India's Digital Personal Data Protection Rules were notified in November 2025, and with them the speculation phase ended. Every organisation handling Indian personal data is now a Data Fiduciary with a defined runway: full compliance by 13 May 2027, and penalties that reach ₹250 crore per breach. The organisations that treat the interim as a build period — rather than a grace period — will be the ones that clear it without a scramble.
What actually changed in November
The Act had been law since 2023; the Rules made it operational. Consent artefacts, breach-notification timelines, retention behaviour and the machinery of data-principal rights moved from principle to specification. In practice, that converts DPDP from a legal-review problem into an engineering programme.
Compliance you cannot demonstrate on demand is compliance you do not have.
Who carries the exposure
The Fiduciary definition is broad by design. If your systems decide the purpose and means of processing Indian personal data — customers, employees, vendors — the obligations attach, regardless of where you're headquartered or hosted. Processors inherit duty through contract, which is why vendor governance appears in every serious readiness framework.
The four capabilities to build first
Across readiness engagements, sequencing matters more than tooling. The order that works:
- Discovery — you cannot protect or delete what you cannot find. Map personal data across systems and flows before anything else.
- Consent — capture, manage and honour it, with proof. Cosmetic banners that don't gate processing fail the first audit question.
- Retention — define it, then make systems actually enforce it. Indefinite storage is now a liability with a price tag.
- Rights operations — access, correction and erasure requests need a workflow with clocks, not an inbox.
Why this lands on the security team
DPDP is nominally a privacy regime, but its enforcement surface is technical: encryption posture, access control, logging, breach detection and response timelines. The CISO inherits the delivery whether or not the mandate letter says so. Treating DPDP as an extension of the security programme — not a parallel legal project — is the pattern that ships on time.
Xploreteq runs DPDP readiness as an operational framework — discovery through rights operations — under the same team that runs your security controls. See the framework, or start with an assessment.