The DPDP Rules 2025 were notified by MeitY in November 2025, turning the DPDP Act, 2023 from a principle into an enforceable regime. For schools the practical takeaway is a countdown: most substantive obligations — notices, consent, security safeguards, breach reporting and retention — apply from around 13 May 2027, while Consent Manager provisions come in around November 2026. This article breaks down exactly what the Rules added, what schools must do at each phase, and why starting now is the cheapest path to compliance.
The phased timeline (immediate / 12 months / 18 months)
- What activates when, in a simple table.
What the Rules newly require
- Standalone itemised notices; verifiable parental consent mechanics; 72-hour breach reporting; retention & erasure triggers; security baselines (access control, log retention).
What it means for a school, step by step
- A short to-do list mapped to each phase.
The cost of waiting
- Why a 9–12 month programme means starting in 2026.
FAQ
Q: When were the DPDP Rules notified?
A: In November 2025, via gazette notification by MeitY.
Q: What is the DPDP deadline for compliance?
A: Most substantive obligations apply ~13 May 2027; some Consent Manager provisions ~November 2026.
Q: Do schools need to start now?
A: Yes — typical compliance programmes take 9–12 months, so 2026 is the time to begin gap assessment.
Call Now
WhatsApp