The DPDP Rules, 2025, introduce obligations that come into force in May 2027, creating new expectations for how organisations collect, use, secure, and delete personal data.