The DPDP Rules are law. The 18-month countdown has started.

The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules on 13 November 2025. The provisions establishing the Data Protection Board took effect at once. Consent-manager registration applies after twelve months. The bulk of the obligations, covering notice, security safeguards, breach notification, retention and erasure, and verifiable parental consent, apply eighteen months after publication, in May 2027.

Five things to do before the deadline

• Inventory personal data: what you collect, why, where it sits and who can see it.
• Re-write notices so that consent is specific, informed and easy to withdraw.
• Test security safeguards against the way data is really handled, including by vendors.
• Build a breach-response playbook with forensic readiness, so you can establish what was taken and notify on time.
• Set retention and erasure rules and evidence that they are followed.

Where investigations meet privacy

Data protection does not stop investigations. It changes how they are run. Device imaging, email review and background checks all process personal data, and each must rest on a lawful basis, be proportionate and be documented. BDI designs investigation protocols that meet the evidential standard and the privacy standard at the same time.

The same discipline is spreading regionally: the UAE's Personal Data Protection Law awaits its executive regulations, and organisations operating across both markets should design one programme that satisfies the stricter of the two.