# DPDP Rules 2025 Compliance Timeline for Foreign Companies in India

> Source: https://krystal7.com/insights/dpdp-rules-2025-compliance-foreign-companies
> Publisher: Krystal7 Consultants (Krystal7 Innovations Private Limited), Gurugram, India
> Author: CA Nandini
> Published: 03 Jan 2026; updated 24 Oct 2026
> Summary: The DPDP Rules 2025 were notified on 13 Nov 2025, and most duties for foreign companies handling Indian personal data apply from 13 May 2027.

*Written by CA Nandini Hasija, Krystal7 Consultants. Last updated 23 October 2026.*

## AI Overview Summary

- The DPDP Rules 2025 were notified as G.S.R. 846(E) on 13 Nov 2025. Most duties of a Data Fiduciary apply from 13 May 2027, and consent manager rules from 13 Nov 2026.
- Section 3(b) of the DPDP Act, 2023 reaches a foreign company processing data outside India when the processing relates to offering goods or services to people in India.
- An Indian subsidiary processing customer or employee data in India is fully covered. Processing foreign residents' data under a contract with a foreign party is largely exempt under section 17(1)(d).
- Under rule 7, a fiduciary must tell each affected person about a personal data breach without delay, and give the Data Protection Board a detailed report within 72 hours.
- Penalties run up to INR 250 crore for weak security safeguards and INR 200 crore for failing to report a breach, under the Schedule to the Act.

**The DPDP Rules 2025 were notified as G.S.R. 846(E) on 13 Nov 2025 under the Digital Personal Data Protection Act, 2023. The Data Protection Board was established that day. Consent manager rules apply from 13 Nov 2026. Notice, consent, security, breach reporting, rights and transfer rules apply from 13 May 2027. A foreign company is covered when it processes data in India, or offers goods or services to people in India.**

This page covers who the Act reaches, the phased dates, notice and consent, and fiduciary duties. It also covers significant data fiduciaries, transfers abroad, breach reporting, the Board and penalties. It ends with a worked breach timeline and a readiness checklist for an Indian subsidiary.

## When do the DPDP Rules 2025 apply to a foreign company?

The core duties apply from 13 May 2027, eighteen months after the Rules were published on 13 Nov 2025. That date covers notice, consent, security, breach reporting, erasure, rights and transfers. Rules on consent managers start on 13 Nov 2026. The Board and its procedure rules have applied since 13 Nov 2025.

The Ministry of Electronics and Information Technology (MeitY) published three notifications on 13 Nov 2025:

- **G.S.R. 843(E)** appointed the dates on which each section of the [DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) takes effect.
- **G.S.R. 844(E)** established the Data Protection Board of India, with its head office in the National Capital Region.
- **G.S.R. 846(E)** notified the [Digital Personal Data Protection Rules, 2025](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf).

The [PIB release of 14 Nov 2025](https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2190014) announced the Rules the next day, so some summaries give 14 Nov. The gazette date is 13 Nov 2025. A corrigendum, G.S.R. 892(E) of 10 Dec 2025, fixed drafting errors in the Rules without changing any date.

Parliament passed the Act as Act 22 of 2023, and it received assent on 11 Aug 2023. MeitY published the draft Rules for comment as G.S.R. 02(E) on 3 Jan 2025, with comments due by 18 Feb 2025.

## What is the phased commencement timeline?

G.S.R. 843(E) and rule 1 of the Rules split commencement into three phases. The Board and its procedure took effect on 13 Nov 2025. Consent manager registration follows on 13 Nov 2026. Everything that changes how a business handles data follows on 13 May 2027.

| Phase | Date | Sections of the Act in force | Rules in force |
|---|---|---|---|
| On publication | 13 Nov 2025 | 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) | Rules 1, 2 and 17 to 21 |
| One year after publication | 13 Nov 2026 | 6(9) and 27(1)(d) | Rule 4 |
| Eighteen months after publication | 13 May 2027 | 3 to 5; 6(1) to 6(8) and 6(10); 7 to 17; 27 except 27(1)(d); 28 to 34; 36 and 37; 44(2) | Rules 3, 5 to 16, 22 and 23 |

Three effects of this split catch foreign groups out:

- **Section 3 itself starts on 13 May 2027.** The territorial reach of the Act applies from that date, along with the duties.
- **The IT Act rules continue until then.** Section 44(2) omits section 43A of the Information Technology Act, 2000 only from 13 May 2027. Until that date, the 2011 rules on sensitive personal data under section 43A still bind a body corporate in India.
- **Penalties wait for the duties.** Section 33 and the Schedule start on 13 May 2027, so the Board cannot penalise a breach of a duty that is not yet in force.

