Short answer
LowerPlane serves startups in the United States, Singapore, India and worldwide. India's DPDP Rules 2025 (G.S.R. 846(E), notified 13 November 2025) commence in three phases: machinery rules on notification, the Consent Manager regime about 13 November 2026, and the substantive duties (notice, security safeguards, breach reporting, retention, children's data, Significant Data Fiduciary rules) about 13 May 2027.
Most of India's Digital Personal Data Protection Act 2023 has been sitting dormant since it was passed. The DPDP Rules 2025 are what finally switch it on. The notification on 13 November 2025 confirmed what the Rules do, who they apply to, and — critically — when each part commences. If you are a SaaS company serving Indian users, the clock on your real substantive compliance obligations started in mid-November 2025 and expires about 13 May 2027. The intermediate milestone, in mid-November 2026, turns on the Consent Manager ecosystem.
This piece walks through all three phases, the practical difference each makes for a SaaS startup, and the six-month plan that gets you from “we have a privacy policy” to “we can prove it” by May 2027. The DPDP overlap with GDPR and SOC 2 means you can reuse most of the evidence you already have — see the DPDP vs GDPR comparison for the control-by-control map.
The three commencement phases
| Phase | Approximate date | Rules in force | What it does |
|---|---|---|---|
| Phase 1 | 13 Nov 2025 (notification) | Rules 1, 2 and 17–21 | Short title, definitions and the Data Protection Board of India (appointment of Chair and Members, procedure, meetings, authentication). The Board exists but has little to enforce yet. |
| Phase 2 | ~13 Nov 2026 | Rule 4 (Consent Managers) | The Consent Manager regime goes live — registration with the Board, eligibility, obligations, and the ability for data principals to centrally manage consent across fiduciaries. |
| Phase 3 | ~13 May 2027 | Rules 3, 5–16, 22 and 23 | The substance of the Act: notice content, security safeguards, breach intimation, retention periods, verifiable parental consent for children, Significant Data Fiduciary duties, cross-border transfer restrictions, exemptions and procedural rules. |
The exact calendar dates depend on how the government counts the one-year and eighteen-month periods from the 13 November 2025 notification. For planning purposes, “mid-November 2026” and “mid-May 2027” are safe anchors.
Phase 2: the Consent Manager regime
A Consent Manager is an entity that provides data principals a single, interoperable interface to grant, review and withdraw consent across the Data Fiduciaries they interact with. Think of it as a privacy equivalent of DigiLocker or UPI: one dashboard, many parties. Under Rule 4 a Consent Manager must:
- Be a company incorporated in India and registered with the Data Protection Board.
- Meet a minimum net-worth threshold and a fit-and-proper test for directors.
- Operate on a data-fiduciary-neutral basis — it cannot preferentially route consent to its parent group's products.
- Be interoperable with other registered Consent Managers (so a user does not need to re-grant everything if they switch).
- Maintain records of consent that are produceable to the data principal and the Board on request.
For most SaaS startups the practical question is consumer, not provider: once the regime is live, data principals using your product will expect to manage their consent through a Consent Manager. Your product has to be able to receive, honour and revoke consent via the Consent Manager APIs. That integration work is the single biggest build item between now and November 2026.
Phase 3: the substantive duties that start in May 2027
Phase 3 is where DPDP becomes a “real” privacy regime. If you are a Data Fiduciary processing the personal data of Indian data principals, these are the duties that go live:
- Notice (Rule 3). Every notice to a data principal must list the personal data being collected and the specific purpose, with a hyperlink to withdraw consent and raise a grievance, in a form the user understands.
- Security safeguards (Rule 6). Encryption or masking in transit and at rest, access controls, logging and monitoring, continuity of processing, backups, incident response capabilities. The Rules do not prescribe specific technologies — the standard is “reasonable security safeguards” measured against risk.
- Breach intimation (Rule 7). Notification to the Data Protection Board “without delay” and to each affected data principal, with cause, consequences and mitigation. A detailed report follows within 72 hours.
- Retention (Rule 8). Personal data of e-commerce entities, online gaming and SSMI social-media intermediaries deleted three years after last contact unless law requires longer. All other data fiduciaries retain only for the purpose consented to.
- Children's data (Rule 10). Verifiable parental consent for anyone under 18, with exceptions for health, education and child welfare uses.
- Significant Data Fiduciary duties (Rule 12). If designated, you must appoint a Data Protection Officer in India, conduct periodic DPIAs, undergo an independent data audit and publish annual compliance information.
- Cross-border transfers (Rule 14). Transfers permitted unless the central government, by notification, restricts transfer to a specified country.
- Rights of data principals (Rule 13). Access, correction, erasure, grievance redressal and nomination — with timelines that will be read strictly after Phase 3.
