India's Digital Personal Data Protection Rules 2025, notified on 13 November 2025, introduce a phased implementation schedule that places the consent-manager regime into effect from November 2026, with full substantive obligations applying from 13 May 2027. International companies processing personal data of individuals in India – whether through subsidiaries, cross-border data transfers, or digital services – must begin compliance preparations now. The timeline is short, and the regulatory architecture differs in important respects from GDPR compliance frameworks that many organisations already follow.
What Changed and When
The DPDP Rules 2025 were notified on 13 November 2025, giving formal shape to the Digital Personal Data Protection Act that Parliament had passed earlier. The rules establish a two-stage rollout. The first operational milestone is the consent-manager regime, which becomes active in November 2026. The second and more comprehensive stage – covering the full range of substantive obligations for data fiduciaries – takes effect on 13 May 2027.
Alongside the rules, the Data Protection Board of India has been constituted. This is the designated supervisory authority under the Act, empowered to investigate complaints, impose financial penalties, and issue directions. Its constitution marks a shift from a purely legislative framework to an enforceable regulatory regime, and organisations should treat it with the same seriousness they afford regulators such as the Information Commissioner's Office in the UK or data protection supervisory authorities under GDPR.
The Consent-Manager Regime: What It Means in Practice
A consent manager is a registered intermediary through which data principals (individuals) can give, review, and withdraw consent for the processing of their personal data. Under the DPDP Rules 2025, data fiduciaries will be required to interact with consent managers in a prescribed manner. This introduces a structural layer to consent workflows that goes beyond the checkbox-and-policy approach familiar in GDPR compliance programmes.
From November 2026, companies that collect or process personal data of individuals in India will need to ensure that their consent mechanisms are compatible with the consent-manager infrastructure. Organisations that have not mapped their data flows and consent touchpoints ahead of this date risk being unable to demonstrate lawful processing once the regime is live.
For businesses that also operate under NIS2, DORA, or comparable frameworks in the European Union, there is an additional complexity: the Indian regime creates obligations that run in parallel rather than in alignment. Data transfer arrangements, processor agreements, and breach notification procedures will need to satisfy both sets of requirements without assuming equivalence between them.
Who Is Affected
The rules apply to the processing of digital personal data of individuals in India, regardless of where the data fiduciary is established. The following types of organisations should treat this alert as directly relevant:
- Foreign companies offering goods or services to individuals in India, even without a physical presence.
- Indian subsidiaries and joint ventures of international groups, which will be data fiduciaries in their own right.
- Financial institutions subject to oversight by SEBI or the RBI, where the DPDP Rules interact with existing sectoral data-localisation and customer-data obligations under banking and finance regulation.
- Technology and platform companies processing large volumes of behavioural or transactional data.
- Any organisation engaged in cross-border data transfer involving personal data originating in India, pending the government's notification of permitted transfer frameworks.
It is worth noting that significant processing entities – categorised as Significant Data Fiduciaries – face additional obligations. The criteria for that designation have not yet been fully prescribed and remain subject to further notification. Organisations in sectors already regulated by SEBI, RBI, or NCLT proceedings involving data-intensive businesses should monitor these developments closely, as sectoral rules may interact with or supplement the DPDP framework.
If you are assessing whether your organisation falls within the scope of these rules, or how your existing data transfer arrangements are affected, our team is available to discuss your situation. Please write to us at info@ferrazwhitmore.com or visit our contacts page.
Key Deadlines at a Glance
| Milestone | Date | What It Requires |
|---|---|---|
| DPDP Rules 2025 notified | 13 November 2025 | Organisations should have begun gap analysis against the Rules |
| Consent-manager regime live | November 2026 | Consent workflows must be compatible with registered consent managers |
| Full substantive obligations | 13 May 2027 | All data fiduciary obligations under the Act and Rules apply in full |
Immediate Actions for International Companies
Given the November 2026 consent-manager deadline, there is limited runway for preparation. The following steps are relevant for most international organisations with Indian data exposure:
- Map your data flows. Identify all categories of personal data collected from individuals in India, the purposes of processing, and the legal bases relied upon. This is a prerequisite for both consent-manager compatibility and the broader obligations that follow in May 2027.
- Review cross-border data transfer arrangements. The permitted transfer framework under the DPDP Act has not yet been fully notified. Organisations relying on standard contractual clauses or other GDPR-derived instruments should not assume these will be accepted as sufficient under the Indian regime. Monitor government notifications and seek advice on interim measures.
- Assess data breach notification obligations. The Rules set out requirements for notifying the Data Protection Board and affected data principals following a personal data breach. These timelines and thresholds differ from those under GDPR and from sector-specific obligations under RBI or SEBI frameworks. A consolidated breach response procedure should account for all applicable regimes.
- Update processor and vendor agreements. Data processing agreements used with Indian vendors or processors will need to be reviewed against the requirements of the DPDP Rules. Existing GDPR-compliant templates will not automatically satisfy Indian requirements.
- Engage with the consent-manager ecosystem. Registered consent managers are not yet operational, but the technical and commercial landscape is developing. Organisations should track the registration process and assess which consent-manager arrangements suit their processing activities.
For a structured overview of the full implementation timeline and the obligations at each phase, we have published a detailed guide: India DPDP Rules – Implementation Roadmap.
Interaction with Sectoral Regulators
India's financial sector is subject to data governance expectations from both the RBI and SEBI, which have their own requirements around data localisation, customer confidentiality, and technology risk. The DPDP framework does not displace these obligations; it operates alongside them. For financial institutions and fintech businesses, compliance planning must be coordinated across the DPDP Rules, applicable RBI master directions, and SEBI circulars. Organisations facing corporate restructuring or M&A proceedings before the NCLT should also consider how personal data assets and liabilities are treated in that context.
Our banking and finance practice in India advises on the intersection of data protection requirements with regulatory obligations across both the DPDP framework and existing financial sector rules. Further information is available at our India banking and finance practice page.
How Ferraz & Whitmore Can Assist
Our data protection practice advises international companies on building compliance programmes that address the DPDP Act and Rules in India alongside obligations under GDPR, NIS2, DORA, and equivalent frameworks in other jurisdictions. We work with legal and compliance teams to map data flows, draft or revise processing agreements, assess cross-border transfer risk, and prepare breach response procedures tailored to the applicable regulatory landscape.
Further detail on our India data protection advisory work is available at our India data protection practice page.
To discuss your organisation's exposure under the DPDP consent-manager regime or the broader obligations taking effect in 2027, please contact us at info@ferrazwhitmore.com or through our contacts page. Early preparation provides the greatest flexibility in structuring a compliant and operationally workable approach.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.