The short version: India's DPDP Rules 2025 phase in from 13 November 2025. Consent Manager rules start 13 November 2026, and the core duties on businesses apply from 13 May 2027. Apps and chatbots need itemised notices, provable consent records, one-tap withdrawal, a rights inbox, retention jobs and a 72-hour breach runbook.
Last updated: 21 October 2026.
This guide is not legal advice; ask your counsel to interpret the Act and Rules for your business.
This is the engineering view of what changes in an app, website, chatbot or backend handling personal data of people in India. Legal points link to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, both published by MeitY.
When do the DPDP Rules 2025 take effect?
The Rules were published in the Gazette as G.S.R. 846(E), dated 13 November 2025. Rule 1 sets three start dates (DPDP Rules, rule 1):
- On publication (13 November 2025): rules 1, 2 and 17 to 21, which cover definitions and the Data Protection Board.
- One year after publication (13 November 2026): rule 4, registration and obligations of Consent Managers.
- Eighteen months after publication (13 May 2027): rules 3, 5 to 16, 22 and 23. These carry the duties most businesses care about: notices, security safeguards, breach intimation, retention and erasure, contact details, children's data, Significant Data Fiduciary duties, user rights and cross-border transfers.
The calendar dates are our arithmetic from rule 1. PIB described an 18-month phased compliance timeline, repeated in a 5 August 2026 release, and MeitY has established the Data Protection Board of India.
Who does the DPDP Act apply to?
It applies to digital personal data processed in India, and to processing outside India when it is connected to offering goods or services to people in India (Act, section 3). Personal data is "any data about an individual who is identifiable by or in relation to such data" (section 2(t)).
Three roles matter for engineering teams:
- Data Fiduciary: the business that decides why and how data is processed. If you run the app, you are this.
- Data Processor: anyone processing on your behalf. Your cloud host, email provider, analytics tool and LLM API vendor usually sit here.
- Data Principal: the person the data is about. For a child (under 18, section 2(f)), it includes the parent.
Section 8(1) makes the Data Fiduciary responsible for its processors' processing, whatever the contract says.
What must a consent notice and consent record contain?
Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the data needed for the stated purpose (Act, section 6(1)). Rule 3 says the notice must stand on its own, in clear and plain language, and include at minimum (DPDP Rules, rule 3):
- an itemised description of the personal data;
- the specified purpose and the goods, services or uses it enables;
- a link and means to withdraw consent, exercise rights and complain to the Board.
The notice and the consent request must be available in English or any language in the Eighth Schedule to the Constitution (sections 5(3) and 6(3)). What to build:
- Purpose-scoped consent, not one checkbox. Store one row per person, per purpose, with the notice version shown, timestamp, channel and language.
- Unticked controls. A clear affirmative action rules out pre-ticked boxes.
- Versioned notices. Keep every published notice text so you can show what a person actually saw.
Section 6(10) puts the burden of proof on you: if consent is disputed, the Data Fiduciary must prove notice was given and consent obtained. An append-only consent ledger is the simplest way to do that. Users who consented before the Act commenced also need a notice "as soon as it is reasonably practicable" (section 5(2)), so plan an email or in-app notice campaign for your existing base.
How easy must it be to withdraw consent?
As easy as giving it. Section 6(4) gives the right to withdraw at any time "with the ease of doing so being comparable to the ease with which such consent was given", and rule 3(c)(i) repeats this for the notice. If consent took one tap in the app, withdrawal cannot require an email to support.
After withdrawal you must stop processing within a reasonable time and make your processors stop too (section 6(6)), then erase the data unless a law requires you to keep it (section 8(7)). In practice: a withdrawal event your backend sends to every system holding the data, from CRM to chatbot logs.
How do data principal rights requests work?
People can request a summary of their data and processing, the identities of other fiduciaries and processors it was shared with, correction, completion, updating and erasure, grievance redressal and nomination of another person (sections 11 to 14). Rule 14 requires you to publish how to make a request and what identifier you need, and to publish a grievance response period of no more than 90 days (DPDP Rules, rule 14). Rule 9 requires the contact of your Data Protection Officer, or a person who can answer processing questions, on your website or app and in every rights response.
What to build: a "Your data" screen, a request queue with deadlines, identity checks against an existing identifier, and an export job covering every store, including vendor systems.
How long can you keep personal data?
Only as long as the purpose needs, then erase it, unless a law requires retention (section 8(7)). For large e-commerce entities, online gaming intermediaries and social media intermediaries, the Third Schedule deems the purpose over after three years without contact, and rule 8(2) requires a warning at least 48 hours before erasure.
There is a floor as well as a ceiling. Rule 8(3) requires keeping personal data, associated traffic data and processing logs for at least one year from the date of processing for the purposes in the Seventh Schedule, then erasing them unless another law requires longer. Rule 6(1)(e) also asks for logs to be kept for a year for breach detection and investigation.
What to build: a retention policy per data category, scheduled deletion jobs, and a separate, access-controlled log store kept for at least a year, so deleting a user's profile does not delete the audit trail you are required to keep.
What security safeguards do the Rules require?
Rule 6 lists the minimum (DPDP Rules, rule 6): encryption, obfuscation, masking or tokenisation; access control on computer resources; logging, monitoring and review to detect unauthorised access; backups for continued processing; security clauses in processor contracts; and technical and organisational measures to make all of this work. Failing to take reasonable security safeguards carries the highest penalty in the Act, up to ₹250 crore (Act, Schedule).