The six-month plan to be May 2027 ready
You have roughly 18 months from publication of this article. Here is how a 1–50 person SaaS team should sequence the work:
- Months 1–2: inventory and classification. Build a Record of Processing Activities for Indian data principals. Separate columns for data category, purpose, legal basis (consent / certain legitimate uses), retention, downstream processors, cross-border destinations.
- Months 3–4: notice and consent redesign. Granular, purpose-specific consent capture; withdraw-consent and grievance link in notices; audit trail of consent lifecycle. Dark patterns out.
- Months 5–6: Consent Manager integration. Build the ingress and egress APIs so Consent Managers can grant, modify and revoke consent on behalf of users once Phase 2 lights up.
- Months 7–9: security safeguards and breach workflow. Encryption review, access-control hardening, logging retention, breach runbook with 72-hour reporting target, DPO (or equivalent contact) named in India.
- Months 10–12: rights plumbing. Self-service portal for access, correction, erasure and nomination requests, with SLA tracking.
- Months 13–18: audit readiness. If SDF-adjacent (large user base, sensitive categories), start the independent data audit and DPIA cadence six months before May 2027.
The LowerPlane DPDP hub maps each of these to concrete controls and templates; the SaaS compliance guide covers the engineering patterns.
Overlap with GDPR, SOC 2 and ISO 27001
DPDP is not a greenfield compliance programme. If you have shipped GDPR Article 30 ROPAs, SOC 2 Common Criteria, or ISO 27001 Annex A, roughly 65–75% of the work transfers:
- ROPA — a GDPR Article 30 register, scoped to Indian data principals, satisfies DPDP record-keeping.
- Security safeguards — SOC 2 CC6/CC7 and ISO 27001 A.5/A.8 cover the Rule 6 expectations.
- Breach notification — the GDPR 72-hour workflow adapts to DPDP's Board notification; the main delta is cause/mitigation detail required by the Board.
- Rights handling — the DSR portal you built for GDPR covers DPDP access/correction/erasure with the addition of nomination.
- Vendor management — GDPR DPAs translate to DPDP processor contracts with minimal change.
The irreducible DPDP-only work is the Consent Manager API integration, verifiable parental consent for under-18s, and the India-resident DPO if designated as a Significant Data Fiduciary.
Frequently asked questions
When do the DPDP Rules 2025 come into force?
In three phases, counted from the notification date of 13 November 2025. Phase 1 (Rules 1, 2, 17 to 21) was effective on notification. Phase 2 (Rule 4, Consent Managers) applies one year after notification, around 13 November 2026. Phase 3 (Rules 3, 5 to 16, 22 and 23) applies 18 months after notification, around 13 May 2027.
Who must register as a Consent Manager?
Any entity offering a Consent Manager service under the DPDP Act must register with the Data Protection Board. A Consent Manager must be an Indian company that meets the eligibility criteria in Rule 4 — net worth, fit-and-proper directors, data-fiduciary-neutral operations, and interoperability with other Consent Managers. Most SaaS companies will consume Consent Manager services rather than operate one.
Does the DPDP Act apply to US SaaS companies?
Yes, if you offer goods or services to data principals (people) in India, you are a Data Fiduciary under Section 3 of the DPDP Act regardless of where you are incorporated. The Rules 2025 apply the same way.
What is a Significant Data Fiduciary (SDF)?
The central government may designate an entity as a Significant Data Fiduciary based on volume and sensitivity of personal data processed, risk to data principals, impact on sovereignty, risk to electoral democracy and public order. SDFs have extra duties under Rule 12: appointing a Data Protection Officer in India, independent data audits, and periodic DPIAs.
How does DPDP overlap with GDPR?
There is roughly 70% operational overlap: notice, consent management, data subject rights (DPDP calls them data principal rights), breach notification, retention limits, children's data, security safeguards and vendor management are all common ground. The main divergence is DPDP's lack of explicit lawful bases besides consent and "certain legitimate uses," the Consent Manager architecture, and India-specific breach reporting to the Board.
What are the DPDP penalties?
Up to INR 250 crore (about USD 30 million) per instance of failure to prevent a personal data breach, up to INR 200 crore for failure to notify the Board or affected principals, up to INR 200 crore for failure in Significant Data Fiduciary obligations, up to INR 50 crore for processing children's data without the required protections, and up to INR 10,000 on data principals for frivolous complaints.
Run DPDP, GDPR and SOC 2 on one evidence base
LowerPlane maps your existing GDPR ROPA, SOC 2 controls and ISO 27001 evidence to the DPDP Rules so you don't rebuild. See the DPDP framework page or jump into the DPDP vs GDPR comparison.