Latest / Government and geopolitics

Rule changeGovernmentMediaIndiaConfirmed

India notifies the DPDP Rules, with full duties from May 2027

See how this story connects

MeitY notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, bringing the 2023 Act into operation in phases. The Data Protection Board provisions took effect at once, consent manager registration follows after 12 months, and notice, consent, security, breach notification, children’s data and cross-border rules apply after 18 months, from 13 May 2027. Penalties under the Act reach Rs 250 crore for security failures.

Why it matters

Any company that trains or runs AI on personal data of people in India has a fixed compliance date for consent, security, breach reporting and children’s data duties.

When
13 Nov 2025
ID
WTA-N-2025-0075
Where
India
Who
MeitY, Data Protection Board of India
Rules involved

Summary by wheresthe.ai, from Press Information Bureau and the reporting credited above. Checked against the source on 9 Oct 2026.

Source copy: download the source PDF as saved on 18 Oct 2026 (PDF). Document the source offers: the source PDF. Also held by the Internet Archive.

Earlier in this Storyline: What led hereIndia enacts the Digital Personal Data Protection Act, 2023

Cite this story

WTA-N-2025-0075: “India notifies the DPDP Rules, with full duties from May 2027.” wheresthe.ai, 13 Nov 2025. https://wheresthe.ai/d/in-dpdp-rules-notified-2025-11/ (source: Press Information Bureau).

Spotted an error? Email [email protected].