DPDP Rules 2025 Compliance Timeline for Foreign Companies in India
What the DPDP Act, 2023 and the DPDP Rules 2025 mean for a foreign company or Indian subsidiary. Phased dates, notice and consent, fiduciary duties, breach reporting, transfers abroad, the Board and penalties.
Krystal7 Consultants · India entry, tax and compliance
Written by CA Nandini Hasija, Krystal7 Consultants. Last updated 23 October 2026.
The DPDP Rules 2025 were notified as G.S.R. 846(E) on 13 Nov 2025 under the Digital Personal Data Protection Act, 2023. The Data Protection Board was established that day. Consent manager rules apply from 13 Nov 2026. Notice, consent, security, breach reporting, rights and transfer rules apply from 13 May 2027. A foreign company is covered when it processes data in India, or offers goods or services to people in India.
This page covers who the Act reaches, the phased dates, notice and consent, and fiduciary duties. It also covers significant data fiduciaries, transfers abroad, breach reporting, the Board and penalties. It ends with a worked breach timeline and a readiness checklist for an Indian subsidiary.
When do the DPDP Rules 2025 apply to a foreign company?
The core duties apply from 13 May 2027, eighteen months after the Rules were published on 13 Nov 2025. That date covers notice, consent, security, breach reporting, erasure, rights and transfers. Rules on consent managers start on 13 Nov 2026. The Board and its procedure rules have applied since 13 Nov 2025.
The Ministry of Electronics and Information Technology (MeitY) published three notifications on 13 Nov 2025:
G.S.R. 843(E) appointed the dates on which each section of the DPDP Act takes effect.
G.S.R. 844(E) established the Data Protection Board of India, with its head office in the National Capital Region.
The PIB release of 14 Nov 2025 announced the Rules the next day, so some summaries give 14 Nov. The gazette date is 13 Nov 2025. A corrigendum, G.S.R. 892(E) of 10 Dec 2025, fixed drafting errors in the Rules without changing any date.
Parliament passed the Act as Act 22 of 2023, and it received assent on 11 Aug 2023. MeitY published the draft Rules for comment as G.S.R. 02(E) on 3 Jan 2025, with comments due by 18 Feb 2025.
What is the phased commencement timeline?
G.S.R. 843(E) and rule 1 of the Rules split commencement into three phases. The Board and its procedure took effect on 13 Nov 2025. Consent manager registration follows on 13 Nov 2026. Everything that changes how a business handles data follows on 13 May 2027.
Phase
Date
Sections of the Act in force
Rules in force
On publication
13 Nov 2025
1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3)
Rules 1, 2 and 17 to 21
One year after publication
13 Nov 2026
6(9) and 27(1)(d)
Rule 4
Eighteen months after publication
13 May 2027
3 to 5; 6(1) to 6(8) and 6(10); 7 to 17; 27 except 27(1)(d); 28 to 34; 36 and 37; 44(2)
Rules 3, 5 to 16, 22 and 23
Three effects of this split catch foreign groups out:
Section 3 itself starts on 13 May 2027. The territorial reach of the Act applies from that date, along with the duties.
The IT Act rules continue until then. Section 44(2) omits section 43A of the Information Technology Act, 2000 only from 13 May 2027. Until that date, the 2011 rules on sensitive personal data under section 43A still bind a body corporate in India.
Penalties wait for the duties. Section 33 and the Schedule start on 13 May 2027, so the Board cannot penalise a breach of a duty that is not yet in force.
We found no gazette notification changing these dates on the MeitY and eGazette listings by 23 Oct 2026. MeitY discussed a shorter window in 2026, so check the Gazette before you fix your programme dates. The section "What has happened since" below covers those reports.
Does the DPDP Act apply to a company outside India?
Yes, in one case. Section 3(b) applies the Act to processing outside India if it relates to offering goods or services to Data Principals in India. A US software company selling subscriptions to Indian users is covered. A foreign company with no Indian customers, users or staff is not.
A foreign SaaS seller also faces GST on its Indian sales, as our guide to OIDAR services explains. The two regimes reach the same business from different angles.
