DPDP Act and Rules 2025: a practical compliance guide for security and IT teams
The rules are notified and the clock is running. Here is what the DPDP Act actually asks of security and IT teams, what applies when, and a six-month plan to be ready before 13 May 2027.
The short version
- The DPDP Rules were notified on 13 November 2025. Most obligations on businesses apply from 13 May 2027.
- You must take “reasonable security safeguards”. The Rules name encryption, masking, tokenisation, access control, logging and monitoring.
- After a personal data breach you must inform the Data Protection Board and every affected person without delay, and file a detailed report within 72 hours.
- Failing to protect data can cost up to ₹250 crore per instance. Failing to report a breach, up to ₹200 crore.
- A customer list copied to a pen drive or pasted into a chatbot can be a breach. Laptops are where most teams are least prepared.
What the DPDP Act and Rules are
The Digital Personal Data Protection Act, 2023 is India’s first comprehensive law on personal data. It was passed in August 2023 but could not take effect until the government issued the detailed rules. The DPDP Rules, 2025 were notified by MeitY on 13 November 2025, and they bring the Act into force in three phases.
The Act covers digital personal data: data collected online, or collected offline and later digitised. It applies to processing inside India, and to processing outside India when it is connected with offering goods or services to people in India.
Three roles matter:
- Data Fiduciary — the business that decides why and how personal data is processed. If you are a bank, NBFC, fintech or SaaS company with Indian customers, this is you.
- Data Processor — a vendor processing data on your behalf. You stay responsible for what they do, so your contracts must carry the security duties down to them.
- Significant Data Fiduciary (SDF) — a fiduciary the government notifies because of the volume or sensitivity of what it processes. SDFs have extra duties, including an annual Data Protection Impact Assessment and audit.
The timeline: what applies when
| Date | What comes into force | What it means for you |
|---|---|---|
| 13 Nov 2025 | Definitions and the Data Protection Board (Rules 1, 2, 17–21) | The regulator is being set up. No new duties on businesses yet. |
| 13 Nov 2026 | Registration of Consent Managers (Rule 4) | Consent Manager platforms can register. Mostly relevant if you plan to use one. |
| 13 May 2027 | Everything else (Rules 3, 5–16, 22–23) | Notice and consent, security safeguards, breach reporting, erasure, data principal rights and SDF duties all apply. |
Eighteen months sounds generous. It isn’t, if you have to find out where personal data actually sits first, then change processes, contracts and tooling around it. Teams that start in early 2027 will be writing policies with no evidence behind them.
The obligations security teams own
Most DPDP commentary focuses on consent banners and privacy notices. Those matter, but they belong to product and legal. Four obligations land squarely on security and IT.
1. Reasonable security safeguards (Section 8(5), Rule 6)
The Act says a Data Fiduciary must protect personal data in its possession or under its control, “including in respect of any processing undertaken by it or on its behalf by a Data Processor”, by taking reasonable security safeguards to prevent a breach. Rule 6 sets out the minimum. In plain terms:
- Protect the data itself with encryption, obfuscation, masking or virtual tokens.
- Control access to the systems that hold it.
- Keep logs, monitoring and review that let you detect unauthorised access, investigate it and fix it.
- Have backups and continuity measures so processing can continue after an incident.
- Retain those logs and the related personal data for at least one year, to support investigation, unless another law says otherwise.
- Put security obligations into contracts with Data Processors.
- Take the organisational and technical measures needed to make all of this actually work.
Note the word “control”. A spreadsheet of customer PANs on an employee’s laptop is still personal data under your control. So is a CSV a support agent exported to “check something quickly”.
2. Breach intimation (Section 8(6), Rule 7)
The Act defines a personal data breach broadly: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration or destruction of personal data, or loss of access to it, that compromises its confidentiality, integrity or availability. That is much wider than “we were hacked”.
When you become aware of one, Rule 7 requires two things:
- Without delay, inform the Data Protection Board and each affected Data Principal. The notice to individuals must describe the breach, its likely consequences, what you are doing about it, what they can do to protect themselves, and who to contact.
- Within 72 hours (or a longer period the Board allows), give the Board a detailed report: the facts, circumstances and reasons for the breach, mitigation, findings about who caused it, remedial steps to prevent a repeat, and a report on the notices sent to individuals.
Seventy-two hours is enough time to write a report. It is not enough time to work out what was on a laptop, how many records were in the file, and where else it was copied — unless you already know.
