DPDP Countdown: SBI Targets December. Is Your Organisation Ready for May 2027?
India's largest bank says it will be DPDP compliant five months early. The Rules name specific security safeguards and set a 72-hour breach report to the Board. Here is what that means for your security stack.
By Intellinative Research Team ·
Key takeaways
- The DPDP Rules 2025 (G.S.R. 846(E)) were notified on 13 November 2025. Consent-manager rules apply from about 13 November 2026, and the core obligations from about 13 May 2027.
- Rule 6 names encryption, masking or tokenisation, access control, logging and monitoring, and backups. Logs must be kept for at least one year.
- A personal data breach must be reported to affected people without delay, and in detail to the Data Protection Board within 72 hours. CERT-In's separate 6-hour reporting rule still applies.
- The maximum penalty is ₹250 crore for failing to keep reasonable security safeguards, and ₹200 crore for failing to notify a breach.
- An EY survey in January 2026 found that 83% of organisations had not started full implementation. SBI's December target shows the leaders are moving now.
India's largest bank is moving early. Most organisations are not.
On 11 September 2026, Business Standard reported that SBI aims to be fully compliant with the Digital Personal Data Protection (DPDP) Act by December 2026. A senior official said: "Procurement of software is done and the deployment will be completed by December for DPDP compliance." The statutory deadline is May 2027.
Other organisations are further behind. In an EY survey of 150+ professionals published in January 2026, 48% had started gap assessments, 81% had not updated their privacy policies and 83% had not started full implementation. Financial services was the furthest ahead, with 34.7% having started compliance work, against 9.9% in healthcare.
- 83% of organisations had not started full DPDP implementation (EY India, Jan 2026)
- 72 hrs to send the detailed breach report to the Data Protection Board (DPDP Rules, Rule 7)
- 1 year minimum retention for processing logs, against CERT-In's 180 days (DPDP Rules, Rule 6(1)(e))
- ₹250 cr maximum penalty for failing to keep reasonable security safeguards (DPDP Act, Schedule)
Three commencement dates, one already passed
- 11 Aug 2023 · DPDP Act enacted The Digital Personal Data Protection Act, 2023 received assent (PIB).
- 13 Nov 2025 · Rules notified; Board provisions in force The DPDP Rules 2025 (G.S.R. 846(E)) were published in the Gazette. Rules 1, 2 and 17–21, which cover the Data Protection Board, took effect on publication (Rule 1).
- ~13 Nov 2026 · Consent managers Rule 4 takes effect one year after publication. Consent managers must be Indian companies with a net worth of at least ₹2 crore (First Schedule). A law-firm note says the Board's portal is expected to go live before then (Mondaq, 24 Sep 2026).
- ~13 May 2027 · Core obligations Rules 3, 5–16, 22 and 23 take effect after 18 months. They cover notice, security safeguards, breach intimation, data retention, data principal rights and the duties of significant data fiduciaries.
What Rules 6, 7, 8 and 13 mean for your security architecture
| DPDP obligation | What the text says | Control that meets it |
|---|---|---|
| Rule 6 · Safeguards | Securing personal data through encryption, masking or tokenisation | KMS-backed encryption at rest and in transit. Tokenisation for identifiers such as Aadhaar, PAN and account numbers. Masking in non-production environments. |
| Rule 6 · Access | Measures to control access to the computer resources used for processing | Central identity provider, MFA, RBAC and least privilege, privileged access management, and quarterly access reviews. |
| Rule 6 · Monitoring | Appropriate logs, monitoring and review to detect unauthorised access | SIEM with alerting on personal data stores. Detection of unusual bulk reads or exports. |
| Rule 6(1)(e) · Retention | Logs and personal data kept for a minimum of one year | Tiered log storage. Keep one year of personal data logs, plus 180 days in India for CERT-In. |
| Rule 6 · Continuity | data backup | Immutable, tested backups and a documented restore procedure. |
| Rule 7 · Breach | Notify affected people without delay. Detailed report to the Board within 72 hours | Incident runbook that sends one event down three reporting paths (CERT-In 6h, sector regulator, DPDP Board 72h), with pre-approved notification templates. |
| Rule 13 · SDFs | DPIA and audit once every twelve months | Annual DPIA calendar, independent audit, and due diligence on the algorithms and technology in use. |
One incident, three clocks
| Report to | Deadline | Trigger |
|---|---|---|
| CERT-In | 6 hours from noticing | Covered cyber incidents (Directions, Apr 2022) |
| RBI (DAKSH) · SEBI · IRDAI · PFRDA | 6 hours (SEBI portal filing within 24 hours) | Sector rules. See our SEBI and RBI briefings |
| Affected data principals | Without delay | Personal data breach (Rule 7) |
| Data Protection Board | Detailed report within 72 hours | Personal data breach (Rule 7) |
Penalties are per instance, and security failures carry the highest one
| Breach of obligation | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board or affected people of a breach | ₹200 crore |
| Breach of additional obligations for children's data | ₹200 crore |
| Breach of additional obligations of a significant data fiduciary | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of a data principal's own duties | ₹10,000 |
The top two penalty lines are security failures, not privacy-notice failures. A company with an excellent consent flow and weak encryption, access control or monitoring is still exposed to the largest fine. That is why DPDP programmes need the CISO involved as much as the DPO.
