schedule to the Rules).
If notified as a Significant Data Fiduciary, can you demonstrate the additional governance obligations?
See Section 4 below.
Section 4: Significant Data Fiduciary (SDF) obligations
Under Section 10 of the DPDP Act, the Central Government may notify a Data Fiduciary (or a class of Data Fiduciaries) as a Significant Data Fiduciary (“SDF”) on the basis of factors including the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential impact on the sovereignty and integrity of India, and the risk to electoral democracy.
Where an entity is notified as an SDF, additional governance obligations apply under Rule 13 of the DPDP Rules 2025:
Data Protection Officer (DPO) based in India
A DPO who represents the SDF under the Act, is based in India, and reports to the Board of Directors or other senior governance body. The DPO is the point of contact for grievance redressal and for communications with the Data Protection Board of India.
Independent data auditor
An independent auditor must evaluate the SDF’s compliance with the Act.
Periodic Data Protection Impact Assessment (DPIA) and audit
DPIAs and audits are required at prescribed intervals (every twelve months), assessing the risk to Data Principals’ rights arising from the SDF’s processing operations.
Localisation of specified data categories
Rule 13 of the DPDP Rules 2025 empowers the Central Government to specify categories of personal data and traffic data that an SDF must keep within India. The scope of the localisation requirement depends on specific Government notifications identifying the data categories.
For foreign-owned Indian subsidiaries whose scale, sensitivity, or sector risk makes SDF designation realistic, these governance obligations substantially elevate the India compliance profile.
Section 5: Cross-border data transfer — the Section 16 framework
For foreign-owned Indian subsidiaries that transfer personal data outside India for processing — a common pattern where group-level IT systems, HR platforms, customer analytics, or payroll processing sit in the parent jurisdiction — Section 16 of the DPDP Act sets a materially more permissive framework than the EU GDPR equivalent.
Negative-list model
Section 16(1) empowers the Central Government to restrict transfers of personal data for processing to specified countries by notification. The Act does not operate a general prohibition on transfers abroad. Until the Central Government notifies a restricted-country list, cross-border transfers are broadly permitted, subject to sectoral rules.
Sectoral rules preserved
Section 16(2) provides that nothing in Section 16 overrides any Indian law that provides for higher protection or a greater transfer restriction. The Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), and other sectoral regulators have their own localisation and transfer rules that continue to apply.
Accountability remains with the Data Fiduciary
Regardless of where processing is performed, the Indian Data Fiduciary remains responsible for DPDP compliance in respect of the transferred data. Group-level processing agreements, intra-group data transfer protocols, and data processor contracts need to allocate the compliance risk explicitly.
SDF additional conditions
Where the Data Fiduciary is an SDF, Rule 13 of the DPDP Rules 2025 permits the Central Government to require specified categories of data to be kept within India, which operates alongside the Section 16 framework.
Section 6: The penalty ladder under Section 33
Civil penalties under Section 33 of the DPDP Act are capped at the amounts specified in the Schedule to the Act, and the Data Protection Board exercises discretion within those caps based on the nature, gravity, and duration of the breach.
|
Failure |
Maximum penalty |
|
Failure to maintain reasonable security safeguards (Section 8(5)) |
INR 250 crore |
|
Failure to notify a personal data breach (Section 8(6) read with Rule 7) |
INR 200 crore |
|
Breach of children’s data obligations (Section 9) |
INR 200 crore |
|
Breach of Significant Data Fiduciary obligations (Section 10) |
INR 150 crore |
|
Any other breach of the Act or the Rules |
INR 50 crore |
Three points worth noting:
- These are ceilings, not standard fines. The Board determines the specific quantum in each case under its Section 33 discretion.
- Penalties can stack. A single incident may constitute both a Section 8(5) safeguards failure and a Section 8(6) notification failure, with separate penalties applied.
- Penalties are only part of the cost. Investigation time, customer trust impact, regulatory engagement, and legal fees add to the direct penalty exposure.
The penalties commence from 13 May 2027, aligned with the Phase 3 commencement of the substantive provisions.
