The DPDP Rules timeline reaches its first major milestone this week. India’s Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology (MeitY) in the Gazette notification G.S.R. 846(E), dated November 13, 2025. Rule 4, which covers the registration and obligations of Consent Managers, comes into force one year after publication, so it takes effect in mid-November 2026. Most obligations for businesses, including consent notices, breach reporting and children’s data, follow eighteen months after publication, in May 2027.
This article is general information, not legal advice.
What changed in the DPDP Rules timeline
Rule 1 of the Rules sets out a phased start. Rules 1, 2 and 17 to 21, which mainly deal with the Data Protection Board, came into force on the date of publication. Rule 4 comes into force one year after publication. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication.
There is a one-day difference in official dates. The Gazette notification is dated November 13, 2025, while the Press Information Bureau (PIB) states that the government notified the Rules on November 14, 2025. Because the Rules count from the date of publication, the Consent Manager provisions apply from November 13 or 14, 2026, and the main business obligations from May 13 or 14, 2027. Businesses should plan for the earlier date.
Consent Managers are registered entities that give individuals a single platform to give, manage, review and withdraw consent. According to PIB, they must be companies based in India. The obligations arriving in May 2027 are the ones that change daily work for marketers and website owners. Under Rule 3, a consent notice must stand on its own, use clear and plain language, list the personal data being collected item by item, and explain the specific purpose. It must also give a link through which people can withdraw consent as easily as they gave it. Rule 7 requires businesses to inform affected individuals of a personal data breach without delay, and to inform the Board. Rule 10 requires verifiable consent from a parent before processing a child’s personal data.
Why it matters for businesses
Many websites still collect data through pre-ticked boxes, bundled terms and generic privacy policies. That approach is hard to square with the Rule 3 standard. Every lead form, newsletter signup, WhatsApp opt-in and checkout page that collects personal data will need a clear, purpose-specific notice and a working way to withdraw consent.
The penalties are significant. PIB notes that under the DPDP Act, failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and violations of obligations relating to children up to ₹200 crore. For small and mid-size businesses, the bigger risk is operational: retargeting audiences, CRM lists and email databases built without valid consent may become hard to use once the rules apply.
The rules also reach beyond Indian companies. Brands in the GCC, US or EU that market to people in India should expect the same consent and notice questions, especially if they collect data through Indian-facing websites or campaigns. Eighteen months sounds generous, but redesigning forms, updating consent records and retraining teams takes time, and agencies and vendors will be busy as May 2027 approaches.
What to do now
- Audit every place your website, apps and ads collect personal data, including forms, chat widgets, pixels and WhatsApp flows.
- Draft standalone consent notices in plain language that list each data item and its specific purpose, rather than bundling consent into terms.
- Build a withdrawal option that is as easy to use as the original opt-in, and connect it to your CRM and email tools.
- Identify where you may process children’s data, and plan a method for verifiable parental consent.
- Write a breach response plan that covers informing affected people and the Data Protection Board without delay.
- Watch for Consent Manager registrations and decide whether integrating with one makes sense for your audience.
Purple Rocket’s digital marketing team in India can help you rebuild forms and campaigns around consent. Contact us to plan the changes before the May 2027 deadline.