We found no gazette notification changing these dates on the MeitY and eGazette listings by 23 Oct 2026. MeitY discussed a shorter window in 2026, so check the Gazette before you fix your programme dates. The section "What has happened since" below covers those reports.

## Does the DPDP Act apply to a company outside India?

Yes, in one case. Section 3(b) applies the Act to processing outside India if it relates to offering goods or services to Data Principals in India. A US software company selling subscriptions to Indian users is covered. A foreign company with no Indian customers, users or staff is not.

A foreign SaaS seller also faces GST on its Indian sales, as our guide to [OIDAR services](/insights/oidar-gst-foreign-saas-digital-services-india) explains. The two regimes reach the same business from different angles.

Section 3(a) covers all processing within India of personal data collected digitally, or collected on paper and digitised later. Section 3(c) excludes processing by an individual for personal or domestic purposes, and data the person or a legal duty has made public.

| Situation | Is the Act engaged? | Main provision | Practical note |
|---|---|---|---|
| Foreign SaaS company sells to Indian businesses and users, with no Indian entity | Yes, for Indian users' data | Section 3(b) | Notice, consent, security and a contact person for Indian users |
| Indian subsidiary processes its own employees' data | Yes | Section 3(a); section 7(i) | Employment is a legitimate use, so consent is not needed for employment purposes |
| Indian subsidiary sends staff data to the parent's global HR system | Yes | Sections 3(a), 8 and 16 | The subsidiary stays the fiduciary for that data and must secure the transfer |
| Indian capability centre processes data of foreign residents for the parent under a contract | Mostly exempt | Section 17(1)(d) | Sections 8(1) and 8(5) still apply, so security safeguards remain |
| Indian subsidiary processes Indian customers' data as the parent's vendor | Yes, as a processor | Sections 8(1) and 8(2) | The fiduciary needs a contract with the processor |
| Foreign company only buys from Indian suppliers | Only for Indian contact persons' data, if processed in India | Section 3 | Usually limited to business contact data |

The capability centre exemption deserves care. Section 17(1) switches off most of Chapter II, all of Chapter III and section 16 for this processing. It keeps section 8(1) on responsibility and section 8(5) on security safeguards. A centre that loses foreign customer data can still face the INR 250 crore penalty for weak safeguards. Our guide to [setting up a global capability centre](/insights/global-capability-centre-gcc-india-setup) covers the rest of the structure.

## Who is a data fiduciary and who is a data processor?

A Data Fiduciary decides why and how personal data is processed, alone or with others (section 2(i)). A Data Processor processes data on its behalf (section 2(k)). The fiduciary carries the duties and stays responsible for its processors under section 8(1). A processor may act only under a valid contract (section 8(2)).

In a foreign group, the roles often split across entities:

- **The Indian subsidiary as fiduciary.** It decides on its own employees' data, its Indian customers' data and its vendor contacts.
- **The parent as fiduciary.** It decides on data it collects from Indian users through a global website or app, under section 3(b).
- **Joint fiduciaries.** Where the parent and the subsidiary decide purposes together, for example a group CRM, both can be fiduciaries.
- **Group service providers as processors.** A shared service company that hosts or runs payroll for the subsidiary acts as a processor and needs a written contract.

The Act has no separate rule for intra group transfers. We draft a group data processing agreement that names the fiduciary for each data set and binds each processor to rule 6 safeguards. Our [legal advisory team](/services/legal-advisory.html) drafts these agreements.

## What must a consent notice contain?

Section 5 requires a notice with every consent request, or before it. Rule 3 requires the notice to stand alone and be clear. It must list the personal data and the specific purpose. It must link to the website or app where the person can withdraw consent, exercise rights and complain to the Board.

