Blog Details

India’s Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and most of the obligations for businesses apply from 13 May 2027. Much of the work to get ready is IT work: knowing where personal data lives, controlling who can reach it, and being able to show what happened if something goes wrong.

This checklist covers the IT side. It is a summary for awareness, not legal advice. Check the official notification and speak to your legal adviser about your own obligations.

The timeline

• 13 November 2025: the Rules were notified and the Data Protection Board provisions came into force.
• 13 November 2026: the consent manager provisions apply.
• 13 May 2027: the main obligations apply, including notices and consent, security safeguards, breach reporting and the rights of data principals.

Some commentators count these dates from the following day. Either way, 13 May 2027 is the date to plan for.

1. Know what personal data you hold, and where

Personal data in a business is rarely in one place. List where you keep names, phone numbers, email addresses and anything more sensitive: your CRM and accounting software, email mailboxes, shared drives, spreadsheets on laptops, WhatsApp groups and phones. Note who owns each source and why you keep the data. You cannot protect, or delete, what you have not found.

2. Control who can access it

• Turn on multi-factor authentication (MFA) for email and every system that holds personal data, starting with administrator accounts.
• Give people access only to what their job needs, and review it when roles change.
• Remove leavers’ accounts and shared-password access on their last day.
• Check external sharing links in OneDrive, SharePoint and Teams, which often stay open long after a project ends.

3. Protect it

• Encrypt laptop and desktop disks, so a lost device is not a data breach.
• Run up-to-date endpoint protection on every device that touches personal data.
• Keep systems updated, and replace software that no longer gets security updates.
• Back up important data, keep a copy away from your office network, and make sure someone on your team knows how to restore it.

4. Keep logs

If something goes wrong, you will need to know what happened: who signed in, from where, and what was accessed. Make sure sign-in and audit logging is switched on in Microsoft 365 and on your firewall and servers, and that logs are kept long enough to be useful.

5. Have a breach response plan

The Rules include requirements for reporting personal data breaches. Write down, in one page, who decides that an incident is a breach, who contains it, who contacts your legal adviser, and who informs the people affected and the Data Protection Board when required. Keep contact details for your IT provider and key vendors in the same place.

6. Fix your website forms

Contact and enquiry forms are often the first place personal data enters a business. Show a short notice before people submit, explaining what you collect and why. Ask for consent with an unticked box, keep marketing consent as a separate, optional choice, and explain how to withdraw consent. Collect only the fields you need, and link to a plain-language privacy notice.

7. Check your vendors and decide how long you keep data

List the service providers that handle personal data for you, such as your email, hosting, backup, payroll and CRM providers, and make sure your contracts with them cover data protection. Then set a retention period for each type of data, and actually delete it when that period ends, including old form submissions stored in your website.

Where to start

If you do only three things this month: list where your personal data lives, switch on MFA everywhere, and write the one-page breach plan. They take days, not months, and everything else builds on them.