Updated 8 Nov 2026: dates, sections and penalties re-read in the DPDP Act, 2023 and the DPDP Rules, 2025 that day.
For an L&D team, 13 November 2026 changes almost nothing: the only rule that starts that day (Rule 4) licenses Consent Managers. The duties that touch your LMS (notice, security safeguards, one-year logs, 72-hour breach reports, erasure) start on 13 May 2027, with maximum penalties of ₹250 crore. Most mandatory training data can rest on the Act's employment ground, but optional courses, pre-hire tests, under-18 interns and customer call recordings need more care.
This guide is written for the people who run an LMS, a compliance-training calendar or a sales-coaching programme in India. It is general information, not legal advice. Tough Tongue AI, which publishes this site, sells AI roleplay software; it appears once below, marked.
What actually starts on 13 November 2026
The DPDP Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E) and phase in over 18 months. The government's PIB release calls it an "18-month phased compliance timeline".
| Date | What comes into force (Rule 1) | What it means for L&D |
|---|---|---|
| 13 Nov 2025 | Rules 1, 2 and 17 to 21: definitions and the Data Protection Board | Nothing to build yet |
| 13 Nov 2026 | Rule 4: registration and duties of Consent Managers | No new duty for an employer |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23: notice, security, breach, retention, children, Significant Data Fiduciaries | Your LMS, logs, vendor contracts and leaver records must be ready |
A proposal to cut the timeline from 18 to 12 months was discussed with industry in January 2026. As of 9 October 2026 it was "not gazetted", according to ConsentOS's status tracker, and the PIB page still gives 18 months. Check again before you plan around May 2027.
Several posts call 13 November 2026 a compliance deadline. Cyberaube's Rule 4 analysis puts it plainly: "It is not a compliance deadline for banks, insurers, hospitals, e-commerce platforms or SaaS companies." The same holds for an employer's L&D team.
Which learner data needs consent, and which does not
The DPDP Act lets you process personal data with consent (section 6) or for a "legitimate use" (section 7). Employment is one of those uses, so a mandatory course for your own staff usually needs no consent form. The formal notice in section 5 goes with consent requests; telling staff what you collect is still good practice.
The grey zones are where consent is the safer route. Khaitan & Co.'s employer guide says "it is not clear if the legitimate use ground can be used during recruitment or for optional events for employees".
| Learner data (example) | Likely ground | What to do |
|---|---|---|
| Mandatory course records (POSH, code of conduct, product certification) | Employment, s.7(i) | Tell staff what you keep; limit who sees scores |
| Assessment scores used in reviews (quiz marks, certification pass or fail) | Employment, s.7(i) | Tell staff that scores feed reviews |
| Optional learning (electives, external MOOCs, wellness talks) | Unclear: use consent | Separate opt-in, easy to withdraw |
| Pre-hire tests (aptitude test, case study, mock call) | Unclear: use consent | Consent in the candidate flow |
| Under-18 interns or apprentices (school-leaver apprentices) | Child under s.2(f) | Verifiable parental consent, s.9 |
| Customer calls used for coaching (recorded sales or support calls) | Not employment: the customer is the Data Principal | Notice at call start, or redact before reuse |
| Leavers' learning history (transcripts after exit) | Purpose may have ended | Erase unless another law needs it |
"Likely ground" is our reading of the Act, not a court ruling. Sections 4 to 7 of the Act set out the grounds; the Rules add how notices and consent must look.
The blind spot: customer calls in your coaching library
Sales and support teams often coach from real call recordings. Each recording holds a customer's voice, name, phone number and sometimes account details, and that customer is a Data Principal in their own right.
The employment ground in section 7(i) covers your employees, not your customers. So reusing a customer call as training material needs a basis of its own. In practice teams take one of three routes:
- Say it at the start of the call. The usual "this call may be recorded for training and quality" line, backed by a written notice.
- Redact before reuse. Strip names, numbers and account details before a call enters the training library.
- Practise without customer data. Use scripted or AI roleplay buyers, so no real customer is recorded at all.
The third route is what AI roleplay tools do. Tough Tongue AI (our product) runs voice roleplays with an AI buyer, so the practice audio holds only your employee's voice. Read AI roleplay vs classroom training for how the two compare on results.
Security, logs and breaches in L&D terms
Rule 6 of the Rules lists "reasonable security safeguards". In LMS terms, these are the four that matter most (English text from an unofficial reproduction of Rule 6; the official Gazette PDF is linked above):
- Access control (Rule 6(1)(b)). Managers see their team's scores; nobody else browses them.
- Logs (Rule 6(1)(c) and (e)). Keep "appropriate logs" of who opened learner data, and "retain such logs and personal data for a period of one year".
- Processor contracts (Rule 6(1)(f)). Your LMS vendor is a Data Processor; the contract must carry security terms.
- Backups (Rule 6(1)(d)). Training records must survive an incident.
If learner data leaks, section 8(6) of the Act requires you to tell the Data Protection Board and each affected person. Rule 7 asks for a detailed report to the Board "within seventy-two hours of becoming aware of the breach" (Rule 7 text). Run one drill a year with your LMS vendor so you know who calls whom.
How long to keep learning records
Section 8(7) says a Data Fiduciary must erase personal data once consent is withdrawn or the purpose is "no longer being served", "unless retention is necessary for compliance with any law". For a leaver, the purpose of most learning records ends with the job.