The Act gives two lawful grounds under section 4: consent, or a legitimate use under section 7. Consent under section 6 must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Withdrawal must be as easy as giving consent (section 6(4)).

Section 7 lists the legitimate uses. Two matter most for a subsidiary:

- **Section 7(a).** Data the person gives voluntarily for a specified purpose, without objecting to its use.
- **Section 7(i).** Employment purposes, and protecting the employer from loss or liability, such as preventing corporate espionage or protecting trade secrets.

So an Indian employer does not need consent to run payroll or appraisals. It still needs security, accuracy, erasure and grievance processes for that data from 13 May 2027.

Consent managers start earlier. Rule 4 and section 6(9) apply from 13 Nov 2026. A consent manager must be an Indian company registered with the Board. Part A of the First Schedule requires a net worth of at least INR 2 crore.

## What duties does a data fiduciary have?

Section 8 sets the core duties from 13 May 2027. The fiduciary must keep data accurate, take reasonable security safeguards and report breaches. It must erase data once the purpose ends, publish a contact person and run a grievance process. The Rules give each duty its detail.

| Duty | Provision | What the Rules add | Applies from |
|---|---|---|---|
| Responsibility for processors | Section 8(1), 8(2) | Contract with each processor | 13 May 2027 |
| Reasonable security safeguards | Section 8(5) | Rule 6: encryption or masking, access control, logs and monitoring, backups; keep logs for one year | 13 May 2027 |
| Breach intimation | Section 8(6) | Rule 7: each affected person without delay; Board report within 72 hours | 13 May 2027 |
| Erasure when the purpose ends | Section 8(7) | Rule 8: three year periods and 48 hours' notice for listed platforms | 13 May 2027 |
| Retention for state purposes | Rule 8(3); Seventh Schedule | Personal data, traffic data and logs kept for at least one year | 13 May 2027 |
| Contact person or Data Protection Officer | Section 8(9) | Rule 9: publish business contact details prominently | 13 May 2027 |
| Grievance redress | Section 8(10), section 13 | Rule 14: publish the process and resolve within 90 days | 13 May 2027 |
| Rights of access, correction, erasure, nomination | Sections 11 to 14 | Rule 14: means of request on the website or app | 13 May 2027 |

Rule 6 lists the safeguards in plain terms. They include encryption, obfuscation, masking or virtual tokens, access controls, logs that make access visible, monitoring and backups. The fiduciary keeps the logs and the related personal data for one year to detect and remedy breaches, unless another law needs longer.

Rule 8 sets erasure periods only for large platforms in the Third Schedule. These are ecommerce entities and social media intermediaries with at least 2 crore registered users in India. Online gaming intermediaries qualify at 50 lakh users. Data is erased three years after the person last engaged, after 48 hours' notice. Other fiduciaries erase when the purpose is served, under section 8(7).

## How must a personal data breach be reported?

Rule 7 requires two intimations. The fiduciary tells each affected Data Principal without delay, in plain language. It also tells the Board without delay. A detailed report follows within 72 hours of becoming aware, or a longer period the Board allows. Both duties start on 13 May 2027.

| Intimation | To whom | Deadline | Contents | Provision |
|---|---|---|---|---|
| First notice to each affected person | Every affected Data Principal | Without delay | What happened, likely consequences, steps taken, steps the person can take, contact details | Rule 7(1); section 8(6) |
| First notice to the Board | Data Protection Board | Without delay | Description of the breach, its nature, extent, timing, location and likely impact | Rule 7(2) |
| Detailed report to the Board | Data Protection Board | Within 72 hours, or a longer period the Board allows | Facts and causes, mitigation, findings on who caused it, remedial steps, and the notices given to people | Rule 7(2) |
| Cyber incident report | Indian Computer Emergency Response Team (CERT-In) | Within six hours of noticing a reportable incident | Incident details in the agency's format | CERT-In directions No. 20(3)/2022-CERT-In of 28 Apr 2022 under section 70B of the IT Act |

The CERT-In clock is much shorter and runs under the Information Technology Act, 2000. The two regimes run side by side, so one incident can trigger both reports. We keep one incident log and file each report from it.

