On November 14, 2025, MeitY published the Digital Personal Data Protection Rules, 2025 in the Gazette — finally operationalising the [DPDP Act 2023](https://www.meity.gov.in/) two years and three months after Parliament passed it. The Rules give you 18 months on a phased schedule. The marketing teams at most Indian SaaS firms are reading this as "we have time." We do not. Phase 3, the one that breaks your product if you ignore it, is the May 2027 milestone — and the engineering changes it requires take 12 to 18 months for any product with non-trivial user data. This is the founder-friendly action plan, with the 12 specific engineering tasks our team is now running for SaaS clients in Bengaluru, Hyderabad, and Pune.
## The 60-second answer
The DPDP Rules notified on Nov 14, 2025 set off a three-phase compliance schedule: the Data Protection Board is being constituted now (Phase 1), Consent Manager registration opens in November 2026 (Phase 2), and the operational obligations — consent notices, security safeguards, breach notification, Significant Data Fiduciary duties, data principal rights — kick in around May 2027 (Phase 3). The penalty ceiling is ₹250 crore per breach. The 12 engineering tasks below are what an Indian SaaS founder should start this quarter so Phase 3 lands without a fire drill.
## The phased timeline at a glance
## What you should ship in the next 90 days (the 12 engineering tasks)
## What changes IMMEDIATELY (Phase 1)
Three things go live the moment the Rules were notified:
1. The Data Protection Board exists. It can take complaints. It does not yet have full enforcement teeth, but it can conduct fact-finding and refer matters.
2. The breach-notification expectation is set, even before formal enforcement. A breach in November 2025 that you fail to disclose is a problem in 2027 when investigators look back.
3. Industry norms are shifting. Procurement teams at every Indian enterprise are starting to ask "are you DPDP-ready?" as part of vendor selection. Saying "we have until May 2027" is the wrong answer for a sales call in Q1 2026.
## What the rules actually say (the bits that matter)
The full text is on the [MeitY website](https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa) and the official PIB summary is [here](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655). Read the full Rules at least once before delegating.
## Common mistakes we see in the wild
Symptom: "We added a checkbox to the signup form. We are DPDP-compliant." No. The notice has to be a separate, standalone document with version control and audit-logged consent. A checkbox in a 2,000-word T&C does not satisfy Rule 3.
Symptom: "Our T&C says users can email us to delete their data." Rule 13 requires a programmatic mechanism — a button, an API, something a user can use without you in the loop. An email-based process will fail audit.
Symptom: "We don't process Indian data, we are a B2B SaaS for US clients." If any of your US client's employees are in India, or if any of your US client's customers are Indian — DPDP applies to that subset. The cross-border applicability is broader than most founders assume.
Symptom: "We outsourced the DPO to our CA firm." The DPO must be an employee or contractor accountable to the board, with authority to escalate independently. A CA firm is an auditor, not a DPO.
Nov 14, 2025
Gazette publication date
18 months
Total phased rollout
72 hours
Breach notification window
₹250 cr
Maximum penalty per breach
Nov 14, 2025 — Phase 1 (immediate)
DPDP Rules notified in the Gazette. Data Protection Board of India formally constituted. Breach-handling expectation begins de facto, even though the formal obligation is in Phase 3. Smart firms start drafting consent notices now.
DPDP Rules notified in the Gazette. Data Protection Board of India formally constituted. Breach-handling expectation begins de facto, even though the formal obligation is in Phase 3. Smart firms start drafting consent notices now.
Nov 2026 — Phase 2 (12 months)
Registration framework for Consent Managers opens. These are licensed intermediaries who will let users grant, review, and revoke consent across multiple Data Fiduciaries — think DigiLocker for consent. SaaS founders need to decide whether to integrate a Consent Manager API or build proprietary consent UX.
Registration framework for Consent Managers opens. These are licensed intermediaries who will let users grant, review, and revoke consent across multiple Data Fiduciaries — think DigiLocker for consent. SaaS founders need to decide whether to integrate a Consent Manager API or build proprietary consent UX.
May 2027 — Phase 3 (18 months)
The big one. Standalone consent-notice obligation, security-safeguard obligation, 72-hour breach-notification rule, Significant Data Fiduciary obligations (DPIA + annual audit + DPO), data-principal rights (access, correction, erasure, nominate). Non-compliance = up to ₹250 cr per breach.
The big one. Standalone consent-notice obligation, security-safeguard obligation, 72-hour breach-notification rule, Significant Data Fiduciary obligations (DPIA + annual audit + DPO), data-principal rights (access, correction, erasure, nominate). Non-compliance = up to ₹250 cr per breach.
1. Standalone consent notice
Section 8 of the Rules requires the consent notice to be a separate document, not buried in T&Cs. Build a dedicated consent-capture screen. Log the version of the notice the user accepted, with timestamp and IP.
2. Erasure pipeline (DSAR)
Build a single endpoint that, given a user ID, deletes the row in your primary DB, queues purge jobs for analytics warehouse (BigQuery, Snowflake), revokes access tokens, scrubs CDN-cached PII, and logs the chain of deletions for audit.
