Timeline
Getting ready for 13 May 2027
Core DPDP obligations begin on 13 May 2027. Here is a precise, month-by-month plan from November 2026.
Short answer
Under Rule 1 of the DPDP Rules, 2025 (G.S.R. 846(E)), Rules 3, 5 to 16, 22 and 23 come into force on 13 May 2027, eighteen months after publication. That is when core obligations begin for Data Fiduciaries: notice, consent, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances. From 4 November 2026 that leaves a little over six months to plan, build and rehearse.
What begins on 13 May 2027
Rules 1, 2 and 17 to 21 have applied since 13 November 2025, and Rule 4 starts on 13 November 2026. The table lists the rules that begin on 13 May 2027, with their headings from G.S.R. 846(E).
| Rule | Heading |
|---|---|
| Rule 3 | Notice given by Data Fiduciary to Data Principal |
| Rule 5 | Processing by the State for subsidy, benefit, service, certificate, licence or permit |
| Rule 6 | Reasonable security safeguards |
| Rule 7 | Intimation of personal data breach |
| Rule 8 | Time period for specified purpose to be deemed as no longer being served |
| Rule 9 | Contact information of person to answer questions about processing |
| Rules 10 to 12 | Verifiable consent for children and for persons with disability who have a lawful guardian, and exemptions for children's data |
| Rule 13 | Additional obligations of Significant Data Fiduciary |
| Rule 14 | Rights of Data Principals |
| Rule 15 | Transfer of personal data outside the territory of India |
| Rule 16 | Exemption for research, archiving or statistical purposes |
| Rules 22 and 23 | Appeal to Appellate Tribunal; calling for information from Data Fiduciary or intermediary |
A month-by-month plan
These months are a suggested plan, not legal deadlines. The only date in the law here is 13 May 2027.
- 01November to December 2026: find and map
Build an inventory of where personal data sits and a record of each processing activity. For each purpose, note the lawful ground: consent (s.6) or a legitimate use (s.7).
- 02January 2027: notices and consent
Rewrite notices to Rule 3: itemised data and purposes, and links to withdraw consent, exercise rights and complain to the Board. Plan the s.5(2) notice to people whose data you collected before commencement.
- 03February 2027: rights and grievances
Publish how Data Principals make requests (Rule 14) and the contact Rule 9 requires. Set a grievance response period of no more than 90 days, the limit in Rule 14(3).
- 04March 2027: security and breach
Check the Rule 6 safeguards, including logs kept for one year. Write a Rule 7 runbook: each affected Data Principal and the Board without delay, and the detailed report within 72 hours.
- 05April 2027: processors, retention and children
Put processors under valid contracts with security terms (s.8(2), Rule 6). Set retention and erasure rules (s.8(7), Rule 8). If you process children's data, plan verifiable parental consent (Rule 10).
- 06Early May 2027: rehearse and collect evidence
Run a sample withdrawal, an access request and a breach drill. Keep the outputs as evidence that the processes work.
Evidence to have ready
- Published notice text, with the date each version went live.
- Consent records per person and purpose that prove notice and consent (s.6(10)).
- The published contact for questions about processing (Rule 9).
- The published way to make requests and the grievance response period (Rule 14).
- A breach runbook and a record of the drill.
- Retention rules, including at least 48 hours' notice before erasure if you fall in a Third Schedule class (Rule 8).
- Processor contracts with security terms, and logs kept for at least one year (Rule 6, Rule 8(3)).
Keep the plan precise
As of 4 November 2026, no Board members have been appointed and no Significant Data Fiduciary has been designated that we know of. Plan for the duties as written, not for headlines. Rule 4 Consent Manager registration starts on 13 November 2026, but s.6(7) says Data Principals may use a Consent Manager, so you do not need to wait for one.
How TruePrivacy helps
Our checklist for May 2027 lists the tasks in full. Inside TruePrivacy, the DPDP checklist and posture view marks each control compliant, partial or non-compliant from live records. It is a readiness view and does not certify anything.
Data discovery builds the inventory, consent management keeps the records, rights requests and grievances run against the 90-day outer limit, and breach management runs a clock for each audience.
What happens on 13 May 2027 under DPDP?
Rules 3, 5 to 16, 22 and 23 of the DPDP Rules, 2025 come into force, so the core obligations of Data Fiduciaries begin (Rule 1).
Is anything due before 13 May 2027?
Rule 4 on Consent Manager registration comes into force on 13 November 2026. The core duties of Data Fiduciaries start on 13 May 2027.
Where is the full checklist?
See our checklist for May 2027, or take the readiness quiz to find gaps first.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin