When do the DPDP Rules apply to my business?

Most duties apply from 13 May 2027: notices, security safeguards, breach reporting, one-year log retention, rights requests and children's data. They were published on 13 November 2025 with an 18-month runway. Registration of Consent Managers starts a year earlier, but that matters only to firms that want to become one.

Does Odoo make us DPDP compliant on its own?

No software does. The DPDP Act puts duties on you as the business that decides why data is processed. Odoo gives you the tools: role-based access, two-factor login, Privacy Lookup to find and erase a person's data, and data recycling rules. Consent records, the one-year access log and the breach procedure have to be set up.

What is the 90-day limit for DPDP requests?

Rule 14 says you must publish how long you take to answer grievances, and that period cannot be more than 90 days. MeitY's explainer applies the same 90 days to requests to see, correct or erase personal data. In Odoo, a Helpdesk team with a deadline on each ticket keeps those requests visible until closed.

What must we do within 72 hours of a data breach?

Tell the Data Protection Board without delay, then send a detailed report within 72 hours: what happened and why, what you did to limit it, who caused it if known, and how you told the people affected. Each affected person must also be told without delay, through their account or registered contact.

Does Odoo keep the one-year logs the Rules ask for?

Not by default. Odoo records changes to tracked fields, but its user log keeps only each user's most recent login and deletes older ones every day. Keeping one year of access logs means adding an audit log for personal-data models and setting log retention on your hosting.

Are employee and payroll records covered?

Yes. The Act covers digital personal data, including employee, applicant and payroll records in Odoo HR and Payroll. Employment is one of the legitimate uses that does not need separate consent, but the security, breach, retention and rights duties still apply to that data.

Data protection in Odoo

DPDP Rules compliance in Odoo

What India's Digital Personal Data Protection (DPDP) Rules require from 13 May 2027, which parts Odoo already handles, and what has to be set up.

Last reviewed: November 2, 2026

What do the DPDP Rules require, and from when?

The Rules sit under the Digital Personal Data Protection Act, 2023. These are the duties an Odoo user is most likely to meet; the Rules also set extra duties for Significant Data Fiduciaries and for very large online platforms.

DPDP Rules 2025 duties and dates, read on 2026-11-02, with sources
Rule	What it means	Source
When the duties start	The Rules were published on 13 November 2025. Consent Manager registration opens one year later. Notice, security safeguards, breach reporting, retention, rights requests and children's data apply 18 months after publication: 13 May 2027.	DPDP Rules 2025, rule 1
Notice before consent	A standalone notice in plain language that lists the personal data and the purpose for each item. It must link to where people withdraw consent, as easily as they gave it, and to where they can complain to the Data Protection Board.	DPDP Rules 2025, rule 3
Security safeguards	Encryption, masking or tokens; access control on the systems that hold personal data; logs, monitoring and review of who accessed what; and backups to keep processing going. Your contracts with processors must require the same.	DPDP Rules 2025, rule 6
Personal data breach	Tell each affected person without delay: what happened, the likely consequences, what you are doing and what they can do. Tell the Board without delay, then send a detailed report within 72 hours.	DPDP Rules 2025, rule 7
Logs and retention	Keep personal data, traffic data and logs of processing for at least one year from the processing, unless another law sets a longer period. Erase personal data once consent is withdrawn or the purpose is no longer served.	Rules, rules 6 and 8; Act, section 8(7)
Requests and grievances	Publish how people can ask to see, correct or erase their data, and what identifier they need. Answer grievances within a period you publish, no longer than 90 days. MeitY applies the same 90 days to access, correction and erasure requests.	DPDP Rules 2025, rule 14
A named contact	Publish the business contact of your Data Protection Officer, or of a person who can answer questions about your processing, and give it in every response to a request.	DPDP Rules 2025, rule 9
Children's data	Before processing data of anyone under 18, get verifiable consent from a parent. Schools, clinics and some other bodies have limited exemptions.	DPDP Rules 2025, rules 10 and 12
Penalties	Up to ₹250 crore for failing to take reasonable security safeguards; up to ₹200 crore for failing to report a breach or for breaching children's obligations; up to ₹50 crore for other breaches of the Act.	PIB explainer on the DPDP Rules

What does Odoo already do, and what has to be set up?

Checked against Odoo 20. The tools named here are standard Odoo; Helpdesk needs an Enterprise subscription.