Section 3(a) covers all processing within India of personal data collected digitally, or collected on paper and digitised later. Section 3(c) excludes processing by an individual for personal or domestic purposes, and data the person or a legal duty has made public.
Situation
Is the Act engaged?
Main provision
Practical note
Foreign SaaS company sells to Indian businesses and users, with no Indian entity
Yes, for Indian users' data
Section 3(b)
Notice, consent, security and a contact person for Indian users
Indian subsidiary processes its own employees' data
Yes
Section 3(a); section 7(i)
Employment is a legitimate use, so consent is not needed for employment purposes
Indian subsidiary sends staff data to the parent's global HR system
Yes
Sections 3(a), 8 and 16
The subsidiary stays the fiduciary for that data and must secure the transfer
Indian capability centre processes data of foreign residents for the parent under a contract
Mostly exempt
Section 17(1)(d)
Sections 8(1) and 8(5) still apply, so security safeguards remain
Indian subsidiary processes Indian customers' data as the parent's vendor
Yes, as a processor
Sections 8(1) and 8(2)
The fiduciary needs a contract with the processor
Foreign company only buys from Indian suppliers
Only for Indian contact persons' data, if processed in India
Section 3
Usually limited to business contact data
The capability centre exemption deserves care. Section 17(1) switches off most of Chapter II, all of Chapter III and section 16 for this processing. It keeps section 8(1) on responsibility and section 8(5) on security safeguards. A centre that loses foreign customer data can still face the INR 250 crore penalty for weak safeguards. Our guide to setting up a global capability centre covers the rest of the structure.
Who is a data fiduciary and who is a data processor?
A Data Fiduciary decides why and how personal data is processed, alone or with others (section 2(i)). A Data Processor processes data on its behalf (section 2(k)). The fiduciary carries the duties and stays responsible for its processors under section 8(1). A processor may act only under a valid contract (section 8(2)).
In a foreign group, the roles often split across entities:
The Indian subsidiary as fiduciary. It decides on its own employees' data, its Indian customers' data and its vendor contacts.
The parent as fiduciary. It decides on data it collects from Indian users through a global website or app, under section 3(b).
Joint fiduciaries. Where the parent and the subsidiary decide purposes together, for example a group CRM, both can be fiduciaries.
Group service providers as processors. A shared service company that hosts or runs payroll for the subsidiary acts as a processor and needs a written contract.
The Act has no separate rule for intra group transfers. We draft a group data processing agreement that names the fiduciary for each data set and binds each processor to rule 6 safeguards. Our legal advisory team drafts these agreements.
What must a consent notice contain?
Section 5 requires a notice with every consent request, or before it. Rule 3 requires the notice to stand alone and be clear. It must list the personal data and the specific purpose. It must link to the website or app where the person can withdraw consent, exercise rights and complain to the Board.
The Act gives two lawful grounds under section 4: consent, or a legitimate use under section 7. Consent under section 6 must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Withdrawal must be as easy as giving consent (section 6(4)).
Section 7 lists the legitimate uses. Two matter most for a subsidiary:
Section 7(a). Data the person gives voluntarily for a specified purpose, without objecting to its use.
Section 7(i). Employment purposes, and protecting the employer from loss or liability, such as preventing corporate espionage or protecting trade secrets.
So an Indian employer does not need consent to run payroll or appraisals. It still needs security, accuracy, erasure and grievance processes for that data from 13 May 2027.
Consent managers start earlier. Rule 4 and section 6(9) apply from 13 Nov 2026. A consent manager must be an Indian company registered with the Board. Part A of the First Schedule requires a net worth of at least INR 2 crore.
What duties does a data fiduciary have?
Section 8 sets the core duties from 13 May 2027. The fiduciary must keep data accurate, take reasonable security safeguards and report breaches. It must erase data once the purpose ends, publish a contact person and run a grievance process. The Rules give each duty its detail.