A readiness plan that finishes before May 2027
Do before 31 December 2026
- Build a personal data inventory and data-flow map across applications, SaaS, data lakes and backups
- Classify processors and update contracts with DPDP security and breach-notification clauses
- Close Rule 6 gaps: encryption coverage, tokenisation of key identifiers, MFA everywhere, logging to a SIEM
- Extend retention for personal data processing logs to at least one year
- Write and rehearse a breach runbook covering the 6-hour and 72-hour clocks
Do before 13 May 2027
- Deploy notices and consent flows. Decide whether to integrate a registered consent manager
- Set up data principal rights workflows (access, correction, erasure, grievance) with service levels
- Configure retention and erasure schedules
- If you may be designated an SDF: complete the first DPIA and independent audit
- Train the board and run a tabletop exercise
Intellinative runs DPDP compliance management together with cloud security engineering, so the control mapping above is built into the infrastructure rather than only written into policy. See how we built identity, segmentation and monitoring for a taxpayer-data platform, or talk to our team about a DPDP gap assessment.
Frequently asked questions
When do DPDP obligations take effect?
The Board provisions took effect on 13 November 2025, when the DPDP Rules 2025 were notified. Consent-manager rules apply from about 13 November 2026. The core obligations (notice, security safeguards, breach intimation, retention and rights) apply from about 13 May 2027.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore per instance for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach can cost up to ₹200 crore.
How quickly must a personal data breach be reported under DPDP?
Affected data principals must be told without delay. A detailed report must reach the Data Protection Board within 72 hours of becoming aware of the breach. CERT-In's separate 6-hour cyber incident reporting rule still applies.
What security safeguards do the DPDP Rules require?
Rule 6 names encryption, masking or tokenisation of personal data; controls on access to computer resources; logs, monitoring and review; data backups; and retention of logs and personal data for at least one year for detection and investigation.
What extra duties do significant data fiduciaries have?
An annual data protection impact assessment and audit, due diligence on the technology and algorithms they use, and possible restrictions on transferring certain data outside India.
Is the Data Protection Board operational?
It exists in law and works as a digital office. As of August 2026 no Chairperson or Members had been appointed, according to LiveLaw. MeitY sought applications in May and June 2026.
Sources
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) · MeitY / Gazette of India · 13 Nov 2025
- Digital Personal Data Protection Act, 2023 · MeitY · 11 Aug 2023
- Government notifies DPDP Rules · PIB · 14 Nov 2025
- DPDP Rules explainer · PIB · Nov 2025
- Vacancy: Chairperson and Members, Data Protection Board · MeitY · 6 May 2026
- CERT-In Directions under Section 70B(6) · CERT-In · 28 Apr 2022
- SBI aims for DPDP compliance by December, ahead of May 2027 deadline · Business Standard · 11 Sep 2026
- SBI to complete software, hardware deployment for DPDP compliance by Dec · Business Standard · 11 Sep 2026
- India's Data Protection Board: Established in Law, Absent in Fact · LiveLaw · 1 Aug 2026
- DPDP Consent Manager Framework · Mondaq / MC Maheshwari & Co · 24 Sep 2026
- India's data privacy shift: steering DPDP compliance and readiness · EY India · 27 Jan 2026
- Human oversight will remain critical even as banks embrace AI: RBI Governor · Business Today · 11 Aug 2026