DPDP Rules
2025.
Metadata
Implementation.
Rule Index
Compliance Roadmap
Monitor DPBI establishment and member appointments
Ongoing from 13 Nov 2025Track DPBI Chairperson and member appointments. DPBI will begin issuing guidelines, standards, and specifications that will define compliance requirements across all Rules.
Conduct data mapping audit
Q1 2026 (recommended)Map all personal data flows: what data is collected, from whom, for what purpose, where stored, who has access, how long retained, which third parties receive it. This audit is the foundation for all subsequent DPDP compliance work.
Assess SDF designation risk
Q1 2026Assess whether your organisation is likely to be designated as a Significant Data Fiduciary based on data volume, sensitivity, and systemic importance. SDFs face additional obligations (India-based DPO, independent auditor, DPIA). Begin DPO talent planning if SDF designation is likely.
Monitor negative list notifications
OngoingWatch for Central Government notifications specifying countries on the cross-border transfer 'negative list'. Begin mapping all jurisdictions to which Indian user data is transferred — have contingency plans ready for business-critical transfers to potentially listed countries.
Penalty Schedule
Failure to take security safeguards to prevent data breach
Rule 7 • Section 33(1) read with Section 8(5)
Failure to notify Data Protection Board of personal data breach
Rule 7(2)(a) • Section 33(2) read with Section 8(6)
Failure to notify Data Principals of breach
Rule 7(2)(b) • Section 33(3) read with Section 8(6)
Processing children's data without verifiable parental consent
Rule 6 • Section 33(4) read with Section 9