What is the breach notification process?
Rule 7 has two audiences (DPDP Rules, rule 7):
- Each affected person, without delay, through their account or registered contact: what happened, likely consequences, what you are doing, what they can do, and a contact.
- The Data Protection Board, without delay, with a description of the breach, then within 72 hours a detailed report covering causes, mitigation, findings about who caused it, remedial steps and the notices sent to users. The Board can allow longer on a written request.
Not notifying the Board or affected people can cost up to ₹200 crore. Build the runbook now: an owner, notice templates, a query listing affected users, and bulk messaging.
What changes for children's data?
A child is anyone under 18. Before processing a child's data you need verifiable consent of a parent (section 9(1)), and you may not track, behaviourally monitor or target advertising at children (section 9(3)). Rule 10 says how to verify the parent is an identifiable adult: using reliable identity and age details you already hold, or details provided voluntarily, including through a virtual token from an authorised entity such as a DigiLocker service provider (DPDP Rules, rule 10). The Fourth Schedule exempts some cases, such as healthcare providers and educational institutions, within set conditions.
What to build: an age question at sign-up, a parent verification flow, and a flag that switches off behavioural analytics, ad SDKs and personalisation for child accounts.
What should contracts with processors and vendors cover?
You may use a Data Processor only under a valid contract (section 8(2)), and rule 6(1)(f) expects that contract to include security safeguards. Add breach reporting, deletion on instruction (section 8(7)(b)), rule 8(3) log retention and help with rights requests. Keep a vendor register, because section 11(1)(b) lets a person ask who you shared their data with.
Can personal data leave India?
Yes, by default. Section 16 lets the Government restrict transfers to countries it notifies, rule 15 adds conditions on making data available to foreign States, and stricter sector laws still apply. Significant Data Fiduciaries may also be told to keep specified data in India (rule 13(4)). Make hosting region a configuration setting, not a rewrite.
What extra duties do Significant Data Fiduciaries have?
The Government can notify a business as a Significant Data Fiduciary based on data volume, sensitivity and risk (section 10). It needs a Data Protection Officer based in India and an independent data auditor, and under rule 13 an annual Data Protection Impact Assessment and audit, with findings reported to the Board, plus checks that its algorithmic software does not put users' rights at risk.
What is different for AI chatbots?
Chatbots collect personal data in free text. What we design for:
- Transcripts are personal data. Once a conversation links to a phone number, email, account or order, it is data about an identifiable person.
- Ask before you collect. If the bot asks for a phone number or email, show a short notice in the chat first: what is collected, why, and a link to withdraw. Section 7(a) allows processing data a person volunteers for a specified purpose, but a bot that prompts for contact details for marketing follow-up should get explicit, purpose-scoped consent.
- Your LLM provider is a processor. Prompts sent to a model API are processing on your behalf. Check its retention and training terms and record which provider gets which data.
- Redact before logging. Mask phone numbers, emails and ID numbers in prompts, traces and analytics (rule 6 names masking and tokenisation).
- Separate the conversation from the audit log. Delete chat content when its purpose ends, but keep the processing logs that rule 8(3) requires for a year.
- Make rights reach the bot. Export and erasure jobs must cover the chat store, vector indexes built from conversations, and human handoff tools.
What does each obligation mean in the stack?
| Obligation | What to build | Where it lives |
|---|---|---|
| Notice and consent (s.5, s.6, rule 3) | Itemised, versioned notice; per-purpose consent ledger | Frontend, consent service, database |
| Withdrawal as easy as consent (s.6(4)) | One-tap withdrawal; event that stops downstream processing | App settings, message queue, integrations |
| Rights requests (s.11 to 14, rule 14) | "Your data" page, request queue, export and erasure jobs | Frontend, admin panel, backend jobs |
| Contact details (rule 9) | DPO or contact on site, app and every response | Website footer, app, email templates |
| Security safeguards (rule 6) | Encryption, access control, monitoring, backups | Infrastructure, IAM, logging |
| Breach intimation (rule 7) | Runbook, notice templates, affected-user query | Incident process, messaging service |
| Retention and erasure (s.8(7), rule 8) | Retention schedule, deletion jobs, 1-year log store | Database, schedulers, log storage |
| Children (s.9, rule 10) | Age gate, parent verification, tracking off for minors | Sign-up flow, analytics config |
| Processors (s.8(2), rule 6(1)(f)) | Contracts, vendor register, deletion on instruction | Legal, procurement, integrations |
| Chatbot data | Consent in chat, redaction, LLM vendor terms | Bot flows, middleware, logging |
What should you do before each deadline?
Now:
- Map every place personal data enters, is stored or is sent, including chatbot logs and LLM APIs.
- List processors and start contract updates.
- Write the breach runbook and name an owner.
Before 13 November 2026:
- Ship versioned notices and the per-purpose consent ledger.
- Decide whether you will accept consent through registered Consent Managers once rule 4 applies.
- Plan the section 5(2) notice to existing users.
Before 13 May 2027:
- Withdrawal, rights requests and the 90-day grievance process live and published.
- Retention jobs, one-year log store and rule 8 erasure warnings in place.
- Child flows, security controls and processor contracts finished, then tested end to end.
How can FNA help?
Most of this is careful product engineering. Our custom software development team builds these into existing backends, our AI chatbot developers design bots that ask before they collect and redact what they log, and our support and maintenance team can keep retention jobs and access reviews running after launch.
