# India's DPDP Rules 2025 for health apps: duties and dates

> What the DPDP Rules 2025 require of health and wellness apps: notice, consent, children's data, security, breaches and the 13 May 2027 deadline.

Regulation · Regions: India · By Yash Nerkar (BrandLabs) · Published 2026-11-14 · Reviewed 2026-11-14 · Source: https://www.brandlabs.app/learn/india-dpdp-rules-health-apps

**TL;DR:** The DPDP Rules were notified on 13 November 2025 and roll out in stages. Consent manager registration applies after one year, and most operational duties, including notice, security safeguards, breach reporting and children's consent, apply from 13 May 2027. Penalties for security failures reach ₹250 crore.

## Key takeaways

- The DPDP Rules were notified on 13 November 2025 and apply in stages.
- Rule 3 notice, Rule 10 children's consent and the other operational rules apply 18 months after notification, from 13 May 2027.
- Consent manager registration under Rule 4 applies one year after notification, from 13 November 2026.
- For users under 18, apps must obtain verifiable consent from a parent or guardian; healthcare providers have specific exemptions.
- Penalties for failing to take reasonable security safeguards reach ₹250 crore.

## When do the DPDP Rules apply?

The Rules were notified on 13 November 2025 with a staged rollout. Board-related rules applied immediately. Consent manager registration applies one year later. Most duties that health apps feel day to day apply 18 months after notification, from **13 May 2027**.

| Rule | What it covers | Applies from |
| --- | --- | --- |
| Rule 3 | Notice to users before collecting data | 13 May 2027 |
| Rule 4 | Consent manager registration | 13 Nov 2026 |
| Rule 6 | Reasonable security safeguards | 13 May 2027 |
| Rule 7 | Breach intimation to the Board and users | 13 May 2027 |
| Rule 8 | Erasure when the purpose ends | 13 May 2027 |
| Rule 10 | Verifiable consent for children's data | 13 May 2027 |

## What must a notice include?

A standalone, plain-language notice that itemises the personal data collected, the specific purpose, and how users can withdraw consent, exercise their rights and complain to the Data Protection Board. Withdrawing consent must be as easy as giving it.

## What changes for children's data?

Anyone under 18 is a child. Apps must verify that the person consenting is the parent or guardian, using reliable identity or age details, and must not track, behaviourally monitor or target ads at children. Healthcare providers and some other categories are exempt from parts of this when acting for the child's health or safety.

## What security does the Act expect?

Reasonable safeguards: encryption or masking, access controls, logging and monitoring of access, backups, and contracts that bind processors to the same standard. For AI products, that includes keeping names and phone numbers out of prompts and model logs.

## How should a health app prepare?

Map every place personal data flows, including chat transcripts, analytics and model providers. Rewrite the notice, record consent before any processing, add parental consent where minors can sign up, set retention limits, and rehearse a breach report. Start now: these changes touch onboarding, data models and vendor contracts.

## Frequently asked questions

### Do DPDP Rules treat health data as sensitive?

The DPDP Act does not create a separate sensitive category like GDPR. All personal data needs a lawful basis, usually consent, with notice. In practice, health data raises the stakes for security safeguards, breaches and children's data.

### Can a health app process a teenager's data?

Users under 18 are children under the Act. Apps need verifiable consent from a parent or guardian and may not track or behaviourally monitor children, subject to exemptions that include healthcare providers in specific conditions. Confirm the exemption scope against the notified text.

### What happens if we have a breach?

You must inform the Data Protection Board and every affected user without delay, with details of the breach, its likely impact and the steps taken. The Rules set out what the intimation must contain and a fuller report within 72 hours.

## Where BrandLabs fits

A Private-by-design sprint builds DPDP notice, consent, log redaction and breach workflows into your product before 13 May 2027. https://www.brandlabs.app/services#private-by-design

## Sources

- Digital Personal Data Protection Rules, 2025, Ministry of Electronics and IT, India, 2025-11-13: https://www.meity.gov.in
- Insight brief on DPDP Rules, Data Security Council of India, 2025: https://www.dsci.in/files/content/knowledge-centre/2025/Insight-Brief-on-DPDP-Rules.pdf
- Digital Personal Data Protection Rules 2025: key highlights, SCC Online, 2025-12-26: https://www.scconline.com/blog/post/2025/12/26/digital-personal-data-protection-rules-2025-key-highlights/