DPDP Rules 2025: What To Do First
The DPDP Rules 2025 bring India’s data protection law into force in phases. Here is a practical order of work for the months before the main obligations apply.
In this article
The Digital Personal Data Protection Rules were notified in November 2025. With them, India’s data protection law moved from a text people discussed to a timetable people have to plan around. For many companies the first question is simple: where do we start?
The good news is that the rules arrive in phases. That gives you time, but only if you use it well. This guide sets out a sensible order of work for a CTO, founder or compliance lead who wants to make steady progress without turning the business upside down.
1. Understand the phased timeline
The DPDP Rules do not switch everything on at once. The provisions that set up the Data Protection Board come first. The provisions on consent managers follow later. The main obligations for organisations that handle personal data, the ones most teams worry about, apply about 18 months after notification.
That window is not a reason to wait. It is roughly the time a typical company needs to find its personal data, fix its notices and consent flows, sign proper contracts with vendors and practise its breach response. Teams that start late usually end up rushing the hardest parts, such as cleaning up old data and changing product screens.
| Phase | What it covers | What to do in this phase |
|---|---|---|
| First | Provisions that set up the Data Protection Board | Map your data and name owners |
| Later | Provisions on consent managers | Decide whether consent managers matter to you |
| About 18 months after notification | The main obligations for organisations | Have notices, consent, rights and breach response working |
Check the official text of the Rules for the exact commencement of each part, and keep an eye on any clarifications the government publishes. Plan your work against the phases, not against a single deadline.
2. Find your personal data before you change anything
You cannot protect data you do not know you hold. Before you rewrite a single notice, build a simple record of the personal data you collect, why you collect it, where it lives and who can see it. This is the foundation for almost every other duty under the Act.
List your data sources.
Sign-up forms, mobile apps, HR systems, support tools, analytics, marketing lists and spreadsheets that live on shared drives.
Record the purpose for each one.
Write down why you collect the data in plain words. If nobody can explain the purpose, that is a finding in itself.
Map where the data goes.
Note which internal teams, vendors and cloud services receive it, including tools outside India.
Mark who owns each system.
Every data source needs a named owner who can answer questions and make changes.
Flag the risky areas.
Children’s data, large volumes, sensitive categories and old data kept "just in case" deserve early attention.
Keep this record in a format your team will actually maintain. A clear spreadsheet that is updated every quarter beats a beautiful diagram that nobody touches after the first workshop. Our DPDP Act readiness article covers data discovery in more depth.
3. Turn the Act into owned tasks
Once you know your data, you can turn the law into a short list of tasks, each with an owner and a date. Most organisations end up with a similar backbone: clear notices, valid consent where consent is the basis, a way for people to exercise their rights, reasonable security safeguards, vendor contracts that pass the duties down, and a tested breach response.
Assign these tasks to the people who run the systems, not only to legal or compliance. The product team owns the consent screens. The engineering team owns logging and deletion. The procurement or vendor team owns contract updates. Compliance coordinates and checks the evidence.
Make room for change, not only for advice. Several tasks touch live systems: consent screens, retention jobs and deletion requests. Those changes go through your normal release process, so they need space in the product roadmap. Raise them early with the people who plan the sprints.
Breach response deserves a special mention. Under the DPDP Rules, a personal data breach must be intimated to the affected people and to the Data Protection Board, with a detailed report to the Board within 72 hours. That is hard to meet without a plan, contact lists and practice. Treat it as an early task rather than a final one.
Finally, decide how you will track progress. A monthly review with the owners, a simple status for each task and a short note of decisions taken will keep the programme moving. It also gives you a record that shows the steps you took, which helps if anyone asks later.
The duties look large on paper, but they become manageable once they are broken into owned, dated tasks. If you would like help working out your own order of work, our DPDP compliance service team is happy to talk it through.