India's DPDP Rules: what the deadlines mean for document handling

India's Digital Personal Data Protection Act, 2023, is being brought into force in stages by the Digital Personal Data Protection Rules, 2025. For firms that handle KYC packs, loan files, HR records or client documents, the timeline matters. This post summarises the dates and what they mean in practice. It isn't legal advice, so confirm the details against the official notification.

The timeline

The Ministry of Electronics and Information Technology notified the Rules on 13 November 2025, as SCC Online reported. They take effect in three steps:

1. November 2025: provisions setting up the Data Protection Board took effect immediately.
2. November 2026: provisions on registering consent managers come into force one year after notification.
3. Around May 2027: most obligations for organisations that handle personal data, such as notices, security safeguards, breach reporting and retention, apply 18 months after notification.

What it means for documents

Most firms' personal data lives in documents: scanned IDs, statements, forms, contracts and spreadsheets. A few practical steps make the 2027 obligations easier to meet:

• Know where documents go. Map which documents are sent to vendors, partners, lenders or regulators, and whether they need everything in them.
• Share less. Redact identifiers that the recipient doesn't need, such as most of an Aadhaar number, PAN or account number. See how to mask an Aadhaar number on any document.
• Avoid unnecessary uploads. Sending documents to third-party online tools to process or redact them adds another place your data lives. See online redaction tools: what happens to your file.
• Watch hidden content. Spreadsheets and Office files carry hidden data; see hidden tabs and rows.
• Keep a record of what you shared and what you removed, so you can answer questions later.

Where Ombly fits

Ombly runs on your own computer or your firm's servers. It detects Aadhaar numbers (checked against their checksum), PAN, IFSC, account and card numbers and names, lets a reviewer accept each suggestion, and exports a copy rebuilt from pixels, with an audit trail for teams. Book a call to see it with your documents.