DPDP requirements mapped to Odoo features and setup work
What you need	What Odoo does	What we set up
Consent records	Odoo records email opt-outs (the blacklist and mailing-list unsubscribes) and the website cookie bar offers essential-only or all cookies. It has no register of who agreed to which notice, for which purpose.	A consent log on each contact: purpose, notice version, date, channel and withdrawal date, filled from your website forms and shown on the contact.
Access by role	Access groups decide which apps and menus each user sees; record rules limit them to their own company, team or records. Two-factor authentication is built in.	A role matrix signed off by you, so payroll, HR and customer data are visible only to the people who need them. Two-factor on for every internal user.
Access logs for one year	Tracked fields record who changed what in the chatter. Out of the box, Odoo keeps only each user's most recent login: a daily clean-up deletes older ones.	An audit log on the models that hold personal data, and server and login logs kept for at least one year on your hosting.
Requests to see or erase data	The Privacy Lookup tool finds every record that holds a person's name or email, lets you archive or delete them, and logs each lookup with who handled it.	A request process with a 90-day clock, using Privacy Lookup for the search and its log as your evidence.
Erase when no longer needed	Data recycling rules archive or delete records of a chosen model once they are older than a set period, manually or automatically.	Retention rules per data type, set after your CA confirms how long tax and accounting records must be kept.
Breach response	Odoo does not run a breach process for you. Helpdesk (Enterprise) can time tickets against a deadline in hours.	A breach procedure with named owners, a 72-hour clock for the Board report, and notice templates for affected people.

An eight-step Odoo checklist before 13 May 2027

List the personal data you hold in Odoo, model by model: contacts, employees, applicants, website visitors, students or patients.
Write the notice for each purpose and record consent against it on the contact.
Set access groups and record rules from a role matrix, and switch on two-factor authentication.
Turn on an audit log for personal-data models and keep server and login logs for one year.
Name your Data Protection Officer or contact person and publish the details.
Set up the request process: a published route, Privacy Lookup for the search, and a 90-day deadline on each request.
Write the breach procedure and test it once before 13 May 2027.
Add data recycling rules for records you no longer need, after checking legal retention periods.

Switching on Odoo's AI agents as well? The same access rules decide what an agent can read and change. Read what to lock down before you switch on Odoo 20's AI agents.

Getting it set up with TechUltra

We set up roles, logging, consent records and the request process as part of an Odoo project, or on an Odoo you already run. New to Odoo? Access roles are set from day one in our fixed-price India packages, including the move off Tally in the Tally to Odoo playbook. For the other Indian rules Odoo has to follow, see GST e-invoicing and e-way bill in Odoo. This page explains the Rules; it is not legal advice, so have your lawyer confirm how they apply to you.

DPDP compliance in Odoo: common questions

When do the DPDP Rules apply to my business?

Most duties apply from 13 May 2027: notices, security safeguards, breach reporting, one-year log retention, rights requests and children's data. They were published on 13 November 2025 with an 18-month runway. Registration of Consent Managers starts a year earlier, but that matters only to firms that want to become one.
Does Odoo make us DPDP compliant on its own?

No software does. The DPDP Act puts duties on you as the business that decides why data is processed. Odoo gives you the tools: role-based access, two-factor login, Privacy Lookup to find and erase a person's data, and data recycling rules. Consent records, the one-year access log and the breach procedure have to be set up.
What is the 90-day limit for DPDP requests?

Rule 14 says you must publish how long you take to answer grievances, and that period cannot be more than 90 days. MeitY's explainer applies the same 90 days to requests to see, correct or erase personal data. In Odoo, a Helpdesk team with a deadline on each ticket keeps those requests visible until closed.
What must we do within 72 hours of a data breach?

Tell the Data Protection Board without delay, then send a detailed report within 72 hours: what happened and why, what you did to limit it, who caused it if known, and how you told the people affected. Each affected person must also be told without delay, through their account or registered contact.
Does Odoo keep the one-year logs the Rules ask for?

Not by default. Odoo records changes to tracked fields, but its user log keeps only each user's most recent login and deletes older ones every day. Keeping one year of access logs means adding an audit log for personal-data models and setting log retention on your hosting.
Are employee and payroll records covered?

Yes. The Act covers digital personal data, including employee, applicant and payroll records in Odoo HR and Payroll. Employment is one of the legitimate uses that does not need separate consent, but the security, breach, retention and rights duties still apply to that data.

Want your Odoo ready before May 2027?

Chat on WhatsApp