Our reading is that the 72 hour clock runs from the moment the fiduciary becomes aware of the breach. A processor's delay in telling the fiduciary does not stop the clock, so processor contracts should require notice within hours.

## What is a significant data fiduciary?

A significant data fiduciary is a fiduciary, or a class of them, that the Central Government notifies under section 10. The factors include the volume and sensitivity of data, risk to people, and effects on sovereignty, security and public order. It must appoint an India based Data Protection Officer and an independent data auditor, and run impact assessments and audits.

Section 10(2) and rule 13 set the extra duties:

- **Data Protection Officer.** Based in India and answerable to the board of directors or similar governing body (section 10(2)(a)).
- **Independent data auditor.** Appointed to evaluate compliance (section 10(2)(b)).
- **Impact assessment and audit.** A Data Protection Impact Assessment and an audit once every twelve months, with a report of significant observations to the Board (rule 13).
- **Algorithmic due diligence.** Checks that algorithmic software used for processing does not risk the rights of Data Principals (rule 13).
- **Localisation for specified data.** Personal data the Centre specifies on a committee's advice must not leave India, with its traffic data (rule 13).

We found no notification naming any significant data fiduciary by 23 Oct 2026. Large platforms, health and financial data processors and companies handling children's data at scale should plan as if they may be named. A breach of section 10 duties carries up to INR 150 crore under the Schedule.

## Can personal data be transferred outside India?

Yes, unless the Central Government restricts transfers to a notified country or territory under section 16(1). The Act uses a restricted list, not an approved list. Rule 15 lets the Centre set requirements, by general or special order, on making transferred data available to a foreign State or its agencies. Sector laws with stricter rules prevail under section 16(2).

What this means for a group sending Indian data to a parent or a cloud region abroad:

- **No list yet.** We found no notification under section 16(1) restricting any country by 23 Oct 2026.
- **No transfer contract template.** The Act and Rules do not prescribe standard clauses. The fiduciary still owes security under section 8(5) wherever the data sits.
- **Sector rules first.** Section 16(2) keeps any Indian law with a higher degree of protection, such as RBI's directions on storing payment system data in India.
- **Significant data fiduciaries.** Rule 13 can require specified data to stay in India.

From 13 May 2027, we record each outbound data flow with the country, the recipient, the purpose and the safeguards. That register answers the Board's questions and any future section 16 notification.

If you plan to keep data in India instead, our guide to the [data centre India tax holiday](/insights/data-centre-india-incentives-tax-holiday) covers the incentives, rules and approvals.

## What are the rules for children's data?

Section 9 requires verifiable consent from a parent or lawful guardian before processing data of a child under 18. It bans processing likely to harm a child's well being, and tracking, behavioural monitoring or targeted advertising aimed at children. Rule 10 sets the verification methods, and rule 12 lists exemptions.

Rule 10 requires the fiduciary to check that the person consenting is an identifiable adult. It can rely on identity details it already holds or a virtual token from a trusted source such as DigiLocker. Rule 12 and the Fourth Schedule exempt listed classes and purposes, such as healthcare, education and real time safety, from parts of section 9.

For an edtech, gaming or consumer app with Indian users, this is the costliest change. A breach of section 9 carries up to INR 200 crore under the Schedule.

## What is the Data Protection Board and how are penalties set?

The Data Protection Board of India, established on 13 Nov 2025 under section 18, inquires into breaches, directs remedies and imposes penalties. It works as a digital office. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days under section 29. Penalties run up to INR 250 crore for each breach listed in the Schedule.

| Schedule item | Breach | Maximum penalty |
|---|---|---|
| 1 | Failure to take reasonable security safeguards (section 8(5)) | INR 250 crore |
| 2 | Failure to notify the Board or affected people of a breach (section 8(6)) | INR 200 crore |
| 3 | Breach of the duties for children (section 9) | INR 200 crore |
| 4 | Breach of the extra duties of a significant data fiduciary (section 10) | INR 150 crore |
| 5 | Breach of a Data Principal's duties (section 15) | INR 10,000 |
| 6 | Breach of a voluntary undertaking accepted by the Board (section 32) | Up to the penalty for the original breach |
| 7 | Any other breach of the Act or Rules | INR 50 crore |

Section 33(2) makes the Board weigh the nature, gravity and duration of the breach and the type of data. It also weighs repetition, any gain made or loss avoided, mitigation and proportionality. A person must exhaust the fiduciary's grievance process before complaining to the Board, under section 13(3).

