DPDP Rules timeline: what AI calls and chatbots need to be ready for by May 2027
The DPDP Rules, 2025 were notified on 13 November 2025 and take effect in three stages. The Data Protection Board rules applied at once. Consent manager registration starts one year later, in November 2026. Most duties for businesses, including consent notices, security safeguards, breach reporting, retention and grievance handling, start eighteen months after notification, in May 2027.
- Rules 1, 2 and 17 to 21 applied on 13 November 2025; Rule 4 on consent managers applies one year later.
- Rules 3, 5 to 16, 22 and 23, which carry most business duties, apply eighteen months after notification.
- A consent notice must stand on its own, use clear and plain language and itemise the personal data and purpose.
- Breaches go to affected people without delay and a detailed report to the Board within 72 hours.
- MeitY consulted in January 2026 on shortening the 18 months to 12, so watch for an amending notification.
The three dates to put in your calendar
The Digital Personal Data Protection Rules, 2025 were published in the Gazette of India as G.S.R. 846(E), dated 13 November 2025. Rule 1 sets out when each part comes into force. This page reads from that Gazette text and is general information, not legal advice.
| When | What starts |
|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21: title, definitions and the Data Protection Board |
| One year later (November 2026) | Rule 4: registration and obligations of consent managers |
| Eighteen months later (May 2027) | Rules 3, 5 to 16, 22 and 23: notice, security, breach intimation, retention, rights and more |
One change is possible. In January 2026 MeitY asked industry for views on cutting the eighteen months to twelve, with feedback due by 4 February 2026. Officials said no final decision had been taken. We have not found an amending notification as on 21 October 2026, but check MeitY's announcements before you plan around May 2027.
What a consent notice has to say (Rule 3)
Every AI chat or call that collects personal data starts with a notice. Rule 3 says the notice must:
- be understandable on its own, without depending on other documents;
- use clear and plain language;
- give an itemised description of the personal data you collect;
- state the specific purpose, and the goods, services or uses it enables;
- give a link to your website or app, and any other means, by which the person can withdraw consent as easily as they gave it, exercise their rights and complain to the Board.
For a WhatsApp bot, that can be one short message before the first question, with a link. For an AI call, a long spoken notice does not work. A practical pattern is a one-line spoken summary, followed by the full notice sent on WhatsApp or SMS straight after.
Consent itself comes from the Act: it must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. A customer saying "haan" to an unclear question is weak evidence.
Security, logs and breach reporting (Rules 6 and 7)
Rule 6 lists reasonable security safeguards: encryption or masking, access control, logs and monitoring to detect unauthorised access, backups for continuity, and contract terms with your data processors. It also says logs and personal data kept for this purpose should be retained for one year, unless another law says otherwise.
For an AI agent, your processors include your messaging, telephony and AI providers, and your chatbot platform. Keep a simple list of who handles what.
Rule 7 covers breaches. You must tell each affected person, without delay, what happened, the likely consequences, what you are doing and what they can do. The Board gets a description without delay and a detailed report within 72 hours of you becoming aware, unless it allows longer on written request.
The Act's schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, so this is not a box to tick later.
Retention, rights and grievances (Rules 8 and 14)
- Minimum retention of logs. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from the processing, then erased unless another law needs longer.
- Erasure for large platforms. The Third Schedule sets fixed erasure periods for certain large e-commerce, gaming and social media platforms, with a 48-hour warning before erasure. Most SMBs are not in those classes.
- Publishing how to exercise rights. Rule 14 says you must publish, on your website or app, how a person can request their rights and what identifier you need from them.
- Grievance timeline. You must publish, and keep to, a response period of not more than ninety days for grievances.
A chatbot can carry much of this. A "my data" keyword can explain the request process, collect the request and pass it to a person.
Consent managers from November 2026
A consent manager is a Board-registered platform through which people give, manage and withdraw consent across businesses. Under the First Schedule, an applicant must be a company incorporated in India with a net worth of at least ₹2 crore, among other conditions.
You do not need to become one. What may change is that some customers will start managing consent through a registered consent manager, so your process should accept a withdrawal from any channel the customer uses.
Getting your AI calls and chatbots ready on Convo360
Convo360 gives you the controls; you remain the business responsible for how you use data. A sensible order of work before May 2027:
- Write a plain-language notice and add it as the first Send Message block in each chat flow, with a link to your privacy page.
- Capture consent with Buttons or a Show Form checkbox and store it with Set Variable or Save CRM lead.
- For voice, add a short spoken line to the agent's first message and send the full notice by WhatsApp after the call.
- Honour withdrawal: STOP keywords add the contact to DND, and campaigns skip DND numbers.
- Use Audit Logs and stored transcripts as your record, and keep the list of providers your agents use.
Provider keys are encrypted at rest, and databases and media are backed up nightly. For the basics of consent in a bot, see chatbots and the DPDP Act and the compliance docs.
Example conversation
Build consent into every flow and call
Start free in minutes — no code, no credit card. Bring your own AI keys and pay no per-message markup.
Frequently asked questions
When do the DPDP Rules apply to my business?
Most business duties are in Rules 3, 5 to 16, 22 and 23, which come into force eighteen months after the Rules were published on 13 November 2025, so in May 2027. MeitY has consulted on shortening this, so watch for any amendment.
What must a DPDP consent notice contain?
Under Rule 3 it must be understandable on its own, in clear and plain language, itemise the personal data and state the specific purpose. It must also link to how the person can withdraw consent, exercise their rights and complain to the Board.
How quickly must a data breach be reported?
Rule 7 says you must inform affected people without delay and send the Board a description without delay. A detailed report goes to the Board within 72 hours of becoming aware, unless the Board allows a longer period on written request.
What is a consent manager under DPDP?
A consent manager is a platform registered with the Data Protection Board that lets people give, manage and withdraw consent. Rule 4 applies from November 2026, and applicants must be Indian companies with a net worth of at least ₹2 crore.
Does an AI phone call need a consent notice?
If the call collects or uses personal data on the basis of consent, the notice rules apply from May 2027 like any other channel. A short spoken line followed by the full written notice on WhatsApp or SMS keeps calls brief and the record complete.
Is this article legal advice?
No. It summarises the DPDP Rules as published in the Gazette on 13 November 2025 and reports on MeitY's January 2026 consultation. Have a qualified professional review how the Act and Rules apply to your business.
Official sources
- Gazette of India: Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (13 November 2025)
- EY India: The DPDP Act, 2023 and Rules, 2025, overview including penalties (November 2025)
- Storyboard18: MeitY seeks views on a 12-month DPDP compliance timeline (news report, 28 January 2026)
Related reading
Available across India — see WhatsApp & AI calling automation by state and city.