Duty
Provision
What the Rules add
Applies from
Responsibility for processors
Section 8(1), 8(2)
Contract with each processor
13 May 2027
Reasonable security safeguards
Section 8(5)
Rule 6: encryption or masking, access control, logs and monitoring, backups; keep logs for one year
13 May 2027
Breach intimation
Section 8(6)
Rule 7: each affected person without delay; Board report within 72 hours
13 May 2027
Erasure when the purpose ends
Section 8(7)
Rule 8: three year periods and 48 hours' notice for listed platforms
13 May 2027
Retention for state purposes
Rule 8(3); Seventh Schedule
Personal data, traffic data and logs kept for at least one year
13 May 2027
Contact person or Data Protection Officer
Section 8(9)
Rule 9: publish business contact details prominently
13 May 2027
Grievance redress
Section 8(10), section 13
Rule 14: publish the process and resolve within 90 days
13 May 2027
Rights of access, correction, erasure, nomination
Sections 11 to 14
Rule 14: means of request on the website or app
13 May 2027
Rule 6 lists the safeguards in plain terms. They include encryption, obfuscation, masking or virtual tokens, access controls, logs that make access visible, monitoring and backups. The fiduciary keeps the logs and the related personal data for one year to detect and remedy breaches, unless another law needs longer.
Rule 8 sets erasure periods only for large platforms in the Third Schedule. These are ecommerce entities and social media intermediaries with at least 2 crore registered users in India. Online gaming intermediaries qualify at 50 lakh users. Data is erased three years after the person last engaged, after 48 hours' notice. Other fiduciaries erase when the purpose is served, under section 8(7).
How must a personal data breach be reported?
Rule 7 requires two intimations. The fiduciary tells each affected Data Principal without delay, in plain language. It also tells the Board without delay. A detailed report follows within 72 hours of becoming aware, or a longer period the Board allows. Both duties start on 13 May 2027.
Intimation
To whom
Deadline
Contents
Provision
First notice to each affected person
Every affected Data Principal
Without delay
What happened, likely consequences, steps taken, steps the person can take, contact details
Rule 7(1); section 8(6)
First notice to the Board
Data Protection Board
Without delay
Description of the breach, its nature, extent, timing, location and likely impact
Rule 7(2)
Detailed report to the Board
Data Protection Board
Within 72 hours, or a longer period the Board allows
Facts and causes, mitigation, findings on who caused it, remedial steps, and the notices given to people
Rule 7(2)
Cyber incident report
Indian Computer Emergency Response Team (CERT-In)
Within six hours of noticing a reportable incident
Incident details in the agency's format
CERT-In directions No. 20(3)/2022-CERT-In of 28 Apr 2022 under section 70B of the IT Act
The CERT-In clock is much shorter and runs under the Information Technology Act, 2000. The two regimes run side by side, so one incident can trigger both reports. We keep one incident log and file each report from it.
Our reading is that the 72 hour clock runs from the moment the fiduciary becomes aware of the breach. A processor's delay in telling the fiduciary does not stop the clock, so processor contracts should require notice within hours.
What is a significant data fiduciary?
A significant data fiduciary is a fiduciary, or a class of them, that the Central Government notifies under section 10. The factors include the volume and sensitivity of data, risk to people, and effects on sovereignty, security and public order. It must appoint an India based Data Protection Officer and an independent data auditor, and run impact assessments and audits.
Section 10(2) and rule 13 set the extra duties:
Data Protection Officer. Based in India and answerable to the board of directors or similar governing body (section 10(2)(a)).
Independent data auditor. Appointed to evaluate compliance (section 10(2)(b)).
Impact assessment and audit. A Data Protection Impact Assessment and an audit once every twelve months, with a report of significant observations to the Board (rule 13).
Algorithmic due diligence. Checks that algorithmic software used for processing does not risk the rights of Data Principals (rule 13).
Localisation for specified data. Personal data the Centre specifies on a committee's advice must not leave India, with its traffic data (rule 13).
We found no notification naming any significant data fiduciary by 23 Oct 2026. Large platforms, health and financial data processors and companies handling children's data at scale should plan as if they may be named. A breach of section 10 duties carries up to INR 150 crore under the Schedule.
Can personal data be transferred outside India?
