TL;DR — The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) in a Gazette issue dated 13 November 2025. The Rules fix periods, not calendar dates: consent-manager registration opens one year after Gazette publication, and the notice, consent, security, breach, rights, children’s-data and retention rules apply eighteen months after it — May 2027. The Press Information Bureau gives 14 November 2025 as the notification date, so plan for 13 May 2027, the earlier reading. If you buy software that holds customer data, you stay the data fiduciary and the accountability stays with you. Below are the questions to put to a vendor in writing before you sign, and how our own products answer them.
When do the DPDP obligations apply to my business?
In three stages. Rules 1, 2 and 17 to 21, which set up the Data Protection Board, took effect on publication, 13 November 2025. Rule 4 on consent managers takes effect one year after publication. Rules 3, 5 to 16, 22 and 23 — notice, security, breach, rights, children’s data, retention — take effect eighteen months after publication.
The Rules do not print a calendar date. Rule 1(4) says the substantive rules “shall come into force eighteen months after the date of publication of this Gazette”, and the Gazette issue carrying them (No. 760) is dated Thursday, 13 November 2025. Counted from that date, consent-manager registration opens on 13 November 2026 and the rest applies from 13 May 2027.
One caution on the date. The Press Information Bureau’s explainer of 17 November 2025 says the Rules were “notified on 14 November 2025”; counted from that date the periods end on 14 November 2026 and 14 May 2027. The difference is a day; plan for 13 May 2027, the earlier reading, and treat it as the deadline for the work, not the date to begin it.
The Act itself commences on the same three periods. Its commencement notification, G.S.R. 843(E) of 13 November 2025, brings the Board and definitions into force on publication, section 6(9) and section 27(1)(d) one year later, and the obligations in sections 3 to 17 and the penalty provisions eighteen months later.
What does a compliant consent notice look like?
Under Rule 3 the notice stands alone, is understandable without any other document, and gives in clear and plain language an itemised description of the personal data, the specified purpose and the goods or services enabled, plus the link and means to withdraw consent, exercise rights and complain to the Board. Consent itself must be a clear affirmative action.
Section 6(1) of the Act sets the standard for the consent: “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, limited to the personal data necessary for the specified purpose. A pre-ticked box is not an affirmative action, and a consent bundled into a terms-of-service click is not specific. The Act’s own illustration is a telemedicine app that asks for the phone contact list: the consent is valid for the consultation and void for the contacts.
Rule 3(c)(i) adds a test that software either passes or fails: withdrawing consent must be as easy as giving it. If a vendor captures consent with one tap and withdraws it with an email to support, the notice is not compliant.
What must happen if there is a data breach?
Rule 7 sets two clocks. Each affected person must be told without delay what happened, the likely consequences, the mitigation taken, what they can do and whom to contact. The Board must get a description without delay and, within seventy-two hours of becoming aware, a detailed report — longer only if the Board allows it on a written request.
The seventy-two-hour report has six parts: updated and detailed information on the breach, the broad facts and reasons that led to it, the mitigation implemented or proposed, any findings about who caused it, the remedial measures against recurrence, and a report on the intimations sent to affected people. The Rule applies to “any personal data breach”; it sets no harm threshold below which reporting can wait.
The Schedule to the Act puts a ceiling of ₹200 crore on a failure to notify the Board or affected people, and ₹250 crore on a failure to take reasonable security safeguards. The runbook therefore has to exist before the incident, and the vendor’s contract has to oblige it to tell you within hours, not at the next review.
What security controls does the law expect from my software?
Rule 6 lists the minimum: personal data secured through encryption, obfuscation, masking or virtual tokens; access controls on the systems holding it; logs, monitoring and review to detect and investigate unauthorised access; backups so processing continues after a loss; those logs and the personal data retained for one year; and a contract binding the data processor to the same safeguards.
Every one of those items is checkable in a product demo or a vendor’s written answer. Encryption at rest is either present or absent. An audit log is either tamper-evident or editable. A backup either has a tested restore or it does not. The vendor is your data processor under the Act, and Rule 6(1)(f) makes the contract between you the place where the safeguards are pinned down.
Two more Rules shape the day-to-day. Rule 14(3) requires a published grievance system that responds within a period not exceeding ninety days. Rule 13 applies only to a Significant Data Fiduciary, a class the government notifies, and adds an annual impact assessment and audit, a due-diligence check on algorithmic software, and government-specified data kept inside India.
What should I ask a software vendor before signing?
Seven questions, each tied to the Rule it comes from, and each answerable with a yes, a no, or a document. Ask for the answers in email rather than on a call, keep the email with the contract, and treat a vendor who will not put a control in writing as a vendor who does not have it.
- Is personal data encrypted at rest, and how does search still work? (Rule 6(1)(a))
- Is there an audit log, and can an administrator edit or delete entries? (Rule 6(1)(c))
- Is consent captured per purpose, versioned, and withdrawable as easily as it was given? (Rule 3; section 6)
- How and how fast will you tell us about a breach, and is that in the contract? (Rule 7; Rule 6(1)(f))
- Can we export all our data at any time, including after we stop paying? (section 8(7) erasure; your own continuity)
- Where do data and backups sit, and is a tested restore in place? (Rule 6(1)(d); Rule 15)
- Which features use a language model today, and which are planned? (see the next two sections)
Two further questions belong in the same email even though no Rule names them: the published price of the plan you are comparing, with GST treatment, and any certificate held, with its scope statement.