3. Data-export API
A user requesting data access gets it in a machine-readable format (JSON or CSV) within 30 days. Build the export endpoint now, ship a "Download my data" button before May 2027.
4. 72-hour breach playbook
Document who calls whom, who drafts the user notification, who files the Data Protection Board report. Practise it once a quarter. The 72-hour window starts when you became "aware" — not when you finished investigating.
5. Data-flow inventory
A spreadsheet (or Confluence page) listing every type of personal data you collect, where it sits, who has access, and how long you keep it. The basis for every other DPDP control.
6. Children-data handling
If your product can be used by anyone under 18, you need verifiable parental consent. Build the age-gate, the parental email-confirmation flow, and the audit log. Edtech and gaming SaaS, this is on your critical path.
7. Encryption at rest + in transit
PG/MySQL TDE on the DB, TLS 1.2+ on every API endpoint, S3 SSE-KMS on every bucket. Cheap to ship; expensive to retrofit after a breach.
8. Access logging
Every read of personal data by an internal user (support agent, ops, analytics) is logged. Stripe-style audit log. The Board can demand this in any investigation.
9. Data residency map
Document what is in India, what is on AWS Mumbai vs us-east-1, what flows to Bangalore SaaS vs US-based vendors. The cross-border transfer rules in DPDP Section 16 require you to know.
10. Consent Manager interface
Decide now: integrate with the upcoming Account Aggregator-style Consent Managers (a public API contract) or build proprietary. The right answer depends on whether your users will manage consent across multiple SaaS apps.
11. DPIA template
If you cross the SDF threshold (likely if you have over 1M Indian users or process sensitive data), you need a Data Protection Impact Assessment annually. Build the template now and run it on your existing product.
12. DPO appointment
SDFs need a Data Protection Officer who is an Indian resident and reports to the board. Most SaaS founders are appointing themselves or their CTO as interim DPO. Document the appointment in writing.
| Rule / Section | What it means for engineering | When it bites |
|---|---|---|
| Rule 3 + Section 5 (Notice) | A separate, plain-language consent notice for every purpose of processing. No bundling. | Phase 3 (May 2027) |
| Rule 4 (Consent Manager) | Optional integration with licensed Consent Managers; opens up cross-fiduciary consent UX. | Phase 2 (Nov 2026) |
| Rule 6 (Reasonable Security Safeguards) | Encryption, access controls, logs of access, retention limits, deletion procedures. | Phase 3 (May 2027) |
| Rule 7 (Breach intimation) | Notify users without delay; notify the Board within 72 hours with detailed submission. | Phase 3 (May 2027), de facto Phase 1 |
| Rule 10 (Children data) | Verifiable parental consent for users under 18. Specific carve-outs for healthcare, education. | Phase 3 (May 2027) |
| Rule 12-15 (SDF obligations) | Annual DPIA, independent audit, DPO who is an Indian resident, algorithmic-risk review. | Phase 3 (May 2027) |
The Significant Data Fiduciary trap. The threshold for SDF designation is not in the Rules — MeitY will notify it later. Most analysts expect 50,000–1,000,000 Indian users as the cut. If your B2C SaaS is on a hockey-stick growth curve, assume you will hit SDF status before May 2027. Plan for the DPIA, the annual audit, and the DPO from the start.
## A real example: 110-staff Bengaluru fintech SaaS
We started this work for a Bengaluru fintech SaaS in October 2025, in anticipation of the rules. The company had 380,000 Indian users, a Postgres + Redis stack on AWS Mumbai, and a 4-person engineering team. The 90-day plan we ran:
- Days 1–14: Data-flow inventory. Found 23 places personal data was stored, including 4 forgotten S3 buckets and a Hubspot integration nobody could remember enabling. Tightened access on 11 of them.
- Days 15–35: Built the consent-notice screen (separate page, version-controlled, audit-logged), the data-export API, and the erasure pipeline. Total: 9 engineering days.
- Days 36–60: Encryption audit. Migrated DB to PostgreSQL TDE, enabled S3 SSE-KMS on every bucket, audited every API for TLS 1.2+. Two days of work; the discovery was that an internal admin tool was still on TLS 1.0.
- Days 61–75: 72-hour breach playbook. Tabletop exercise in week 11. Three roles assigned: incident commander (CTO), comms lead (Head of Sales, surprisingly), Board-filing lead (Head of Legal).
- Days 76–90: DPIA template, DPO appointment, data residency map. Total cost: ₹3.4 lakh in our consulting + 22 internal engineering days. The CFO logged the spend as "DPDP runway insurance."