Yes, unless the Central Government restricts transfers to a notified country or territory under section 16(1). The Act uses a restricted list, not an approved list. Rule 15 lets the Centre set requirements, by general or special order, on making transferred data available to a foreign State or its agencies. Sector laws with stricter rules prevail under section 16(2).
What this means for a group sending Indian data to a parent or a cloud region abroad:
No list yet. We found no notification under section 16(1) restricting any country by 23 Oct 2026.
No transfer contract template. The Act and Rules do not prescribe standard clauses. The fiduciary still owes security under section 8(5) wherever the data sits.
Sector rules first. Section 16(2) keeps any Indian law with a higher degree of protection, such as RBI's directions on storing payment system data in India.
Significant data fiduciaries. Rule 13 can require specified data to stay in India.
From 13 May 2027, we record each outbound data flow with the country, the recipient, the purpose and the safeguards. That register answers the Board's questions and any future section 16 notification.
If you plan to keep data in India instead, our guide to the data centre India tax holiday covers the incentives, rules and approvals.
What are the rules for children's data?
Section 9 requires verifiable consent from a parent or lawful guardian before processing data of a child under 18. It bans processing likely to harm a child's well being, and tracking, behavioural monitoring or targeted advertising aimed at children. Rule 10 sets the verification methods, and rule 12 lists exemptions.
Rule 10 requires the fiduciary to check that the person consenting is an identifiable adult. It can rely on identity details it already holds or a virtual token from a trusted source such as DigiLocker. Rule 12 and the Fourth Schedule exempt listed classes and purposes, such as healthcare, education and real time safety, from parts of section 9.
For an edtech, gaming or consumer app with Indian users, this is the costliest change. A breach of section 9 carries up to INR 200 crore under the Schedule.
What is the Data Protection Board and how are penalties set?
The Data Protection Board of India, established on 13 Nov 2025 under section 18, inquires into breaches, directs remedies and imposes penalties. It works as a digital office. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days under section 29. Penalties run up to INR 250 crore for each breach listed in the Schedule.
Schedule item
Breach
Maximum penalty
1
Failure to take reasonable security safeguards (section 8(5))
INR 250 crore
2
Failure to notify the Board or affected people of a breach (section 8(6))
INR 200 crore
3
Breach of the duties for children (section 9)
INR 200 crore
4
Breach of the extra duties of a significant data fiduciary (section 10)
INR 150 crore
5
Breach of a Data Principal's duties (section 15)
INR 10,000
6
Breach of a voluntary undertaking accepted by the Board (section 32)
Up to the penalty for the original breach
7
Any other breach of the Act or Rules
INR 50 crore
Section 33(2) makes the Board weigh the nature, gravity and duration of the breach and the type of data. It also weighs repetition, any gain made or loss avoided, mitigation and proportionality. A person must exhaust the fiduciary's grievance process before complaining to the Board, under section 13(3).
The Board's members were not in place when MeitY invited applications on 6 May 2026. Its circular F. No. 2(1)/2026-Pers.I sought one Chairperson and four Members, including at least one legal expert. We found no official notice appointing the Chairperson or Members by 23 Oct 2026. Check the MeitY website and the Gazette for the Board's constitution.
What should an Indian subsidiary of a foreign group do before 13 May 2027?
Map the data, name the fiduciary for each data set, and fix the contracts with group processors. Then rewrite notices, build the rights and grievance process, set up breach reporting to both the Board and CERT-In, and record outbound transfers. Most of this work takes months, so start in 2026.
A software subsidiary holds customer, employee and vendor data from day one, as our guide to software company registration in India shows. We sequence the programme in this order:
Now. Data inventory by system, with the Indian data, the purpose and the legal ground for each.
By 13 Nov 2026. Decide whether you will use a registered consent manager for consumer products.
First quarter of 2027. Group processing agreements, new notices, the contact person page, the grievance desk and the incident response plan.
By 13 May 2027. Go live with notices, rights handling within 90 days, rule 6 safeguards, log retention and the transfer register.