Which of these controls do Vedatricks products have today?
The table below answers the seven questions for our own products from the code and each product’s public pricing page, as they stood on 22 September 2026. A “not listed” cell means the control is not in the product’s published feature or security list; it is not a yes.
DPDP-relevant controls in Vedatricks products, as of 22 September 2026
| Question | Clinitricks | HamaraPG | Biztricks |
|---|---|---|---|
| Personal data encrypted at rest | Yes — AES-256 on patient health information, with blind indexes so search still works | No | No database encryption at rest; team chat has optional end-to-end encryption |
| Tamper-evident audit log | Yes — append-only, hash-chained | No general audit log; agreement acceptances are logged with time and IP, and every copilot turn is recorded | Activity trail on leads; no hash-chained log listed |
| Consent versioned and re-obtainable | Yes — four consent types, versioned, captured through a link | Not listed | Not listed |
| Two-factor sign-in | TOTP with backup codes | No | Not listed |
| Full data export | The pricing page says “cancel anytime and export everything”; not in the code-verified fact sheet | Not listed | Full JSON export; export stays available on a lapsed plan |
| Language-model features | Planned; not in the product today. The pricing page says “AI Assistant — launching soon” | Live — a read-only owner copilot; every turn audited, monthly token cap per organisation | Planned; not in the product today. The “Smart Insights” cards are a rule-based engine, not AI |
| Certification held | None | None | None |
| Published entry price, ex-GST | Standard ₹599/month, or ₹5,988/year (₹499/month effective) — clinitricks.com/pricing | Free to start; Pro from ₹15 per bed per month billed yearly, ₹20 monthly — hamarapg.com | Starter ₹599/month, or ₹5,999/year — biztricks.vedatricks.com |
Prices are each product’s own published figures on the date shown and exclude GST. Re-read the pricing page before you sign; this table is re-checked only when the date above changes.
Do AI features change anything?
The DPDP Rules do not mention AI; two other instruments do. The IT Rules amendment of February 2026 requires intermediaries to label synthetically generated content clearly and prominently, and the India AI Governance Guidelines of November 2025 ask industry to publish transparency reports and provide grievance redressal — as voluntary measures. Ask a vendor what its AI does today.
The amendment to the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 was notified on 10 February 2026 and came into force on 20 February 2026. Its labelling and takedown duties fall on intermediaries — platforms that host user content — rather than on a clinic or a PG using a management app. The Guidelines rest on voluntary measures and existing law; their line for industry is to comply with Indian law, adopt voluntary frameworks, publish transparency reports, provide grievance redressal and mitigate risk with techno-legal tools.
Within the DPDP Rules themselves, the one AI-specific duty is Rule 13(3): a Significant Data Fiduciary must verify that the algorithmic software it uses is not likely to pose a risk to data-principal rights. For everyone else, the practical rule is the one in the table above. If a product answers your customers with a language model, your customers should be told, and the vendor should be able to say what the model can read, what it can change, and what is logged. In our products that is one live feature: the HamaraPG owner copilot, which is read-only and audited on every turn. The Clinitricks and Biztricks assistants are planned; neither is in the product today.
What else applies besides DPDP?
If you sell through a digital platform, rule 4 of the Consumer Protection (E-Commerce) Rules, 2020 requires your legal name, address and grievance officer, a complaint acknowledged within forty-eight hours and redressed within one month. Rule 3(2) of the IT Rules, 2021 sets twenty-four hours to acknowledge and fifteen days to resolve, with seventy-two hours for certain removal requests.
The two regimes overlap, and the cheapest path is to meet the stricter number in each pair: acknowledge in twenty-four hours, resolve in fifteen days, and publish one grievance officer whose name and contact details satisfy both rules. The same officer can be the point of contact the DPDP Rules require for questions about personal data.
Sources
- Digital Personal Data Protection Rules, 2025 — G.S.R. 846(E), Gazette of India Extraordinary, Part II, Section 3(i), No. 760, dated 13 November 2025. Rules 1(2)–(4), 3, 6, 7, 13, 14 and 15 quoted above. MeitY copy, read 22 September 2026.
- Commencement of the Digital Personal Data Protection Act, 2023 — G.S.R. 843(E), 13 November 2025. Gazette extract mirrored at dpdpa.in, read 22 September 2026.
- Digital Personal Data Protection Act, 2023 — sections 6(1), 8(6)–(7), 16, 17(3) and the Schedule. MeitY copy, read 22 September 2026.
- “DPDP Rules, 2025 Notified” — Press Information Bureau explainer, 17 November 2025 (notification date as stated by PIB; penalty ceilings; ninety-day response window). PIB PDF, read 22 September 2026.
- India AI Governance Guidelines — Ministry of Electronics and Information Technology, November 2025. PIB copy, read 22 September 2026.
- “India targets deepfakes and AI-generated content: key changes under MeitY’s 2026 amendments to the IT Rules” — Freshfields, 20 February 2026 (notification 10 February 2026; in force 20 February 2026). Freshfields, read 22 September 2026.
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(2)(a) — MeitY consolidated text updated 6 April 2023. MeitY PDF, read 22 September 2026.
- Consumer Protection (E-Commerce) Rules, 2020, rule 4(2), 4(4) and 4(5). consumerprotection.in, read 22 September 2026.
- Product prices and controls: clinitricks.com/pricing, hamarapg.com and biztricks.vedatricks.com, read 22 September 2026; security and AI status from the code-verified product fact sheet of 5 September 2026.