Two sets of rules decide how an Indian business looks after personal data and handles cyber incidents. The CERT-In Directions, issued under section 70B(6) of the IT Act, have bound businesses since 2022. The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 arrive in three steps between November 2025 and May 2027. This page lists each date, what it switched on, who it binds and where the official text sits, so you can plan your readiness work in the right order.
The short version
- CERT-In incident reporting, log retention, clock sync and a named point of contact already apply to every business, including MSMEs since 25 September 2022.
- The 15 CERT-In controls for MSMEs (September 2025) are recommendations, not legal duties.
- Most DPDP duties start on 13 May 2027. Consent Manager rules start on 13 November 2026.
The timeline
| Date | What | Who it binds | Where it comes from |
|---|---|---|---|
| 28 Jun 2022 | The CERT-In Directions of 28 April 2022 take effect, 60 days after issue. Report listed cyber incidents to CERT-In within 6 hours, keep logs of all ICT systems for a rolling 180 days within Indian jurisdiction, synchronise system clocks with NIC or NPL time servers, and name a point of contact for CERT-In. | Every service provider, intermediary, data centre, body corporate and government organisation. CERT-In's FAQ reads “body corporate” to include firms and sole proprietorships. | CERT-In Directions, 28 April 2022 CERT-In FAQ, May 2022 |
| 25 Sept 2022 | The same Directions take effect for micro, small and medium enterprises, under CERT-In's extension notice of 27 June 2022. | MSMEs classified under the MSME Ministry's notification S.O. 1702(E) of 1 June 2020, so a business with Udyam registration falls under this date. | CERT-In extension notice, 27 June 2022 |
| 1 Sept 2025 | CERT-In publishes the 15 Elemental Cyber Defence Controls for MSMEs (guideline CISG-2025-03): 15 controls, 45 recommendations, and a suggestion that MSMEs “may conduct Baseline Audits” through a CERT-In empanelled auditing organisation at least once a year. | Advisory only. CERT-In recommends the controls; no penalty attaches to the controls themselves. | CERT-In guideline PDF |
| 13 Nov 2025 | The DPDP Rules 2025 are notified. Rules 1, 2 and 17 to 21 come into force: definitions, and how the Data Protection Board's Chairperson and Members are selected, paid and hold meetings. The Act's definitions and the sections that set up the Board (ss.18 to 26) are in force from the same date. | The Central Government and the Board. No new duty falls on an ordinary business on this date. | DPDP Rules 2025, Rule 1 DPDP Act 2023, s.18 |
| 13 Nov 2026 | Rule 4 and the First Schedule come into force: registration and duties of Consent Managers, including the condition that the applicant is an Indian company with a net worth of at least ₹2 crore. Act s.6(9) (Consent Managers must register with the Board) and s.27(1)(d) (Board inquiries into breaches of registration conditions) start on the same day. | Only businesses that want to operate as a Consent Manager. | DPDP Rules 2025, Rule 4 First Schedule DPDP Act 2023, s.6 |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23 and Act ss.3 to 17 and 27 to 34 come into force: notice, consent, legitimate uses, reasonable security safeguards, breach intimation, erasure and log retention, children's data, Significant Data Fiduciary duties, rights and grievances, transfers outside India, Board inquiries and the penalty Schedule. | Every Data Fiduciary, of any size, that processes digital personal data in India or offers goods or services to people in India. | DPDP Rules 2025, Rule 3 onwards DPDP Act 2023, s.3 |
The DPDP dates are counted from the day the Rules were published in the Gazette: Rule 1 brings Rule 4 into force one year later and the bulk of the Rules eighteen months later. The Act's own sections follow the same three dates.
What has not happened yet
As of October 2026, three things that often appear in vendor marketing have not taken place:
- No Board members. The Data Protection Board of India exists in law, but no Chairperson or Members had been appointed by October 2026. Nobody is inquiring into complaints or issuing DPDP penalties today, and the penalty Schedule itself only commences on 13 May 2027.
- No Significant Data Fiduciaries. The Central Government has not notified any business or class of businesses under section 10(1). Until it does, the extra duties (a Data Protection Officer based in India, an independent data auditor, periodic impact assessments) apply to nobody.
- No exemption for startups or small firms. Section 17(3) lets the Government exempt certain classes, including startups, from the notice, accuracy, erasure, Significant Data Fiduciary and access provisions. No such notification has been issued. Even if one is, consent, security safeguards, breach intimation and grievance duties are outside the reach of that power.
What the penalties look like once they start
The DPDP Act sets ceilings, not fixed amounts. Failing to take reasonable security safeguards (s.8(5)) may attract up to ₹250 crore; failing to give breach intimation (s.8(6)) or breaching the children's data duties (s.9) up to ₹200 crore each; breaching Significant Data Fiduciary duties (s.10) up to ₹150 crore; and breaching any other provision up to ₹50 crore. Section 33 tells the Board to weigh the nature and duration of the breach, the data involved and how promptly the business acted to reduce harm. Under the CERT-In Directions, section 70B(7) of the IT Act allows imprisonment of up to one year, a fine of up to ₹1 lakh, or both; CERT-In's FAQ says the power is meant for deliberate failures.
How to use these dates
Treat CERT-In as current work and DPDP as a project to finish by 13 May 2027. As of October 2026, the CERT-In steps are already due: name your CERT-In point of contact, put the incident address incident@cert-in.org.in into your incident plan, check that your systems keep 180 days of logs, and point your clocks at an NIC or NPL time server. Then use the run-up to May 2027 for the DPDP work: a data inventory, a fresh privacy notice, consent records, vendor contracts, a breach plan with all three clocks, retention rules and a way to answer rights requests. Our explainer on CERT-In's 15 cyber defence controls for MSMEs covers the recommended security baseline control by control. For a block-by-block list of what to prepare, read our DPDP compliance checklist for Indian small businesses.
Frequently asked questions
When do I have to follow the DPDP Act?
Most duties, including notices, consent, security safeguards, breach intimation, children's data, erasure and rights requests, apply from 13 May 2027. Consent Manager registration rules apply from 13 November 2026. The Rules were notified on 13 November 2025.
Do the CERT-In Directions already apply to my small business?
Yes. The Directions of 28 April 2022 bind every body corporate, which CERT-In reads to include firms and sole proprietorships, and they have applied to MSMEs since 25 September 2022. They require reporting listed cyber incidents within 6 hours, keeping 180 days of logs, clock synchronisation and a named point of contact.
Can the Data Protection Board penalise my business today?
No. As of October 2026 no Chairperson or Members of the Board had been appointed, and the DPDP penalty provisions only commence on 13 May 2027. The time before then is for getting ready, not for enforcement.
See where you stand, clause by clause
The Syentrix Compliance Check reads your own documents or your answers against every clause of the DPDP Act, the DPDP Rules, the CERT-In Directions and the 15 MSME controls, and shows the evidence for each verdict.
See the Compliance Check →Read next
Compliance Check
Every DPDP and CERT-In clause checked against your own documents.
ExplainerCERT-In's 15 controls for MSMEs
What each control means and what an auditor asks to see.
ChecklistDPDP Compliance Checklist for Small Businesses
Eight blocks of tasks, each tied to the rule it comes from.
General information, not legal advice. Last reviewed 14 October 2026 against the official texts linked on this page. Readiness information only; for a formal audit speak to a CERT-In empanelled auditing organisation, and for legal advice speak to an advocate.