Employee data needs its own track. Section 7(i) covers employment purposes, but staff still get rights of access, correction and grievance. Exit files and committee records under the POSH Act hold sensitive data, so set access controls and retention periods for them. Our note on termination and final dues covers the exit process those files support.
What changed in 2026
The Act had been on the statute book since 2023. The dates and machinery arrived with the November 2025 notifications. The table lists each step.
Date
Old position
New position
Instrument
11 Aug 2023
No general data protection law; section 43A of the IT Act and 2011 rules
DPDP Act, 2023 enacted, not yet in force
Act 22 of 2023
3 Jan 2025
No rules
Draft DPDP Rules published; comments to 18 Feb 2025
G.S.R. 02(E)
13 Nov 2025
Act not in force
Board provisions in force; Board established in the National Capital Region
G.S.R. 843(E); G.S.R. 844(E)
13 Nov 2025
Draft rules
Final DPDP Rules 2025 with phased commencement
G.S.R. 846(E)
10 Dec 2025
Drafting errors in the Rules
Corrections, no change of dates
G.S.R. 892(E)
6 May 2026
Board without members
Applications invited for a Chairperson and four Members
MeitY circular F. No. 2(1)/2026-Pers.I
13 Nov 2026
No consent manager regime
Consent manager registration with the Board
Section 6(9); rule 4
13 May 2027
Section 43A of the IT Act and the 2011 rules
Full DPDP duties, penalties and transfer rules; section 43A omitted
Section 44(2); rules 3, 5 to 16, 22 and 23
What has happened since
This guide was first published on 3 Jan 2026. Since then, MeitY invited applications for the Board's Chairperson and Members on 6 May 2026. Practitioner reports in February 2026 said MeitY put a proposal to industry on 23 Jan 2026. It would shorten the eighteen month window to twelve months for some duties, with comments due by 4 Feb 2026. We found no gazette notification that changes the dates by 23 Oct 2026, so the table above still shows the law. We treat the proposal as unconfirmed until it appears in the Gazette.
Worked example
Scenario 1. A breach at a US company's Indian subsidiary. A US software company sells subscriptions to Indian businesses and runs customer support from a Pune subsidiary. On Tuesday 8 Jun 2027 at 11:00 IST, the subsidiary's security team finds that a misconfigured storage bucket exposed support tickets. The tickets hold names, phone numbers and emails of Indian customers' staff.
The subsidiary is the fiduciary for its own support data, and the parent is the fiduciary for its platform data. Both run the same incident log. The clocks run as follows:
Step
Deadline
Working
Report to CERT-In
Tuesday 8 Jun 2027, 17:00 IST
Six hours from 11:00
First notice to the Board
Without delay, so on 8 Jun 2027
Rule 7(2)
Notice to each affected person
Without delay, in plain language
Rule 7(1)
Detailed report to the Board
Friday 11 Jun 2027, 11:00 IST
72 hours from 11:00 on 8 Jun
Logs kept for review
At least until 8 Jun 2028
One year under rule 6
Suppose a customer's employee then asks on Thursday 1 Jul 2027 for a summary of the data held about her. Rule 14 caps the grievance process at 90 days, and we apply the same limit to rights requests, so the outer date is Wednesday 29 Sep 2027. We aim for 30 days.
The exposure is two Schedule items. Weak safeguards (item 1) carry up to INR 250 crore, and a late breach notice (item 2) up to INR 200 crore. The Board fixes any amount under section 33(2), so a quick notice and full mitigation reduce the risk.
Scenario 2. Erasure on a large platform. A foreign ecommerce marketplace has 2.4 crore registered users in India, so the Third Schedule applies. A user last bought on 15 Jan 2026 and never returned. Rule 8 counts three years from the later of the last engagement and the commencement of the Rules.
The Rules were published on 13 Nov 2025, but rule 8 itself starts on 13 May 2027. If "commencement" means publication, the later date is the user's last purchase, so erasure falls on 15 Jan 2029. If it means the start of rule 8, the later date is 13 May 2027, so erasure falls on 13 May 2030.
