--- title: "What Happens to Existing SPDI Rules After Full DPDP Enforcement?" date: 2026-09-08 author: "Dhruv Kaushal" url: https://ksandk.com/data-protection-and-data-privacy/what-happens-spdi-rules-after-dpdp-enforcement/ --- ## Introduction India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“[IT Act](https://ksandk.com/data-protection-and-data-privacy/how-do-the-dpdp-rules-interact-with-the-it-act-and-intermediary-guidelines/)“) for body corporates handling sensitive personal data or information. These Rules, framed under Section 43A of the IT Act, prescribe requirements relating to consent, privacy policies, reasonable security practices and procedures, and restrictions on disclosure and transfer of sensitive personal data or information. The Digital Personal Data Protection Act, 2023 (“DPDP Act”), along with the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), introduces a substantially different framework for the processing of digital personal data. The DPDP Rules were notified in the Official Gazette on 13 November 2025, and the Central Government has prescribed a phased commencement of the DPDP Act. Institutional provisions, including those relating to the establishment of the Data Protection Board of India (“Board”), took effect from 13 November 2025. Certain provisions relating to Consent Managers take effect one year after notification, while the bulk of the substantive provisions, including the principal obligations of Data Fiduciaries, Data Principal rights, breach-related obligations and the amendments to the IT Act, take effect eighteen months after notification, i.e. on 13 May 2027. ### Are you a Significant Data Fiduciary? Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF. [Check your compliance score →](https://ksandk.com/privacy-review/scorecard) Until the latter phase takes effect, Section 43A of the IT Act and the SPDI Rules continue to form part of the applicable legal framework. From 13 May 2027, Section 44(2) of the DPDP Act will omit Section 43A of the IT Act and also omit the related rule-making power under Section 87(2)(ob). As the SPDI Rules were framed under these provisions, their statutory foundation will consequently cease to operate from that date. ## Current Status as of September 2026 As of September 2026, organisations that fall within the scope of the SPDI Rules must continue to comply with the existing framework. This includes requirements relating to the collection and processing of sensitive personal data or information, privacy policies, reasonable security practices and procedures, and restrictions governing disclosure and transfer of such information. At the same time, organisations should be preparing for the substantive DPDP framework. The phased commencement gives businesses time to map personal data, review notices and consent mechanisms, strengthen security safeguards, prepare breach-response processes and establish mechanisms for handling Data Principal rights before the broader DPDP obligations take effect in May 2027. The transition should therefore not be viewed as an immediate repeal-and-replacement exercise. The existing SPDI framework continues to operate until the relevant provisions of the DPDP Act take effect. Section 44(2), including the omission of Section 43A, is specifically included in the eighteen-month commencement tranche. ## Key Structural Differences The SPDI Rules adopted a narrower, category-based approach centred on “sensitive personal data or information.” Their obligations principally applied to body corporates and were linked to Section 43A of the IT Act. The framework focused on matters such as privacy policies, consent, reasonable security practices and restrictions on disclosure and transfer. The DPDP Act adopts a broader framework governing the processing of digital personal data. It does not create a separate statutory category of “sensitive personal data or information” comparable to the SPDI Rules. Instead, it establishes obligations applicable to Data Fiduciaries in respect of digital personal data, together with specific provisions relating to children’s data and Significant Data Fiduciaries. The DPDP framework also introduces a statutory framework for Data Principal rights, including rights relating to access to information about personal data, correction and erasure, grievance redressal and nomination. It further introduces a dedicated institutional framework through the Data Protection Board and provides for significant monetary penalties for specified contraventions. This represents a shift from the earlier Section 43A-based framework towards a broader, rights-oriented and penalty-backed data protection regime. ## What Organisations Must Do During the Transition The period until May 2027 should not be treated as a period in which organisations can defer data-protection [compliance](https://ksandk.com/data-protection-and-data-privacy/dpdp-compliance-checklist-india/). Organisations currently subject to the SPDI Rules should continue complying with their existing obligations while simultaneously preparing for the DPDP regime. Practical steps include: - Maintain existing SPDI-compliant privacy policies, consent mechanisms and grievance processes for processing covered by the SPDI Rules. - Map digital personal data flows, purposes and retention periods against the requirements that will apply under the DPDP framework. - Review and redesign [privacy notices](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-website-compliance/) and consent journeys so that they can meet the more detailed requirements of the DPDP Act and Rules when those provisions become applicable. - Strengthen and document reasonable security safeguards. Existing ISO 27001 or similar certifications may provide a useful foundation, but organisations should independently assess their security controls against the requirements of the DPDP framework. - Prepare breach-response procedures capable of meeting the notification requirements under the DPDP Rules once the relevant provisions take effect. - Review vendor and processor arrangements and identify the contractual and operational responsibilities that will arise under the DPDP framework. - Assess whether the organisation may be notified as a Significant