For founders
For founders preparing for DPDP
DPDP comes down to a few dates and a handful of decisions. Make the decisions early and the work fits into normal product and operations cycles.
Short answer
The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025, Consent Manager registration under Rule 4 starts on 13 November 2026, and core obligations begin on 13 May 2027. A founder's job is to name an owner, decide what data the company really needs, fund the work, and know whether it processes children's data. The Board has no members yet, but that does not change the dates.
The dates that matter
| Date | What happens |
|---|---|
| 13 November 2025 | Rules notified (G.S.R. 846(E)), with the commencement notification G.S.R. 843(E). Rules 1, 2 and 17 to 21 in force. |
| 13 November 2026 | Rule 4: Consent Manager registration. |
| 13 May 2027 | Core obligations begin: Rules 3, 5 to 16, 22 and 23. |
For most companies, the date to plan for is 13 May 2027. Rule 4 matters mainly to firms that want to register as Consent Managers. See the full DPDP timeline for what each group of rules covers.
Decisions only a founder can make
- Who owns it. One named person with time and authority, published as the Rule 9 contact.
- What data you really need. Consent covers only data necessary for the purpose (s.6), so less data means less work.
- Whether you serve under-18s. If you do, s.9 and Rule 10 change your sign-up flow and ad model.
- Budget. Counsel time for notices and contracts, engineering time for consent and deletion, and tooling.
- Vendors. Which tools hold user data, and whether you are willing to sign their terms.
- Where data goes. Know which flows leave India; s.16 lets the Central Government restrict transfers to countries it notifies.
- Whether to name a DPO early. Only SDFs must appoint one (s.10(2)(a)), but every company needs a named owner and a Rule 9 contact.
Why this is a product question, not only a legal one
Most DPDP work lands in the product: consent screens, withdrawal settings, deletion paths and children's flows. Planned into the roadmap, it ships with normal releases. Left to the end, the same flows get rebuilt under time pressure.
What to do this quarter
- 01Appoint the owner
Give them a mandate and a monthly slot with you.
- 02Get a baseline
Take the readiness quiz and list the gaps.
- 03Check for children
If anyone under 18 can sign up, read s.9 and Rule 10 now, because parental consent changes the sign-up flow.
- 04Plan to 13 May 2027
Put notice, consent, deletion and breach work into the product roadmap with dates. Our May 2027 checklist sets out the order.
When to bring in help
Bring in counsel for your notice, processor contracts, any children's data, and if you might be notified as a Significant Data Fiduciary. Bring in tooling when spreadsheets stop telling you who consented to what, or when requests arrive faster than one person can track. Before you scale, a part-time adviser can be enough.
How TruePrivacy helps
- One workspace for consent, rights requests, grievances and breach response, with an audit trail behind each.
- The DPDP checklist gives a readiness view from live records that you can show investors and customers. It is not a certification.
- Pricing: Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
What happens on 13 May 2027?
Core obligations begin: notice, consent, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances (Rules 3, 5 to 16, 22 and 23).
Is the Data Protection Board imposing penalties yet?
No Board members have been appointed yet. Penalties under s.33 are decided by the Board after an inquiry.
Do we need a DPO?
Only if you are notified as a Significant Data Fiduciary (s.10(2)(a)). Every fiduciary publishes a contact for questions about processing (Rule 9).
What will TruePrivacy cost us?
Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin