DPDP Rules 2025: A Practical Compliance Guide for Indian Startups & Fiduciaries

 By: Kanak Purohit, Digital Policy Strategist

With the notification of the Digital Personal Data Protection (DPDP) Rules in November 2025, the "grace period" for Indian companies has effectively ended. As we move through 2026, the Data Protection Board of India (DPBI) is shifting from education to enforcement.

The most critical date on every boardroom agenda is now May 13, 2027—the end of the 18-month transition window. After this, failing to align your operations is no longer an oversight; it is a legal risk with penalties of up to ₹250 Crore. Here is your practical roadmap for 2026 compliance.

1. The Notice Mandate: Plain Language & 22 Languages

Under Rule 3, the era of 50-page legalese-heavy privacy policies is over. A Data Fiduciary must now provide an "itemized" notice that is:

• Independently understood: A layperson should know exactly what is being collected.

• Multilingual: The notice must be available in English or any of the 22 languages specified in the Eighth Schedule of the Constitution.

• Checklist Item: Does your app detect a user's region and offer the privacy notice in their local language?

2. Verifiable Parental Consent: The Age-Gating Crisis

For any user under 18, a Data Fiduciary must obtain verifiable parental consent.

• The Mechanism: The 2025 Rules suggest secure methods like DigiLocker’s Age Token or Aadhaar-based verification.

• The "No-Go" Zone: Even with consent, you are strictly prohibited from behavioral monitoring or targeted advertising aimed at children.

• Penalty Risk: Mishandling children’s data carries a specific penalty of up to ₹200 Crore.

3. The Rise of the "Consent Manager"

A unique feature of the Indian framework is the Consent Manager (CM). These are intermediaries registered with the Board that act as a single point of contact for users to manage, review, and withdraw consent across multiple apps.

• Accountability: CMs must be incorporated in India, have a net worth of at least ₹2 Crore, and maintain audit trails for 7 years.

• Business Strategy: If you are a startup, you don't need to build your own complex consent dashboard; you can integrate with a registered CM to outsource this compliance burden.

4. Breach Notification: The 72-Hour Rule

When a data breach occurs, silence is no longer an option.

• Immediate Intimation: You must inform the Board and the affected individuals "as soon as you become aware."

• Detailed Submission: A full report must follow within 72 hours.

• The 2026 Standard: If your IT team doesn't have a "Breach Playbook" that triggers within the first hour of detection, you will likely miss this statutory deadline.

5. Summary Table: DPDP Act vs. DPDP Rules 2025

Feature	DPDP Act (2023)	DPDP Rules (2025)
Consent	Must be "Informed & Specific."	Prescribes standardized templates and multi-factor verification.
Children's Data	Prohibits "harmful" processing.	Mandates Verifiable Parental Consent via DigiLocker/Aadhaar.
Consent Managers	Defined the role.	Set ₹2 Crore net worth and 7-year record retention.
Penalties	Up to ₹250 Crore.	Established the Adjudication Process for the Board.
Data Deletion	Must delete when purpose is served.	Mandates deletion within 3 years of the last interaction for SDFs.

Author's Note:

"In my research for 2026 compliance audits, I’ve noticed that 'Storage Limitation' is the biggest blind spot. Most fiduciaries keep data 'just in case' for future marketing. Under Rule 15, if a user hasn't interacted with your platform for three years, you must delete their data unless a legal obligation says otherwise. You are also required to notify them 48 hours before deletion. This requires an automated backend, not just a manual spreadsheet.