India’s Digital Personal Data Protection Rules, notified in November 2025, take effect in phases — and the next major milestone, Rule 4, lands on 13 November 2026, bringing notice-and-consent requirements and Significant Data Fiduciary obligations into force.
Rule 4 is the operative core of day-to-day DPDPA compliance: specific notice and consent…
SDF status is a government designation, not a self-assessment — based on factors including…
Appoint a Data Protection Officer based in India, responsible for compliance oversight.
Rule 4 is the operative core of day-to-day DPDPA compliance: specific notice and consent requirements, security safeguards, breach intimation procedures, data retention rules, cross-border transfer conditions, and the full set of obligations that apply if your organization is designated a Significant Data Fiduciary (SDF). Organizations that treated the November 2025 notification as the compliance deadline and haven’t revisited their programme since now have a hard, dated milestone to work against.
SDF status is a government designation, not a self-assessment — based on factors including the volume and sensitivity of personal data processed, risk to individuals’ rights, implications for India’s sovereignty and public order, and risk to electoral integrity. Organizations processing large volumes of data, or operating in sectors like fintech, healthtech, or large-scale consumer platforms, should treat SDF designation as a realistic possibility worth preparing for, not an edge case.
Revisit the data mapping and consent-mechanism work from your initial DPDPA readiness (see our DPDPA compliance checklist), specifically against Rule 4’s detailed requirements rather than the Act’s higher-level principles. If there’s a realistic chance of SDF designation, start the DPO appointment and independent-audit engagement conversations now — both take longer to stand up than the remaining runway suggests.
The government designates SDFs directly; there’s no public self-assessment checklist with a definitive threshold. Organizations with large user bases, sensitive data categories, or operating in flagged sectors should treat it as a real possibility and prepare proportionately rather than waiting for designation to start planning.
DPDPA applies to processing of digital personal data within India and to processing outside India connected to offering goods or services to individuals in India — so companies serving Indian users, regardless of where they’re headquartered, should assess applicability. Confirm specifics with counsel.
The Rules don’t specify a grace period beyond the phased effective dates already set. Given the Data Protection Board’s enforcement powers under the Act, the practical guidance is to treat the date as firm and prioritize the notice/consent and security safeguard requirements that apply broadly, even if full programme maturity takes longer.