Reading of "commencement"
Start of the three years
Erasure date
Notice by
Publication of the Rules
15 Jan 2026 (later than 13 Nov 2025)
15 Jan 2029
13 Jan 2029
Commencement of rule 8
13 May 2027 (later than 15 Jan 2026)
13 May 2030
11 May 2030
We plan for the earlier date, 15 Jan 2029, and send the 48 hour notice by 13 Jan 2029. Rule 8(3) still requires the platform to keep the related logs and traffic data for at least one year from processing.
Common mistakes
Treating 13 Nov 2025 as the go live date. Only the Board provisions started then. Fix: plan the programme to 13 May 2027 and the consent manager decision to 13 Nov 2026.
Dropping the IT Act rules early. Section 43A of the IT Act stays until 13 May 2027. Fix: keep the 2011 sensitive data policies in force until then.
Asking employees for consent to everything. Section 7(i) covers employment purposes. Fix: use the legitimate use ground for HR processing and give a clear notice.
Assuming the capability centre exemption covers security. Sections 8(1) and 8(5) still apply under section 17(1)(d). Fix: apply rule 6 safeguards to foreign customer data too.
Running one breach clock. CERT-In needs six hours, and the Board needs a report within 72 hours. Fix: one incident log with both deadlines.
No contract with group processors. Section 8(2) needs a valid contract. Fix: sign a group data processing agreement naming the fiduciary for each data set.
No register of transfers. Section 16 can restrict a country at any time. Fix: keep a register of outbound flows by country and recipient.
Ignoring sector rules. Section 16(2) keeps stricter laws in force. Fix: check RBI, SEBI and IRDAI rules that bind your business before moving data abroad.
Checklist
List every system that holds personal data of people in India, with the purpose and legal ground for each.
Name the Data Fiduciary and each Data Processor for every data set, across group entities.
Sign group data processing agreements that bind processors to rule 6 safeguards and quick breach notice.
Decide by 13 Nov 2026 whether consumer products will use a registered consent manager.
Rewrite consent notices to meet section 5 and rule 3, with links to withdraw consent and to complain.
Publish the contact person or Data Protection Officer details under rule 9.
Build a request and grievance desk that resolves grievances and rights requests within 90 days, the limit in rule 14.
Apply rule 6 safeguards and keep logs and related data for one year.
Write an incident plan with the six hour CERT-In report and the 72 hour Board report.
Set erasure rules for each data set, and the rule 8 schedule if you are a listed platform.
Record every outbound transfer with country, recipient, purpose and safeguards.
Check whether section 9 applies to any product used by children, and build verifiable consent.
Train HR, support and engineering teams before 13 May 2027.
In three phases from G.S.R. 846(E) of 13 Nov 2025. Rules 1, 2 and 17 to 21 on the Board applied on publication. Rule 4 on consent managers applies from 13 Nov 2026. Rules 3, 5 to 16, 22 and 23, which hold the main business duties, apply from 13 May 2027.
Does the DPDP Act apply to a foreign company with no Indian entity?+
Yes, if it offers goods or services to people in India. Section 3(b) of the Digital Personal Data Protection Act, 2023 covers processing outside India in connection with that activity. A foreign SaaS company with Indian users must meet the notice, consent, security and breach duties for their data from 13 May 2027.
Is an Indian subsidiary of a foreign company covered by the DPDP Act?+
Yes. Section 3(a) covers all digital processing within India. The subsidiary is a Data Fiduciary for its employees' and Indian customers' data. Processing of foreign residents' data under a contract with a foreign party is largely exempt under section 17(1)(d). Security duties under section 8(5) still apply.
Do employers need consent to process employee data under the DPDP Act?+
No, for employment purposes. Section 7(i) treats processing for employment, and for protecting the employer from loss or liability, as a legitimate use. The employer still owes security, accuracy, erasure and grievance duties under section 8, and employees keep their rights of access and correction.
What is the breach notification deadline under the DPDP Rules?+
Rule 7 requires notice to each affected person without delay, and to the Data Protection Board without delay. A detailed report must reach the Board within 72 hours of becoming aware, or a longer period the Board allows. CERT-In's separate six hour reporting duty under the IT Act also applies.
