Data protection · compliance from 13 May 2027 · cyber cover
The DPDP Act and Cyber Insurance
The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, and the obligations that change how a business runs day to day apply from 13 May 2027. Any business holding customers' or employees' personal data in digital form is in scope, whatever its size. This page sets out what the law asks, what a breach costs under it, and where insurance fits.
Key takeaways
- The DPDP Rules, 2025 were notified on 14 November 2025. Notices, security safeguards, breach intimation and erasure obligations apply from 13 May 2027, eighteen months on.
- After a personal data breach, a business must tell the Data Protection Board and every affected person without delay, and file a detailed report with the Board within 72 hours of becoming aware of it.
- The Act's schedule sets penalties of up to 250 crore rupees for failing to take reasonable security safeguards, and up to 200 crore rupees for failing to notify a breach. They are per instance, not an annual cap.
- Cyber insurance pays for the response to a breach and for claims by the people affected. Whether a DPDP penalty itself can be insured is untested in India; policies cover penalties only where the law allows it.
- Insurers now ask how data is protected before they quote, so the compliance work and the insurance proposal are largely the same exercise.
What the law asks of an ordinary business
The Act calls a business that decides why and how personal data is processed a data fiduciary. A shop with a customer database, a clinic with patient records, a factory with an HR and payroll system and a hotel with guest registers are all data fiduciaries for the personal data they hold digitally.
From 13 May 2027 a data fiduciary must give a clear notice when it collects personal data, process it only for the purpose given, take reasonable security safeguards to protect it, report breaches, and erase data once the purpose is served unless the law requires it to be kept. The Rules spell out what the safeguards include: encryption, masking or tokenisation of the data, control over who can access it, logs that show access, and backups so processing can continue after an incident.
None of this depends on turnover. The obligations that apply only to the largest processors, designated significant data fiduciaries, sit on top of these, not instead.
What a breach costs now
Before the Act, a small business that lost customer data faced mainly the cost of fixing its systems and whatever claims followed. From May 2027 it also faces a duty to report within fixed times, and a penalty schedule in which the two largest heads are failing to take reasonable safeguards, up to 250 crore rupees, and failing to notify, up to 200 crore rupees.
The Data Protection Board decides the amount in each case and the Act directs it to consider the nature, gravity and duration of the breach and what the business did to mitigate it. Those maximums are not what a small firm should expect to pay. The point is that the two failures the law punishes hardest are the two a prepared business can show it did not commit: it had safeguards, and it reported on time.
The response itself is the cost most firms underestimate: forensic investigators to establish what was taken, lawyers to decide what must be notified and to whom, the notifications themselves, restoring systems, and the trading lost while that happens.
Where cyber insurance fits
A cyber policy is built around that response. It typically pays for incident response and forensics, legal advice on notification, notifying affected people, restoring data and systems, the loss of income while systems are down, claims brought by the people whose data was exposed, and the cost of responding to a regulator's investigation.
Penalties are the open question. Indian cyber wordings cover fines and penalties only where they are insurable under Indian law, and no ruling yet settles whether a penalty imposed by the Data Protection Board is. Buy the cover for the response and the liability, which are certain, and treat any penalty cover as uncertain until the question is decided.
The more useful link runs the other way. A cyber proposal form now asks about encryption, access control, backups, multi-factor authentication and incident response plans, which is close to the DPDP safeguards list. Completing one honestly is a reasonable first audit of where a business stands.
A sensible order of work before May 2027
Find the personal data: what is held, where, by whom and why. Most small businesses discover copies in places nobody planned, such as old spreadsheets, staff phones and vendor systems.
Fix the safeguards the Rules name, starting with access control and backups, which also decide most cyber claims. Write down who decides, within hours, whether an incident is a notifiable breach, because a 72-hour report cannot wait for a meeting.
Then place cyber cover against the risk you now understand, with the insurer's breach response panel agreed in advance so that the first call after an incident goes to people already appointed.
Frequently asked questions
When does the DPDP Act apply to my business?
The DPDP Rules, 2025 were notified on 14 November 2025. The provisions setting up the Data Protection Board took effect at once, and the obligations on notices, security safeguards, breach intimation and erasure apply from 13 May 2027.
Does the DPDP Act apply to small businesses?
Yes. It applies to any business that processes digital personal data of individuals, whatever its size. Additional duties apply to the largest processors designated as significant data fiduciaries, but the core obligations apply to everyone.
How quickly must a data breach be reported under the DPDP Rules?
The business must inform the Data Protection Board and each affected person without delay, and give the Board a detailed report, covering what happened and what was done about it, within 72 hours of becoming aware of the breach.
What is the maximum penalty under the DPDP Act?
Up to 250 crore rupees for failing to take reasonable security safeguards to prevent a breach, and up to 200 crore rupees each for failing to notify a breach and for breaching the obligations on children's data. The Board sets the actual amount case by case.
Does cyber insurance cover DPDP penalties?
Only where a penalty is insurable under Indian law, and that has not yet been decided for penalties imposed by the Data Protection Board. Cyber insurance does cover the breach response, notification costs, restoring systems, lost income and claims by the people affected, which are usually the larger costs for a small business.
Is cyber insurance mandatory under the DPDP Act?
No. The Act requires reasonable security safeguards and breach reporting, not insurance. Cyber insurance is how a business pays for the consequences when a breach happens anyway.
Related: Cyber insurance · Cyber insurance for IT companies · Professional indemnity · Checklists by trade