Also remember that the CERT-In directions of April 2022 already require many cyber incidents to be reported to CERT-In within six hours. DPDP adds to that; it does not replace it.
3. Erasure when the purpose ends (Section 8(7), Rule 8)
You must erase personal data once the purpose it was collected for is no longer being served, or the person withdraws consent, unless another law requires you to keep it. In practice, this means old exports, reports and copies scattered across laptops and shared drives become a liability, not just clutter.
4. Duties of Significant Data Fiduciaries (Section 10, Rule 13)
If you are notified as an SDF, you must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and audit every year. You must also check that algorithmic software you deploy does not risk the rights of Data Principals — a clause that matters as more processing moves to AI models and agents.
Penalties
The Schedule to the Act sets the maximum penalty the Board can impose for each type of breach. The Board considers the nature, gravity and duration of the breach, whether it was repeated, and what you did to mitigate it.
| Breach of | Maximum penalty |
|---|---|
| Duty to take reasonable security safeguards | ₹250 crore |
| Duty to notify the Board and individuals of a breach | ₹200 crore |
| Additional duties for children’s data | ₹200 crore |
| Additional duties of a Significant Data Fiduciary | ₹150 crore |
| Any other provision of the Act or Rules | ₹50 crore |
The top two lines are the ones a single lost laptop or leaked export can trigger, and they can stack: weak safeguards that led to the breach, and a slow or incomplete report afterwards.
Why employee laptops are the gap
Most Indian companies have invested in protecting production: database access controls, cloud security posture tools, WAFs. Very few can answer simple questions about their endpoints:
- Which laptops have files containing Aadhaar or PAN numbers right now?
- Who copied a customer export to USB last month?
- Has anyone pasted account numbers into a public AI chatbot?
- If a laptop were stolen tonight, how many people would you have to notify?
Under DPDP, each of these is a security-safeguard question and a breach-reporting question. Personal data leaves production every day — for reconciliation, collections, support escalations, analytics and debugging — and it lands on laptops. From there it can leave through channels network tools don’t see: USB drives, AirDrop, personal cloud sync, web uploads and AI tools.
A six-month readiness plan
If you are starting now, this sequence gets a mid-sized team to defensible ground by May 2027.
- Month 1 — Map. List the personal data you collect, why, and the systems that hold it. Include laptops and SaaS tools, not just databases. Run discovery on endpoints to see the real picture rather than the documented one.
- Month 2 — Clean up. Delete stale exports and copies whose purpose has ended. Turn on full-disk encryption everywhere. Fix the obvious access-control gaps.
- Month 3 — Control the exits. Put rules on the channels data leaves through: USB, personal cloud, uploads, AI tools. Start in monitor or warn mode to learn normal behaviour before you block.
- Month 4 — Log and retain. Make sure access and movement of personal data is logged centrally and kept for at least one year, in a form an investigator can use.
- Month 5 — Rehearse a breach. Run a tabletop: a laptop with a KYC export is lost. Can you produce the Board notice, the individual notices, and the 72-hour report? Time it.
- Month 6 — Contracts and evidence. Update processor contracts with security duties. Collect the evidence pack: policies, logs, reports, training records.
Checklist for security and IT
- We know which laptops and systems hold personal data, and how much.
- Full-disk encryption is enforced on every work laptop.
- Personal data is masked or tokenised wherever full values aren’t needed.
- USB, personal cloud, uploads and AI tools have rules for personal data.
- Access and movement of personal data is logged and kept for one year or more.
- We can produce a breach timeline — what data, how many records, where it went — within hours.
- We have notice templates for the Board and for affected individuals.
- Processor contracts include security safeguards and breach cooperation.
- Stale personal data is found and deleted on a schedule.
- We have run at least one breach tabletop exercise.
How Scanyx helps
Scanyx covers the endpoint half of this list. It finds personal data on every work laptop and checks disk encryption, controls how that data leaves — block, encrypt, warn or allow with a reason — and keeps an incident record with the record counts and lineage you need for a 72-hour report. Files are scanned on the laptop; only masked findings are sent to the console. AI Guardian adds the same visibility and control for AI tools and agents.
If you want to see what’s sitting on your own laptops, it is free for up to five. Book a 20-minute demo.
This article is a practical summary for security and IT teams, not legal advice. Read the DPDP Act and Rules as published by MeitY and consult counsel for decisions about your organisation.