A client called me last week, not in a panic exactly, but close. He runs a small D2C skincare brand out of Gurgaon — maybe 40,000 customers on file, an email list, some WhatsApp order tracking. “Sir, my CA mentioned something about a new data law deadline. Is my business even affected?” I asked him three questions. He couldn’t answer any of them. That’s when I knew this post needed to be written.
Yes, your business is affected. Almost every business in India is.
What Actually Happened
The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The DPDP Act itself was passed back in 2023, but it needed these Rules to actually become enforceable — think of the Act as the skeleton and the Rules as the muscles that let it move.
Here’s the part most business owners miss: it’s not a single deadline. It’s a phased rollout spread across 12 to 18 months. Some provisions kicked in the moment the Rules were published. Others — the ones that will actually change how you run your business — are still coming.
What’s Already Live
A few obligations didn’t wait for the countdown:
- The Data Protection Board of India is being constituted, and it has real teeth — penalties up to ₹250 crore per breach, though the framework does account for smaller businesses through a graded penalty structure.
- Basic breach-response expectations are already in effect. If personal data is compromised, you can’t sit on it.
- The 48-hour intimation rule around data erasure has begun applying — users must be notified before their personal data is erased when they stop using a service.
What’s Coming — And Why the Timeline Matters More Than the Headline
The provisions still being phased in over the next several months are the ones that will actually cost you money and require process changes:
Consent Managers. If you collect personal data — and if you have a website with a contact form, you do — you’ll eventually need a proper consent architecture, not just a cookie banner nobody reads. This includes registration and accountability of anyone managing consent on your behalf.
Notice requirements. Every time you ask someone for their name, phone number, or email, the law will expect you to tell them clearly why, and get consent that’s actually informed — not a checkbox buried under 4,000 words of legalese.
Data retention limits. Personal data generally cannot be stored indefinitely once its purpose is served. “We might need it someday” is not going to be a defensible retention policy.
Significant Data Fiduciary obligations. If your business processes data at scale — larger platforms, fintechs, e-commerce players — additional obligations kick in, including independent audits and data protection impact assessments.
Why Founders Keep Getting This Wrong
I see the same mistake on repeat. A founder hears “18-month timeline” and mentally files it under “later.” But 18 months from a notification date that’s already months behind us is not as far away as it sounds — and building compliant consent flows, retention policies, and breach-response protocols isn’t something you do in a weekend sprint once the deadline is close. It touches your website, your CRM, your HR data, your vendor contracts.
The businesses that treat this as a genuine now problem — not a someday problem — are the ones that won’t be scrambling (or facing penalties) when full enforcement lands.
What I’d Tell You to Do This Month
If you’re a small or mid-sized business in India, don’t try to boil the ocean. Start here:
- Map what personal data you actually hold — customer names, phone numbers, employee records, vendor contacts. Most founders are surprised by how much is scattered across spreadsheets and inboxes.
- Audit your consent points — every form, every checkout, every WhatsApp opt-in.
- Write down a breach response plan before you need one. Trust me, you don’t want to be improvising this at 11 pm.
- Talk to someone who tracks the phased timeline, so you’re not caught off guard by a provision that’s quietly gone live.
This isn’t about fear-mongering. It’s about not being the business that finds out the hard way what “graded penalty system” means in practice.
If you’re unsure where your business stands under the DPDP Rules, or you just want a plain-language audit of your consent and data practices, get in touch — I’d rather answer your questions now than field a panicked call later.