DPDP Rules: what changed in 2025 and what it means for startups

The DPDP Act 2023 is India's main law on personal data. It states the principles, such as consent and the right to correct or erase data, but leaves the working details to rules. The Digital Personal Data Protection Rules 2025, issued by the Ministry of Electronics and Information Technology (MeitY), supply those details.

In the law's language a company that decides why and how personal data is used is a data fiduciary, and the person the data belongs to is a data principal. Most startups are data fiduciaries, because they collect names, phone numbers, locations and payment details from users.

The Rules were notified on 13 November 2025, according to most law-firm summaries, though a few put the Gazette date a day later. They apply in three steps, as reported: some provisions at once, including those that set up the Data Protection Board, a second group after about 12 months, and the bulk of the duties after about 18 months.

The 12-month step covers the registration of consent managers. The 18-month step, around May 2027, covers the main duties of data fiduciaries. For planning, a startup should treat the second half of 2027 as the date by which systems for notice, consent, security and breach handling are expected to work. Check the Gazette text for exact dates.

• Immediately: short title, definitions and the Data Protection Board provisions.
• After about 12 months: rules for consent managers.
• After about 18 months: most obligations on data fiduciaries, user rights handling, children's data and penalties in practice.

Before collecting personal data, a company must give a clear notice in plain language. According to law-firm summaries of the Rules, the notice should list the data collected, say why it is needed and how a user can withdraw consent, and name how to complain to the Data Protection Board. Withdrawing consent should be as easy as giving it.

Consent must be specific. A startup cannot hide permission for everything inside a long terms page. The law also allows some uses without consent, such as legal obligations and certain emergencies, so a lawyer should map each use to a legal basis.

Companies must put reasonable security safeguards in place, such as encryption, access control and logs, and must tell affected users and the Board when a personal data breach occurs. The Rules set the form and timing of the report, and summaries differ on the details, so read the Gazette text for time limits.

There are also rules on erasing data when it is no longer needed. One summary says that, for certain large platforms, personal data may not be kept beyond a period after the user's last activity unless the law requires it. Confirm which classes of company this applies to before relying on the point.

A company that handles data of children, defined by the Act as anyone under 18, must obtain verifiable consent from a parent or guardian. The Rules list some exemptions, such as services run by schools or healthcare providers for the child's safety. Edtech, gaming and social startups are the most affected.

The government can designate a company as a significant data fiduciary based on the volume and sensitivity of data it handles. Such companies face extra duties, which law-firm summaries list as impact assessments, audits and a data protection officer based in India.

Most early-stage companies have a short runway to prepare. Practical steps include listing every place personal data is collected, rewriting privacy notices, building a way to record and withdraw consent, setting a retention period for each type of data, and agreeing breach procedures with vendors such as cloud and analytics providers.

Penalties under the Act can be large, up to ₹250 crore for some failures, as set in the Act's schedule. Investors now ask about data practices in due diligence, especially in fintech, health and consumer apps. Smaller startups may still benefit from the Rules, since a clean data map is useful for security, marketing and any later fundraise.

This guide is general information and not legal advice. Dates and details can change, so check the Gazette text or take professional advice.

The Data Protection Board of India is the body that receives complaints, investigates breaches and decides on penalties under the Act. It is set up as a digital office, and the Rules say that hearings and filings can happen online. The provisions on the Board were among those that applied from the date of notification.

A user who is unhappy with how a company handles data is expected to complain to the company first, and then to the Board if the matter is not resolved. For a startup, this means that a clear grievance process, with a named contact and a time limit for replies, is part of compliance and also a way to settle problems before they reach the Board.

A short plan helps. In the first month, list the personal data collected, where it is stored and which vendors see it. In the next two months, rewrite the privacy notice and the consent screens and set a retention period for each type of data. After that, test breach handling with a practice drill, update vendor contracts so that suppliers share the duty to protect the data and train the team that deals with users.

Small teams do not need a large budget to begin. Many of the steps are changes to process and documents, and some are already needed for security reviews by customers and for sector rules.

Sector regulators such as the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI) have their own data and outsourcing rules. These still apply to regulated entities. Where two rules overlap, companies usually follow the stricter one. The DPDP Rules add a general layer that applies to almost every business that processes digital personal data.

The Account Aggregator framework, run under RBI rules, is a separate system for sharing financial data with consent. The two frameworks have a similar goal, but they do not replace each other as of November 2026.