The Board's members were not in place when MeitY invited applications on 6 May 2026. Its [circular F. No. 2(1)/2026-Pers.I](https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf) sought one Chairperson and four Members, including at least one legal expert. We found no official notice appointing the Chairperson or Members by 23 Oct 2026. Check the MeitY website and the Gazette for the Board's constitution.

## What should an Indian subsidiary of a foreign group do before 13 May 2027?

Map the data, name the fiduciary for each data set, and fix the contracts with group processors. Then rewrite notices, build the rights and grievance process, set up breach reporting to both the Board and CERT-In, and record outbound transfers. Most of this work takes months, so start in 2026.

A software subsidiary holds customer, employee and vendor data from day one, as our guide to [software company registration in India](/insights/software-company-registration-in-india) shows. We sequence the programme in this order:

- **Now.** Data inventory by system, with the Indian data, the purpose and the legal ground for each.
- **By 13 Nov 2026.** Decide whether you will use a registered consent manager for consumer products.
- **First quarter of 2027.** Group processing agreements, new notices, the contact person page, the grievance desk and the incident response plan.
- **By 13 May 2027.** Go live with notices, rights handling within 90 days, rule 6 safeguards, log retention and the transfer register.

Employee data needs its own track. Section 7(i) covers employment purposes, but staff still get rights of access, correction and grievance. Exit files and committee records under the [POSH Act](/insights/posh-compliance-foreign-owned-company-india) hold sensitive data, so set access controls and retention periods for them. Our note on [termination and final dues](/insights/termination-retrenchment-industrial-relations-code) covers the exit process those files support.

## What changed in 2026

The Act had been on the statute book since 2023. The dates and machinery arrived with the November 2025 notifications. The table lists each step.

| Date | Old position | New position | Instrument |
|---|---|---|---|
| 11 Aug 2023 | No general data protection law; section 43A of the IT Act and 2011 rules | DPDP Act, 2023 enacted, not yet in force | Act 22 of 2023 |
| 3 Jan 2025 | No rules | Draft DPDP Rules published; comments to 18 Feb 2025 | G.S.R. 02(E) |
| 13 Nov 2025 | Act not in force | Board provisions in force; Board established in the National Capital Region | G.S.R. 843(E); G.S.R. 844(E) |
| 13 Nov 2025 | Draft rules | Final DPDP Rules 2025 with phased commencement | G.S.R. 846(E) |
| 10 Dec 2025 | Drafting errors in the Rules | Corrections, no change of dates | G.S.R. 892(E) |
| 6 May 2026 | Board without members | Applications invited for a Chairperson and four Members | MeitY circular F. No. 2(1)/2026-Pers.I |
| 13 Nov 2026 | No consent manager regime | Consent manager registration with the Board | Section 6(9); rule 4 |
| 13 May 2027 | Section 43A of the IT Act and the 2011 rules | Full DPDP duties, penalties and transfer rules; section 43A omitted | Section 44(2); rules 3, 5 to 16, 22 and 23 |

## What has happened since

This guide was first published on 3 Jan 2026. Since then, MeitY invited applications for the Board's Chairperson and Members on 6 May 2026. Practitioner reports in February 2026 said MeitY put a proposal to industry on 23 Jan 2026. It would shorten the eighteen month window to twelve months for some duties, with comments due by 4 Feb 2026. We found no gazette notification that changes the dates by 23 Oct 2026, so the table above still shows the law. We treat the proposal as unconfirmed until it appears in the Gazette.

## Worked example

**Scenario 1. A breach at a US company's Indian subsidiary.** A US software company sells subscriptions to Indian businesses and runs customer support from a Pune subsidiary. On Tuesday 8 Jun 2027 at 11:00 IST, the subsidiary's security team finds that a misconfigured storage bucket exposed support tickets. The tickets hold names, phone numbers and emails of Indian customers' staff.