Can personal data be transferred outside India under the DPDP Act?+
Yes, unless the Central Government restricts transfers to a notified country under section 16(1). Rule 15 lets the Centre set requirements about access by foreign States. Stricter sector laws continue under section 16(2). We found no restricted country notified by 23 Oct 2026.
What is a Significant Data Fiduciary?+
A Data Fiduciary or class notified by the Central Government under section 10 of the DPDP Act, based on data volume, sensitivity and risk. It must appoint a Data Protection Officer based in India and an independent data auditor. Rule 13 requires an impact assessment and audit every twelve months.
Does a foreign company need a Data Protection Officer in India?+
Only if it is notified as a Significant Data Fiduciary, under section 10(2)(a). Every other fiduciary must publish the business contact details of a Data Protection Officer or another person who answers processing questions. Section 8(9) and rule 9 of the DPDP Rules 2025 set this duty.
What are the penalties under the DPDP Act?+
The Schedule sets maximums of INR 250 crore for weak security safeguards and INR 200 crore each for missed breach notices and children's duties. It sets INR 150 crore for significant data fiduciary duties and INR 50 crore for other breaches. The Board fixes the amount under section 33(2).
How long does a company have to answer a data access request?+
Rule 14 of the DPDP Rules 2025 requires fiduciaries and consent managers to publish a grievance process that resolves grievances within 90 days at most. The PIB backgrounder of 17 Nov 2025 applies the same limit to access, correction and erasure requests. The duty applies from 13 May 2027. A person must use the fiduciary's grievance process before complaining to the Board, under section 13(3).
What is a Consent Manager under the DPDP Rules?+
An India based company registered with the Data Protection Board that lets people give, manage, review and withdraw consent. Section 6(9) and rule 4 apply from 13 Nov 2026. Part A of the First Schedule requires a net worth of at least INR 2 crore, among other conditions.
Does the IT Act's section 43A still apply?+
Yes, until 13 May 2027. Section 44(2) of the DPDP Act omits section 43A of the Information Technology Act, 2000 from that date, under G.S.R. 843(E). Until then, the 2011 rules on sensitive personal data still bind a body corporate handling such data in India.
How do you appeal a Data Protection Board order?+
File an appeal with the Telecom Disputes Settlement and Appellate Tribunal within 60 days of receiving the order, under section 29 of the DPDP Act. Rule 22 of the DPDP Rules 2025 requires the appeal to be filed digitally, with fees on the pattern of the TRAI Act.
What should a company do about children's data under the DPDP Act?+
Get verifiable consent from a parent or lawful guardian before processing data of anyone under 18, under section 9 and rule 10. Stop tracking, behavioural monitoring and targeted advertising aimed at children. Check the Fourth Schedule exemptions under rule 12 for healthcare, education and safety purposes.
Sources
Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
Gazette of India, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 Nov 2025, https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
Gazette of India, notification appointing dates for the DPDP Act, 2023, G.S.R. 843(E), 13 Nov 2025, https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf
Gazette of India, establishment of the Data Protection Board of India, G.S.R. 844(E), 13 Nov 2025, https://www.meity.gov.in/static/uploads/2025/11/cc217843dc3bcb37b2b05bcc3b4e031f.pdf
Gazette of India, corrigendum to G.S.R. 846(E), G.S.R. 892(E), 10 Dec 2025, https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf
Gazette of India, draft Digital Personal Data Protection Rules, 2025, G.S.R. 02(E), 3 Jan 2025, https://www.meity.gov.in/static/uploads/2025/02/f8a8e97a91091543fe19139cac7514a1.pdf
Ministry of Electronics and Information Technology, Appointment to the post of Chairperson and Other Members in the Data Protection Board of India, F. No. 2(1)/2026-Pers.I, 6 May 2026, https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf
Press Information Bureau, Government notifies DPDP Rules to empower citizens and protect privacy, 14 Nov 2025, https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2190014
Press Information Bureau, DPDP Rules, 2025 Notified (backgrounder), 17 Nov 2025, https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
Indian Computer Emergency Response Team, Directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents under section 70B(6) of the IT Act, No. 20(3)/2022-CERT-In, 28 Apr 2022, https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf
TALK TO AN ADVISOR
Facing this in your own entity?