## A subtle thing nobody talks about: the audit-log retention question
DPDP requires you to keep access logs for "as long as needed to demonstrate compliance." There is no fixed number. In practice, our advice is 7 years, matching the cyber-insurance and tax-audit retention norms. That is a non-trivial storage cost for high-volume SaaS — budget it from the start. The cheapest way to do it: hot for 90 days in your primary DB, warm in a Postgres archive for 1 year, cold in S3 Glacier Deep Archive for years 2–7. We have built this layered retention for two SaaS clients; the storage cost for 50 GB/year of audit logs is roughly ₹14,000/year all-in.
## When NOT to start this work this quarter
Skip the 90-day sprint if (a) you are pre-product-market fit with under 1,000 monthly active users — your product will look completely different in 12 months and you will rebuild the consent flow anyway; or (b) your SaaS is genuinely B2B-only with zero personal data, processing only company-name + contact-email — the basic Rule 6 controls are enough and you do not need the full programme. Anyone with a B2C product or a B2B product that handles employee/customer data should start now.
## Our take
The DPDP Rules are an opportunity in disguise. The Indian SaaS firms that ship clean consent UX, programmatic erasure, and a defensible breach playbook in 2026 will close enterprise deals faster — because their procurement teams will not need to add a 12-week security review. The firms that wait until April 2027 will find that their best engineers are committed to product launches and that DPDP retrofits are taking 4× the planned time. We have already seen this pattern with EU GDPR — Indian SaaS firms that prepared in 2017 captured EU enterprise contracts that the laggards lost in 2018-2019.
Our founder, [Vivek Singh](https://viveksinra.com), has been writing about the founder side of this — what it means for the consumer-product duty of care — and a sister post on Constitution Day (Nov 26) goes deeper into that angle. The technical playbook above came out of work our team did with [our QA and security lead Manvi](/team/manvi) and CTO [Hrishikesh](/team/rishikesh-baidya) for two SaaS clients between Sept and Nov 2025.
## FAQ
### What is the difference between the DPDP Act and the DPDP Rules?
The Act is the law passed by Parliament in August 2023; the Rules are the operational details — what counts as a "valid consent notice," what counts as a "reasonable security safeguard," who is a Significant Data Fiduciary. The Rules give the Act teeth. Without the Rules, the Act was unenforceable, which is why nothing happened from August 2023 to November 2025.
### When can the Data Protection Board start fining us?
The Board can take complaints now (Phase 1). The penalty regime is fully active in Phase 3 (May 2027). Between now and May 2027, expect investigations and informal compliance notices but not the headline ₹250-crore penalties.
### Do we need a Data Protection Officer (DPO)?
If you are designated a Significant Data Fiduciary, yes — and the DPO must be an Indian resident, reporting to the board. If you are an ordinary Data Fiduciary, you need a "designated person" to receive grievances, but the role can be combined with another (CTO, COO). Most SaaS founders we work with appoint themselves until they cross the SDF threshold.
### What if our customer is in the EU and we are subject to GDPR?
DPDP and GDPR overlap roughly 75%. The big differences: DPDP has no equivalent of GDPR's "legitimate interest" basis (consent is much more central in India), DPDP has stronger children-data rules, and DPDP penalties are calculated differently (capped per breach in INR, not as a % of global turnover). If you are GDPR-compliant, you are roughly 70% of the way to DPDP-compliant; the rest is local-language consent notices and the DPO-residency rule.
### How does DPDP affect AI training data?
Training a model on personal data is "processing" under DPDP. You need a lawful basis — usually consent — for every personal-data row in the training set. Models trained on scraped Indian data without consent are exposed. Synthetic data and data that has been "anonymised in a manner that cannot reasonably be reversed" are out of scope.
### What is the role of the Consent Managers?
Consent Managers are licensed intermediaries (think DigiLocker meets Plaid) that let an end-user manage consent across multiple Data Fiduciaries from one dashboard. The framework registration opens November 2026. SaaS founders should decide whether to integrate the API once it is published — for B2C apps that share data with partners, integrating early is a strong UX win.
### Where can we read what the community is saying?
The [r/india](https://www.reddit.com/r/india/) and [r/IndianSaaS](https://www.reddit.com/r/IndianSaaS/) subreddits have active threads. The [Software Freedom Law Centre](https://sflc.in/) has a public reading guide. The [Internet Freedom Foundation](https://internetfreedom.in/) has been the most useful civil-society lens. We cross-checked our 90-day plan against the [Scrut Automation public guide](https://www.scrut.io/post/dpdp-rules) and the [KPMG implementation deck](https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2025/11/dpdp-rules-2025-guidance-to-dpdp-act-implementation.pdf), both freely downloadable.
Need a DPDP readiness audit and engineering plan?
Our team runs a 90-day DPDP readiness programme for Indian SaaS founders — data-flow inventory in week 1, the 12 engineering changes scoped in week 2, and a fixed-price build-out for the rest. Typical engagement: ₹2.8–₹5.4 lakh depending on existing footprint. The first call is with our QA + security lead Manvi and our engineering team, who have already shipped this for two SaaS clients in Bengaluru.
Book a 30-min DPDP CallTags:
DPDPData ProtectionIndia SaaSComplianceMeitYPrivacyFounder Guide
