The short answer
India notified the Digital Personal Data Protection Rules in November 2025, and they phase in over 18 months. Most duties for businesses apply from around May 2027. If you collect customer phone numbers, start now: say clearly why you’re asking, keep a record of who said yes, and make it easy to say no.
Key takeaways
- The DPDP Rules were notified in November 2025 and roll out over 18 months.
- Most business duties apply from around May 2027.
- Ask clearly, record the yes, and remove anyone who asks.
- 01What was notified
- 02The dates to know
- 03What to do with your customer list now
- 04This is not legal advice
What was notified
The Digital Personal Data Protection Rules, 2025 were notified in November 2025. The government’s press note says they come into force in stages over 18 months.
The dates to know
Rules on consent managers take effect around November 2026. Most other duties follow around May 2027. A proposal to shorten the timeline to 12 months has been reported, but as of 10 October 2026 we haven’t seen it notified.
What to do with your customer list now
Ask for a number with a clear reason, like “for your bills and offers on WhatsApp”. Keep a record of who said yes. Remove anyone who asks you to. Reten only messages customers who opted in.
This is not legal advice
This is a plain summary for owners. For your own business, check with a lawyer or your CA.
Sources
Put it to work.
See who’s due for this one in your own Reten.
Written by the Reten editorial team. General guidance, not legal advice: check consent and messaging rules for your business before you send.