Guides explain the rules. A conversation solves your specific case. Talk to a Krystal7 Consultants advisor about your India entry, FEMA or compliance position.
Nandini Hasija is a co-founder of Krystal7. She leads brand, business development and marketing, and works with founders to define their engagement. She is a Chartered Accountant and achieved All India Rank 49 in the CA examinations.
Six things you can check before you sign, and hold us to after.
A Chartered Accountant signs off
Filings go out through our Chartered Accountant practice, led by CA Nandini Hasija, All India Rank 49, ICAI.
A reply within 4 business hours
The team is online from 9:30 AM to 11:59 PM IST, which covers the working day in the UK and the UAE, the afternoon in Singapore and the morning in the US.
The fee is fixed before work starts
You see the professional fee in writing first. Government fees are passed on at cost.
Both sides of the border, one team
Company law, FEMA and RBI reporting, tax and transfer pricing sit with the same advisers.
Your due dates, tracked by us
We keep the compliance calendar for your entity and tell you what is due before it is due.
500+ clients across 5 continents
More than 50 advisers on the bench when a matter needs a specialist.
Working with the Kristal7 team has been an absolute pleasure. Their professionalism, attention to detail, pace they work at and commitment to delivering top-quality results stand out. They took the time to understand our needs and executed seamlessly. Highly recommend Kristal7 to anyone looking for a reliable partner to establish business in India.
We can't be happier after dealing with true professionals who really do things in India. Absolutely recommended, high-class professionals, Nihal knows his stuff better than anybody in India, trust me. Highly recommended if you ever need any type of business needs to be done properly and ON TIME in India! Thank you guys!!!
Krystal7 Consultants has an exemplary and professional attitude in their approach to services rendered by them. The team and it's leaders are thoroughly aggressive all throughout setting the processes timely and getting procedures done in a time bound and disciplined manner. Highly recommended Consultants to go-to.We wish them all the very best in all their future endeavours and growth story.
I had a great experience with this firm while filing my ITR! The team handled my ITR filing end-to-end, answered all my queries patiently, and made the entire process smooth and hassle-free. Nandini is highly professional, responsive, and took complete ownership throughout. Highly recommended for anyone looking for reliable tax filing assistance.
Very energetic and young professionals with best consultation and commitment of work completion on time in regionable fees. Mr. Nihal is very punctual & committed .
Very happy with my experience with them. They have thoroughly guided me through the processes and executed them as planned, for all my registrations. Definitely would recommend using their services.
Recap
Crystal Seven Consultants, especially Nandini Hassija and Nihal Srivastava, have redefined my experience with compliance management. From professionalism to problem-solving, they delivered trust, accuracy, and peace of mind—qualities rare in this industry.
Detailed Review
When Nandini first called me from Crystal Seven Consultants, I’ll admit I was hesitant. In the compliance and consultancy space, it’s common to see aggressive sales tactics with little to no delivery. But Nandini immediately broke that stereotype with her professionalism, clear communication, and genuine approach. She personally assisted me with something as important as a resignation process, ensuring it was handled responsibly and without stress.
Later, Nihal stepped in and impressed me with his technical expertise and eye for detail. He uncovered a serious compliance error (a mug-up) created by my previous consultant—something that could have been risky and damaging for my company. The way Nihal managed this issue with care, accuracy, and professionalism gave me full confidence that my compliance matters were finally in safe hands.
Today, I rest assured knowing that Daxy’s compliances are being managed with integrity, precision, and accountability. Both Nandini and Nihal have shown me that this industry can, in fact, be built on trust, transparency, and delivery.
I genuinely recommend Crystal Seven Consultants to any business owner who wants their legal, financial, and compliance matters handled not just properly—but with care, reliability, and genuine expertise.
We use Google Analytics to see how the site is used and Google Ads cookies to measure enquiries that come from our ads. You choose what we use, and you can change it at any time. Cookie policy