AI Founders
If you're building an AI product in India, you're already a Data Fiduciary. Here's the clock you're on.
Most DPDP writing is aimed at enterprises with compliance teams. This is the version for people running small products.
WHERE THINGS STAND
The DPDP Rules 2025 were notified on 13 November 2025 via Gazette G.S.R. 846(E). That turned the 2023 Act into binding law with a running clock.
Three dates that matter:
Treating May 2027 as the only deadline. Implementation is phased and November 2026 is a real intermediate milestone — that's two months away.
Also worth knowing, and missing from most guides: a MeitY stakeholder consultation on 23 January 2026 proposed compressing the deadline from 18 months to 12. It has not been confirmed by gazette notification, so it may not happen. But planning for May 2027 with zero slack carries that risk.
WHY AI PRODUCTS HAVE IT HARDER
Routing user data through a third-party LLM API doesn't transfer the obligation. You're still the Data Fiduciary — you've just added a processor relationship you need to be able to evidence.
Then the AI-specific parts: prompts and outputs kept for debugging are personal data if they contain any, retention schedules apply to your logs, and "reasonable security safeguards" is something you have to demonstrate rather than assert.
Not legal advice. I'm reading the same public material you can — check with someone qualified before making decisions.
Accurate as of 10 September 2026. This area is moving; I'll update in November.
Three questions:
WHERE THINGS STAND
The DPDP Rules 2025 were notified on 13 November 2025 via Gazette G.S.R. 846(E). That turned the 2023 Act into binding law with a running clock.
Three dates that matter:
- Now. The Data Protection Board of India exists and functions. A user can file a complaint against you today. There is no switch-on moment still coming.
- ~13 November 2026. Consent Manager registration closes. After that, unregistered entities can't operate as Consent Managers in India
- 13 May 2027. Full substantive compliance. Penalties run up to ₹250 crore per breach category, and they stack.
Treating May 2027 as the only deadline. Implementation is phased and November 2026 is a real intermediate milestone — that's two months away.
Also worth knowing, and missing from most guides: a MeitY stakeholder consultation on 23 January 2026 proposed compressing the deadline from 18 months to 12. It has not been confirmed by gazette notification, so it may not happen. But planning for May 2027 with zero slack carries that risk.
WHY AI PRODUCTS HAVE IT HARDER
Routing user data through a third-party LLM API doesn't transfer the obligation. You're still the Data Fiduciary — you've just added a processor relationship you need to be able to evidence.
Then the AI-specific parts: prompts and outputs kept for debugging are personal data if they contain any, retention schedules apply to your logs, and "reasonable security safeguards" is something you have to demonstrate rather than assert.
Not legal advice. I'm reading the same public material you can — check with someone qualified before making decisions.
Accurate as of 10 September 2026. This area is moving; I'll update in November.
Three questions:
- Has anyone here actually started, or is everyone waiting?
- If you're pre-revenue with 50 users, does this realistically apply to you — or is it an enterprise problem being marketed to startups?
- Anyone got a lawyer who handles this for small companies without enterprise rates?
Add your perspective
Sign in to comment, like, and build your reputation.