The subsidiary is the fiduciary for its own support data, and the parent is the fiduciary for its platform data. Both run the same incident log. The clocks run as follows:

| Step | Deadline | Working |
|---|---|---|
| Report to CERT-In | Tuesday 8 Jun 2027, 17:00 IST | Six hours from 11:00 |
| First notice to the Board | Without delay, so on 8 Jun 2027 | Rule 7(2) |
| Notice to each affected person | Without delay, in plain language | Rule 7(1) |
| Detailed report to the Board | Friday 11 Jun 2027, 11:00 IST | 72 hours from 11:00 on 8 Jun |
| Logs kept for review | At least until 8 Jun 2028 | One year under rule 6 |

Suppose a customer's employee then asks on Thursday 1 Jul 2027 for a summary of the data held about her. Rule 14 caps the grievance process at 90 days, and we apply the same limit to rights requests, so the outer date is Wednesday 29 Sep 2027. We aim for 30 days.

The exposure is two Schedule items. Weak safeguards (item 1) carry up to INR 250 crore, and a late breach notice (item 2) up to INR 200 crore. The Board fixes any amount under section 33(2), so a quick notice and full mitigation reduce the risk.

**Scenario 2. Erasure on a large platform.** A foreign ecommerce marketplace has 2.4 crore registered users in India, so the Third Schedule applies. A user last bought on 15 Jan 2026 and never returned. Rule 8 counts three years from the later of the last engagement and the commencement of the Rules.

The Rules were published on 13 Nov 2025, but rule 8 itself starts on 13 May 2027. If "commencement" means publication, the later date is the user's last purchase, so erasure falls on 15 Jan 2029. If it means the start of rule 8, the later date is 13 May 2027, so erasure falls on 13 May 2030.

| Reading of "commencement" | Start of the three years | Erasure date | Notice by |
|---|---|---|---|
| Publication of the Rules | 15 Jan 2026 (later than 13 Nov 2025) | 15 Jan 2029 | 13 Jan 2029 |
| Commencement of rule 8 | 13 May 2027 (later than 15 Jan 2026) | 13 May 2030 | 11 May 2030 |

We plan for the earlier date, 15 Jan 2029, and send the 48 hour notice by 13 Jan 2029. Rule 8(3) still requires the platform to keep the related logs and traffic data for at least one year from processing.

## Common mistakes

1. **Treating 13 Nov 2025 as the go live date.** Only the Board provisions started then. Fix: plan the programme to 13 May 2027 and the consent manager decision to 13 Nov 2026.
2. **Dropping the IT Act rules early.** Section 43A of the IT Act stays until 13 May 2027. Fix: keep the 2011 sensitive data policies in force until then.
3. **Asking employees for consent to everything.** Section 7(i) covers employment purposes. Fix: use the legitimate use ground for HR processing and give a clear notice.
4. **Assuming the capability centre exemption covers security.** Sections 8(1) and 8(5) still apply under section 17(1)(d). Fix: apply rule 6 safeguards to foreign customer data too.
5. **Running one breach clock.** CERT-In needs six hours, and the Board needs a report within 72 hours. Fix: one incident log with both deadlines.
6. **No contract with group processors.** Section 8(2) needs a valid contract. Fix: sign a group data processing agreement naming the fiduciary for each data set.
7. **No register of transfers.** Section 16 can restrict a country at any time. Fix: keep a register of outbound flows by country and recipient.
8. **Ignoring sector rules.** Section 16(2) keeps stricter laws in force. Fix: check RBI, SEBI and IRDAI rules that bind your business before moving data abroad.

## Checklist

1. List every system that holds personal data of people in India, with the purpose and legal ground for each.
2. Name the Data Fiduciary and each Data Processor for every data set, across group entities.
3. Sign group data processing agreements that bind processors to rule 6 safeguards and quick breach notice.
4. Decide by 13 Nov 2026 whether consumer products will use a registered consent manager.
5. Rewrite consent notices to meet section 5 and rule 3, with links to withdraw consent and to complain.
6. Publish the contact person or Data Protection Officer details under rule 9.
7. Build a request and grievance desk that resolves grievances and rights requests within 90 days, the limit in rule 14.
8. Apply rule 6 safeguards and keep logs and related data for one year.
9. Write an incident plan with the six hour CERT-In report and the 72 hour Board report.
10. Set erasure rules for each data set, and the rule 8 schedule if you are a listed platform.
11. Record every outbound transfer with country, recipient, purpose and safeguards.
12. Check whether section 9 applies to any product used by children, and build verifiable consent.
13. Train HR, support and engineering teams before 13 May 2027.

