The DPDP Act and data localisation: what Indian enterprises must do, and by when

The timeline

MeitY notified the Digital Personal Data Protection Rules, 2025 as G.S.R. 846(E) on 13 November 2025 [1]. They start in three stages.

In January 2026 MeitY consulted industry on shortening the 18-month runway to 12 months, which would move the main duties to 13 November 2026 [3]. That was a proposal, not a notified amendment, so check the Gazette before you plan around 13 May 2027.

What data localisation does and does not mean under DPDP

• Transfers abroad are allowed by default. Section 16(1) lets the government restrict transfers only to countries or territories it notifies [4].
• Stricter sector rules still apply. Section 16(2) preserves any other Indian law that restricts transfers more tightly, such as RBI's payment data rules [4].
• The only DPDP localisation duty is narrow. Rule 13 requires a Significant Data Fiduciary to keep personal data that the government specifies, on a committee's recommendation, inside India [1].
• In the sources we checked, no restricted-country list, no list of Significant Data Fiduciaries and no list of data to be kept in India had been notified yet.

What every business must do from 13 May 2027

• Give a notice that stands on its own, in clear and plain language, itemising the personal data and purposes, with a way to withdraw consent as easy as giving it (Rule 3) [1].
• Keep reasonable security safeguards, including encryption, masking or tokens, access controls, logging and monitoring, backups, and security terms in processor contracts (Rule 6) [1].
• Retain relevant logs and personal data for one year to detect and investigate unauthorised access, unless another law says otherwise (Rule 6) [1].
• Report a personal data breach to each affected person without delay, and to the Board without delay with a detailed report within 72 hours (Rule 7) [1][2]. This is separate from the 6-hour cyber incident report to CERT-In [2][6].
• Erase personal data once its purpose is served, unless a law requires you to keep it (Rule 8) [1].

Employee data has a specific basis: section 7(i) allows processing for employment purposes without consent, but security safeguards and other duties still apply [5].

Extra duties for Significant Data Fiduciaries

• Appoint a Data Protection Officer based in India and an independent data auditor (section 10) [7].
• Carry out a Data Protection Impact Assessment and an audit every twelve months, and report significant observations to the Board (Rule 13) [1].
• Check that algorithmic software processing personal data is not likely to risk people's rights (Rule 13) [1].

Penalties

Where your software runs matters

DPDP makes you answerable for safeguards, logs, breach reporting and erasure across every system that holds personal data, including SaaS tools your vendors run. Each extra vendor adds a processor contract, a log source and a breach path you depend on.

Own360 runs on your own infrastructure, on-premise, in your private cloud or air-gapped, so your data never transits Own360 servers. OwnCentral keeps an immutable audit log with role-based access for people and AI agents, OwnITSM collects DPDP, ISO 27001 and SOC 2 evidence as work happens, and OwnIQ keeps AI inference inside your perimeter.

Questions buyers ask

Does the DPDP Act require data localisation?

No general localisation. Transfers abroad are allowed unless the government restricts a destination under section 16(1); only data the government specifies for Significant Data Fiduciaries must stay in India under Rule 13 [1][4].

When do the DPDP obligations start?

The main duties start on 13 May 2027, eighteen months after the Rules were notified on 13 November 2025. Consent Manager registration starts on 13 November 2026 [1][2].

What is the maximum DPDP penalty?

Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach [8].

How fast must a breach be reported under DPDP?

To affected people and the Board without delay, with a detailed report to the Board within 72 hours. Cyber incidents also go to CERT-In within 6 hours under separate directions [1][2][6].

Read next

• RBI data storage and outsourcing rules
• Air-gapped software for government and critical infrastructure
• Security at Own360