This is a general summary based on a law-firm analysis, not legal advice. Dates and details can change, so check the current position with counsel before relying on any of it. According to that analysis, the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and apply in phases.
The timeline as reported
- Immediately — provisions establishing the Data Protection Board.
- After 12 months, around November 2026 — rules on the registration of Consent Managers.
- After 18 months, around May 2027 — the remaining provisions, including notices, security safeguards, breach reporting, erasure and verifiable parental consent.
Obligations that matter for AI systems
- Notices — must be understandable on their own, itemize the personal data processed, tie each item to a specific purpose and explain how to withdraw consent or complain. A buried clause in a long policy won't do. If a chatbot or voice agent collects data, the notice has to cover it.
- Security safeguards — the analysis lists minimum measures such as encryption, masking or virtual tokens, and access controls, with logs retained for a year. Prompt and conversation logs count as data stores.
- Breach reporting — affected individuals must be told without delay, and the Board receives an initial notice and then a detailed report within 72 hours of awareness. A separate six-hour requirement to report to CERT-In is also noted.
- Retention and erasure — data must be erased once its purpose is served, which applies to chat histories, call recordings and training sets.
- Grievance handling — a process with a 90-day window before a complaint can go to the Board.
- Children's data — verifiable parental consent before processing, with some exemptions. Systems that may be used by minors need a plan.
None of this is specific to AI, but AI systems tend to collect more free-text personal data, keep more logs and pass data to more providers than traditional software. That makes them a good place to find compliance gaps early.
What to do now
- Map personal data flows — for each AI feature: what enters prompts, where it goes, who processes it and how long it is kept.
- Rewrite notices in plain words — and make consent and withdrawal as easy as the original sign-up.
- Set retention limits — for conversations, recordings and logs, with automatic deletion.
- Prepare a breach playbook — roles, contacts and templates, practiced before it is needed.
- Reduce what you send to models — minimize and redact personal data in prompts.
The phased dates give time to prepare, and most of the preparation is good engineering hygiene that customers already ask about. Starting the data map now is the single most useful step.