Our [regulatory compliance advisory team](/services/legal-advisory.html) can run the data inventory and readiness review for your Indian subsidiary.

## Key terms

- **Data Fiduciary**: A person who, alone or with others, decides the purpose and means of processing personal data, under section 2(i) of the Digital Personal Data Protection Act, 2023. The fiduciary carries the duties in section 8, including for processing done by its data processors. (https://krystal7.com/glossary#data-fiduciary)
- **Data Processor**: Any person who processes personal data on behalf of a Data Fiduciary, under section 2(k) of the Digital Personal Data Protection Act, 2023. A fiduciary may engage a processor only under a valid contract, and stays responsible for the processor's work. (https://krystal7.com/glossary#data-processor)
- **Data Principal**: The individual to whom personal data relates, under section 2(j) of the Digital Personal Data Protection Act, 2023. For a child, it includes the parent or lawful guardian. Data Principals hold the rights to access, correction, erasure, grievance redress and nomination. (https://krystal7.com/glossary#data-principal)
- **Significant Data Fiduciary (SDF)**: A Data Fiduciary or class the Central Government notifies under section 10 of the Digital Personal Data Protection Act, 2023, based on data volume, sensitivity and risk. It must appoint a Data Protection Officer based in India, an independent data auditor, and run yearly impact assessments and audits. (https://krystal7.com/glossary#significant-data-fiduciary)
- **Consent Manager**: An India based company registered with the Data Protection Board under section 6(9) of the Digital Personal Data Protection Act, 2023 and rule 4 of the DPDP Rules 2025. It runs a platform through which people give, manage, review and withdraw consent. (https://krystal7.com/glossary#consent-manager)
- **Data Protection Board of India (DPBI)**: The adjudicating body established under section 18 of the Digital Personal Data Protection Act, 2023, with its head office in the National Capital Region. It inquires into breaches, directs remedies and imposes penalties. Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal. (https://krystal7.com/glossary#data-protection-board-of-india)
- **Personal data breach**: Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability, under section 2(u) of the Digital Personal Data Protection Act, 2023. (https://krystal7.com/glossary#personal-data-breach)

## Frequently Asked Questions

### When do the DPDP Rules 2025 come into force?

In three phases from G.S.R. 846(E) of 13 Nov 2025. Rules 1, 2 and 17 to 21 on the Board applied on publication. Rule 4 on consent managers applies from 13 Nov 2026. Rules 3, 5 to 16, 22 and 23, which hold the main business duties, apply from 13 May 2027.

### Does the DPDP Act apply to a foreign company with no Indian entity?

Yes, if it offers goods or services to people in India. Section 3(b) of the Digital Personal Data Protection Act, 2023 covers processing outside India in connection with that activity. A foreign SaaS company with Indian users must meet the notice, consent, security and breach duties for their data from 13 May 2027.

### Is an Indian subsidiary of a foreign company covered by the DPDP Act?

Yes. Section 3(a) covers all digital processing within India. The subsidiary is a Data Fiduciary for its employees' and Indian customers' data. Processing of foreign residents' data under a contract with a foreign party is largely exempt under section 17(1)(d). Security duties under section 8(5) still apply.

### Do employers need consent to process employee data under the DPDP Act?

No, for employment purposes. Section 7(i) treats processing for employment, and for protecting the employer from loss or liability, as a legitimate use. The employer still owes security, accuracy, erasure and grievance duties under section 8, and employees keep their rights of access and correction.

### What is the breach notification deadline under the DPDP Rules?

Rule 7 requires notice to each affected person without delay, and to the Data Protection Board without delay. A detailed report must reach the Board within 72 hours of becoming aware, or a longer period the Board allows. CERT-In's separate six hour reporting duty under the IT Act also applies.

### Can personal data be transferred outside India under the DPDP Act?

Yes, unless the Central Government restricts transfers to a notified country under section 16(1). Rule 15 lets the Centre set requirements about access by foreign States. Stricter sector laws continue under section 16(2). We found no restricted country notified by 23 Oct 2026.