Two rules shape the timing. Rule 8(3) keeps personal data, traffic data and logs for "a minimum period of one year from the date of such processing", and Rule 8(2) asks you to notify the person "at least forty-eight hours" before erasure where Rule 8's deemed-erasure periods apply (Rule 8 text). The Third Schedule's three-year periods name e-commerce, gaming and social media platforms, not employers.
A workable policy: keep a leaver's records for one year after exit, longer only where another law (for example a sector regulator's training record rule) requires it, then erase them in your LMS and at your vendor.
Check your readiness in 2 minutes
Tick what your team already has. The tool sorts what is left by the maximum penalty it maps to and groups it by the team that usually owns it.
DPDP readiness check for L&D · 12 controls · law checked 8 Nov 2026
0 of 12 in place
Your to-do list, highest maximum penalty first, grouped by the team that usually owns it:
IT
- Scores and recordings are visible only to roles that need them (up to ₹250 cr)
- Access logs are kept and kept for at least one year (up to ₹250 cr)
- We have a breach drill: tell learners, report to the Board within 72 hours (up to ₹200 cr)
Legal
- Our LMS vendor signed a processor contract with security terms (up to ₹250 cr)
- Each field is tagged "employment use" or "needs consent" (up to ₹50 cr)
HR
- Under-18 interns or apprentices have verifiable parental consent (up to ₹200 cr)
- Learners get a plain notice of what we collect and why (up to ₹50 cr)
- Leavers' learning records have an erase date, with 48 hours' notice (up to ₹50 cr)
- Learners know whom to ask or complain to about their data (up to ₹50 cr)
L&D
- We have a list of every learner data field our LMS and tools hold (up to ₹50 cr)
- Optional courses and pre-hire tests ask for consent separately (up to ₹50 cr)
Sales enablement
- Customer calls used for coaching are covered by notice or redacted (up to ₹50 cr)
Penalty figures are the maximums in the Schedule to the DPDP Act, 2023. General information, not legal advice. Runs in your browser; nothing is sent anywhere.
DPDP training for employees: a role-based plan
Your L&D team will also be asked to train everyone else on DPDP. One generic video does not fit: HR handles different data from sales. This is the plan we recommend, with time per role. It is our suggestion, not a legal requirement.
| Who and time | Module | Proof of completion |
|---|---|---|
| Everyone, 20 min | What personal data is, notice and consent, spotting and reporting a breach | 5-question quiz, 80% to pass |
| People managers, +15 min | Who may see team data; reviews and scores; leaver handover | Scenario quiz |
| HR and L&D admins, +45 min | Grounds for each data field, under-18 learners, retention and erasure, vendor contracts | Data map of your own systems |
| Sales and support, +20 min | Call recording notices, redaction, CRM hygiene | Redact one sample call |
| IT and security, +60 min | Access control, one-year logs, 72-hour breach drill | Drill notes signed off |
Refresh the everyone module once a year and after any breach. Keep completion records: they are your evidence if the Board asks how you trained staff.
Test yourself: three L&D scenarios
A manager wants to export every team member's quiz scores to a shared spreadsheet. Fine?
Only if the scores serve an employment purpose and the sheet is restricted to people who need it. A shared sheet with open access fails Rule 6(1)(b) access control. Keep scores in the LMS and share a summary.
You want to add an optional evening course on personal finance. Do you need consent?
Consent is the safer route. Optional activities are one of the grey zones Khaitan & Co. flag for the employment ground. Use a clear opt-in and let people withdraw.
Your best sales call from last quarter would make a great training clip. Can you share it in the LMS?
Not as is. The customer on the call is a Data Principal, and the employment ground does not cover them. Use it only if the customer got a recording notice that covers training, or redact it, or rebuild the scenario as a roleplay.
Maximum penalties
The Schedule to the Act sets these maximums per instance. The Data Protection Board decides the actual amount.
| Breach | Up to |
|---|---|
| No reasonable security safeguards (s.8(5)) | ₹250 crore |
| Not telling the Board or affected people about a breach (s.8(6)) | ₹200 crore |
| Children's data duties (s.9) | ₹200 crore |
| Significant Data Fiduciary duties (s.10) | ₹150 crore |
| Any other provision of the Act or Rules | ₹50 crore |
FAQ
Does the DPDP Act apply to employee training data? Yes. Course records, scores and recordings are personal data. Most mandatory training can rely on the employment ground in section 7(i), but security, breach and erasure duties still apply from 13 May 2027.
Do we need employee consent for an LMS? Not for mandatory, job-related training in most readings of section 7(i). Use consent for optional courses, pre-hire tests and anything an employee can say no to.
Is 13 November 2026 a DPDP deadline for HR? No. Only Rule 4 on Consent Managers starts that day. Employer duties start on 13 May 2027 unless the government gazettes a shorter timeline.
Does our LMS data have to stay in India? Not in general. The Act allows transfers abroad unless the government restricts a country. Our Best LMS in India guide lists which vendors name an Indian data centre.
Sources
- Digital Personal Data Protection Act, 2023 (India Code): sections 2(f), 5 to 9, 33 and the Schedule.
- DPDP Rules, 2025, G.S.R. 846(E) (MeitY): Rule 1 commencement dates.
- PIB release, 14 Nov 2025.
- ConsentOS notification status, updated 9 Oct 2026.
- Khaitan & Co. employer guide, SCC Times, 11 Nov 2024.