DPDP and CERT-In obligations by date.
Planning for the Digital Personal Data Protection (DPDP) Rules or CERT-In's direction on logs starts with their dates. Here they are in order, each from the instrument itself. Each is stated as a date, never as a countdown, so you can check it against the source.
Dates set by the instruments
| Date | Instrument | What it sets |
|---|---|---|
| 28 April 2022 | CERT-In Directions No. 20(3)/2022, issued on this date under section 70B(6) of the Information Technology Act | It requires all service providers, intermediaries, data centres, body corporate and Government organisations to enable the logs of all their ICT systems. They must keep the logs securely for a rolling 180 days, and keep them within Indian jurisdiction. |
| 13 November 2025 | The DPDP Rules 2025, published in the Gazette of India Extraordinary No. 760, G.S.R. 846(E) | An eighteen-month period for phased compliance begins. |
| 13 May 2027 | The DPDP Rules 2025 | The phased compliance period ends: the final compliance date the Rules give. |
The penalties are set by the Digital Personal Data Protection Act 2023. The highest, up to ₹250 crore, is for a Data Fiduciary's failure to maintain reasonable security safeguards.
Sources: Gazette of India Extraordinary No. 760, G.S.R. 846(E), 13 November 2025; Press Information Bureau, Government of India, ‘DPDP Rules, 2025 Notified’, for the penalties; CERT-In Directions No. 20(3)/2022 of 28 April 2022.
What Pramaan produces for these safeguards
Dates are the instruments'. Which evidence Pramaan produces for each safeguard, and what stays with you, is set out on DPDP and CERT-In.
Questions
Where do these dates come from?
From the instruments: the DPDP Rules as published in the Gazette of India Extraordinary No. 760, G.S.R. 846(E), and CERT-In Directions No. 20(3)/2022 of 28 April 2022.
When does the DPDP Rules' phased compliance period end?
On 13 May 2027: the Rules were published on 13 November 2025, with an eighteen-month phased period.
Why is there no countdown?
A countdown silently goes wrong if a date moves. A date can be checked against the instrument it comes from.
Does Pramaan make an organisation compliant?
No. Pramaan does not make your organisation compliant. DPDP and CERT-In sets out the evidence it produces for some safeguards.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.