### What is a Significant Data Fiduciary?

A Data Fiduciary or class notified by the Central Government under section 10 of the DPDP Act, based on data volume, sensitivity and risk. It must appoint a Data Protection Officer based in India and an independent data auditor. Rule 13 requires an impact assessment and audit every twelve months.

### Does a foreign company need a Data Protection Officer in India?

Only if it is notified as a Significant Data Fiduciary, under section 10(2)(a). Every other fiduciary must publish the business contact details of a Data Protection Officer or another person who answers processing questions. Section 8(9) and rule 9 of the DPDP Rules 2025 set this duty.

### What are the penalties under the DPDP Act?

The Schedule sets maximums of INR 250 crore for weak security safeguards and INR 200 crore each for missed breach notices and children's duties. It sets INR 150 crore for significant data fiduciary duties and INR 50 crore for other breaches. The Board fixes the amount under section 33(2).

### How long does a company have to answer a data access request?

Rule 14 of the DPDP Rules 2025 requires fiduciaries and consent managers to publish a grievance process that resolves grievances within 90 days at most. The PIB backgrounder of 17 Nov 2025 applies the same limit to access, correction and erasure requests. The duty applies from 13 May 2027. A person must use the fiduciary's grievance process before complaining to the Board, under section 13(3).

### What is a Consent Manager under the DPDP Rules?

An India based company registered with the Data Protection Board that lets people give, manage, review and withdraw consent. Section 6(9) and rule 4 apply from 13 Nov 2026. Part A of the First Schedule requires a net worth of at least INR 2 crore, among other conditions.

### Does the IT Act's section 43A still apply?

Yes, until 13 May 2027. Section 44(2) of the DPDP Act omits section 43A of the Information Technology Act, 2000 from that date, under G.S.R. 843(E). Until then, the 2011 rules on sensitive personal data still bind a body corporate handling such data in India.

### How do you appeal a Data Protection Board order?

File an appeal with the Telecom Disputes Settlement and Appellate Tribunal within 60 days of receiving the order, under section 29 of the DPDP Act. Rule 22 of the DPDP Rules 2025 requires the appeal to be filed digitally, with fees on the pattern of the TRAI Act.

### What should a company do about children's data under the DPDP Act?

Get verifiable consent from a parent or lawful guardian before processing data of anyone under 18, under section 9 and rule 10. Stop tracking, behavioural monitoring and targeted advertising aimed at children. Check the Fourth Schedule exemptions under rule 12 for healthcare, education and safety purposes.

## Sources

- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
- Gazette of India, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 Nov 2025, https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
- Gazette of India, notification appointing dates for the DPDP Act, 2023, G.S.R. 843(E), 13 Nov 2025, https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf
- Gazette of India, establishment of the Data Protection Board of India, G.S.R. 844(E), 13 Nov 2025, https://www.meity.gov.in/static/uploads/2025/11/cc217843dc3bcb37b2b05bcc3b4e031f.pdf
- Gazette of India, corrigendum to G.S.R. 846(E), G.S.R. 892(E), 10 Dec 2025, https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf
- Gazette of India, draft Digital Personal Data Protection Rules, 2025, G.S.R. 02(E), 3 Jan 2025, https://www.meity.gov.in/static/uploads/2025/02/f8a8e97a91091543fe19139cac7514a1.pdf
- Ministry of Electronics and Information Technology, Appointment to the post of Chairperson and Other Members in the Data Protection Board of India, F. No. 2(1)/2026-Pers.I, 6 May 2026, https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf
- Press Information Bureau, Government notifies DPDP Rules to empower citizens and protect privacy, 14 Nov 2025, https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2190014
- Press Information Bureau, DPDP Rules, 2025 Notified (backgrounder), 17 Nov 2025, https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
- Indian Computer Emergency Response Team, Directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents under section 70B(6) of the IT Act, No. 20(3)/2022-CERT-In, 28 Apr 2022, https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf

---
Krystal7 Consultants, business@krystal7.com, +91 94657 30130. HTML version: https://krystal7.com/insights/dpdp-rules-2025-compliance-foreign-companies