Free tool · Every clock cited to its rule
DPDP deadline calculator
Enter when something happened and see every deadline the DPDP Rules 2025 attach to it: the 72-hour breach report to the Board, the 90-day grievance ceiling, the 48-hour warning before erasure, log retention, and when each Rule comes into force. Times are in Indian Standard Time.
By Suryansh Sagar. Periods read from the notified Rules (G.S.R. 846(E), 13 November 2025). Last checked 5 October 2026.
Indian Standard Time
Counted in hours from the moment of awareness. The Rules set no exclusion for weekends or holidays.
Starting the clock...
The clocks
What each deadline means, and where it comes from
- 72 hours: the detailed breach report
- From the moment the Data Fiduciary becomes aware of a personal data breach, it has 72 hours to give the Board the detailed report: facts, mitigation, findings on who caused it, remedial measures and the intimations sent. The Board can allow longer on a written request.
- Rule 7(2)(b)
- Without delay: telling people and the Board
- Each affected Data Principal, and the Board, must first be told without delay. The Rules set no number of hours for this, and a calculator that showed one would be inventing law. Gevox shows the time elapsed instead.
- Rule 7(1), 7(2)(a)
- 90 days: answering a grievance
- The grievance redressal system must respond within a reasonable period not exceeding ninety days. Ninety days is the outer limit; a reasonable period may be much shorter.
- Rule 14(3)
- Three years, and 48 hours notice: erasing inactive accounts
- Large e-commerce, online gaming and social media platforms in the Third Schedule erase a user’s data three years after the latest of last contact, last exercise of rights, or commencement of the Rules, and must warn the user at least 48 hours before.
- Rule 8(1), 8(2)
- One year: keeping logs
- Logs and associated personal data are kept for at least one year so that unauthorised access can be detected, investigated and remedied, then erased unless another law requires longer.
- Rule 6(1)(e), 8(3)
- Every twelve months: the SDF cycle
- A Significant Data Fiduciary runs a DPIA and an audit once in every twelve months from its notification. No entity or class has been notified yet, so this clock runs only as a scenario.
- Rule 13(1)
Questions
Common questions on DPDP deadlines
How long does a company have to report a personal data breach in India?
Under Rule 7(2)(b) of the DPDP Rules 2025, the detailed report to the Data Protection Board is due within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request. Before that, the affected Data Principals and the Board must be told without delay under Rule 7(1) and 7(2)(a).
What is the time limit to resolve a DPDP grievance?
Rule 14(3) requires a response within a reasonable period not exceeding ninety days from receipt.
When do the DPDP Rules come into force?
Rules 1, 2 and 17 to 21 came into force on publication, 13 November 2025. Rule 4, on Consent Managers, comes into force on 13 November 2026. Rules 3, 5 to 16, 22 and 23, which carry most of the duties, come into force on 13 May 2027.
Does the 48-hour erasure warning apply to every business?
No. Rule 8(1) and the Third Schedule cover three classes: e-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh. Other businesses erase personal data once the purpose is served, under Section 8(7).
Is the result legal advice?
No. The calculator applies the periods stated in the DPDP Rules 2025 to the date you enter. Whether a period applies to a particular client, and when awareness of a breach began, are judgements for the professional advising them.
Gevox runs these clocks for every client, live.
The rights and grievance register counts each request against the 90-day ceiling, and the breach module runs both Rule 7 standards from the moment of awareness, for every client workspace at once.