Data Fiduciary and, if so, prepare for the additional obligations applicable to such entities, including requirements relating to a Data Protection Officer, data protection impact assessments and audits. - Train relevant personnel and update internal policies so that the transition to the DPDP framework can be implemented without significant operational disruption. After Section 43A is omitted, organisations should review and update SPDI-specific language in contracts, policies and internal systems. Continuing to rely exclusively on SPDI-era practices may create compliance gaps because the DPDP framework applies to a broader category of digital personal data and introduces different requirements relating to notices, consent, rights and accountability. ## Mini Comparison Table: SPDI Rules vs Full DPDP Regime | Aspect | SPDI Rules, 2011 | DPDP Act & Rules | | --- | --- | --- | | **Scope of data** | Sensitive personal data or information | Digital personal data | | **Primary regulated entity** | Body corporates handling covered SPDI | Data Fiduciaries and other entities to the extent covered by the DPDP Act | | **Regulatory framework** | Section 43A of the IT Act and SPDI Rules | DPDP Act and DPDP Rules | | **Regulator / authority** | No dedicated data protection regulator under the SPDI framework | Data Protection Board of India | | **Individual rights** | Limited statutory framework under the SPDI regime | Rights including access to information, correction, erasure, grievance redressal and nomination | | **Consent and notice** | Consent and privacy policy requirements for covered SPDI | Detailed notice and consent requirements under the DPDP framework, subject to applicable grounds for processing | | **Security obligations** | Reasonable security practices and procedures | Reasonable security safeguards and other obligations under the DPDP framework | | **Breach notification** | No equivalent comprehensive statutory personal-data-[breach notification](https://ksandk.com/data-protection-and-data-privacy/dpdp-data-breach-notification-timeline/) regime to a dedicated data protection authority | Specific personal data breach notification requirements under the DPDP Rules | | **[Cross-border](https://ksandk.com/data-protection-and-data-privacy/cross-border-data-transfers-dpdp-act-india/) transfers** | Transfer permitted subject to prescribed conditions, including ensuring the same level of data protection | Transfers are permitted subject to restrictions that may be specified by the Central Government | | **Penalties / remedies** | Compensation framework under Section 43A | Monetary penalties under the DPDP Act | | **Sensitive data category** | Specific statutory category of sensitive personal data or information | No separate statutory category of sensitive personal data | This comparison highlights why organisations cannot simply discontinue existing SPDI controls today, nor assume that those controls alone will be sufficient under the DPDP framework. ## Practical Implications After May 2027 Once Section 44(2) of the DPDP Act takes effect on 13 May 2027, Section 43A of the IT Act will be omitted, along with the related rule-making power under Section 87(2)(ob). The SPDI Rules, which derive their legal basis from these provisions, will consequently cease to operate as the applicable statutory data-protection framework. Organisations will therefore need to transition from the SPDI-specific framework to the DPDP framework for processing digital personal data. This will mean assessing processing activities against the applicable grounds for processing, implementing appropriate notices and consent mechanisms where required, maintaining reasonable security safeguards, and establishing processes for responding to Data Principal rights. Legacy systems, policies and contracts that continue to refer specifically to “sensitive personal data or information” under the SPDI Rules should be reviewed and updated where necessary. At the same time, the transition from the SPDI framework does not mean that all other privacy, confidentiality, cybersecurity or sector-specific obligations disappear. Organisations will continue to be required to comply with other applicable laws and regulatory requirements governing their particular activities. Significant Data Fiduciaries will be subject to additional obligations under the DPDP Act and Rules, including requirements relating to the appointment of a Data Protection Officer, data protection impact assessments and periodic audits. ## Preparing for a Clean Handover The staggered commencement of the DPDP framework provides organisations with a defined compliance window. Organisations that continue to honour their existing SPDI obligations while using the intervening period to prepare for DPDP compliance will be better positioned for the transition. The immediate priority should therefore be twofold: maintaining compliance with the current framework and progressively building the systems, policies and governance structures required under the DPDP framework. Organisations should particularly focus on data mapping, privacy notices, consent mechanisms, security controls, [retention](https://ksandk.com/data-protection-and-data-privacy/data-retention-deletion-dpdp-act-india/) practices, vendor arrangements, rights-management processes and breach-response mechanisms. The transition is not simply a matter of replacing one privacy policy with another. It requires organisations to reassess how personal data is collected, used, retained, secured and deleted across their operations. ## Frequently Asked Questions ### Explore KSK Data Privacy Hub Free compliance tools and expert guidance covering 75+ jurisdictions. [Global Regulation Finder](/privacy-review/map/)[DPDPA Scorecard](/privacy-review/scorecard/)[DPDPA Guide](/privacy-review/guides/dpdpa/)[GDPR Guide](/privacy-review/guides/gdpr/)[Cross-Border Transfers](/privacy-review/guides/cross-border/) --- ## Office Locations - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com ## Contact - [Contact Page](https://ksandk.com/contact-us/) - General: info@ksandk.com | +91-11-41318190 - WhatsApp: +91-7428567444 - [Privacy Statement](https://ksandk.com/privacy-statement/) - [Terms of Use](https://ksandk.com/terms-of-use/)