Section 7: Why the group global privacy policy will not substitute for India DPDP compliance
Foreign parent companies commonly operate a global privacy and data protection framework aligned with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or other foreign regimes. The DPDP Act’s requirements overlap substantially with these frameworks but diverge in material respects:
Age threshold for children
The DPDP Act defines a child as any individual below 18 years of age (not 16 as under the GDPR).
Lawful grounds for processing
The DPDP Act has a narrower set of lawful grounds than the GDPR. Legitimate interests, for example, is not a general ground under the DPDP Act.
Breach reporting duties
The 72-hour window applies to all personal data breaches under Rule 7, without the GDPR’s “risk to rights and freedoms” severity threshold.
Cross-border transfer framework
The DPDP Act’s negative-list model is materially more permissive than the GDPR’s adequacy / Standard Contractual Clauses / Binding Corporate Rules framework.
For foreign-owned Indian subsidiaries, the practical structure is to maintain the group privacy framework as a strategic umbrella and operate a separate India-specific DPDP implementation policy beneath it. Attempting to apply the group policy directly produces compliance gaps on the specific DPDP divergences above.
The six-month action calendar — November 2026 to May 2027
|
Month |
Focus area |
Concrete step |
|
November 2026 |
Know your data |
Map every location where personal data is collected, processed, and stored — websites, forms, spreadsheets, CRM, payment tools, messaging apps |
|
December 2026 |
Know your vendors |
List every data processor; identify which have Data Processing Agreements and documented security commitments |
|
January 2027 |
Fix notice and consent |
Rewrite privacy notices and consent prompts; itemise purpose for each processing activity |
|
February 2027 |
Build the rights process |
Create a Data Principal rights request form, name a response owner, and build a tracked 90-day response process under Rule 14 |
|
March 2027 |
Secure and log |
Enable access controls, encryption where feasible, logging and monitoring with the Rule 8 one-year retention |
|
April 2027 |
Rehearse a breach |
Run a tabletop exercise against the Rule 7 72-hour timeline |
|
May 2027 |
Final checks |
Finalise vendor Data Processing Agreements, train staff, file documentation |
FAQ — Foreign counsel questions on DPDP compliance
Q: Does the DPDP Act apply to a foreign company that does not have operations in India?
Yes, if the foreign company offers goods or services to individuals in India or processes personal data of individuals in India. The Act’s extra-territorial application under Section 3(b) is broad, consistent with the GDPR’s extra-territorial reach but drafted on different trigger criteria.
Q: Is there a general small-business exemption from the DPDP Act?
No. The Act has no general small-business exemption. The Central Government may notify specific classes of Data Fiduciaries as exempt under Section 17, and startups are among the entities that may be considered for notification, but the default position is that the Act applies regardless of size.
Q: What is the maximum penalty under the DPDP Act for a security breach?
INR 250 crore for a failure to maintain reasonable security safeguards that results in a personal data breach. The Data Protection Board exercises discretion within this cap based on the nature, gravity, and duration of the breach. Penalties may stack where multiple provisions are breached by the same incident.
Q: Does an Indian subsidiary need a Data Protection Officer under the DPDP Act?
Only where the subsidiary is notified as a Significant Data Fiduciary under Section 10. For non-SDF Data Fiduciaries, there is no general DPO requirement, though a nominated grievance redressal officer must be identified under Section 13.
Q: Can a foreign-owned Indian subsidiary continue to transfer personal data to the foreign parent for group-level processing?
Yes, under Section 16, unless the Central Government notifies a restriction on transfers to the specific destination country. Until a restricted-country list is notified, cross-border transfers are broadly permitted, subject to sectoral rules (RBI, SEBI, and others) and to any Rule 13 localisation requirements the Government notifies for Significant Data Fiduciaries.
Q: Is there a grace period after 13 May 2027?
No. The 18-month runway from 13 November 2025 to 13 May 2027 is the grace period. Penalties under Section 33 apply from Phase 3 commencement.
