The Digital Personal Data Protection (DPDP) Rules were notified by MeitY in November 2025, and the compliance clock is now running. Industry commentary points to two dates worth putting in your calendar.
The timeline, as reported
- 13 November 2026 – the Consent Manager framework comes into effect. It is an important milestone, though commentators note it is not a deadline for every data fiduciary.
- 13 May 2027 – most substantive obligations are reported to apply from here: notice, consent, security safeguards, breach reporting and data-principal rights.
Reports also cite a 72-hour window for breach reporting and a 90-day window for resolving grievances, with penalties that can reach hundreds of crores of rupees for serious failures. Figures vary between secondary sources, so please verify them against the official gazette notification before relying on them.
A starter checklist for websites and apps
- Map your data. List what personal data you collect (lead forms, orders, accounts), why, where it is stored and who can access it.
- Review consent and notices. Forms that collect names, phone numbers and emails should say clearly what the data is used for.
- Tighten security. HTTPS everywhere, least-privilege access to admin panels, and tested backups.
- Prepare for requests. Be able to find, correct and delete a person's data when asked.
- Plan for breaches. Decide who investigates and who notifies, before it happens.
What this means for GJDesigns clients
If we build or host your website, app or database, we can help review lead forms, access controls and data retention against this checklist. This article is general information, not legal advice — confirm specifics with your legal counsel.
Source: www.mondaq.com
