Timeline
DPDP compliance timeline for Indian companies
Three dates set the pace for DPDP compliance. Here is what starts on each, where things stand on 4 November 2026, and a phased plan to get ready.
Short answer
Under Rule 1 of the DPDP Rules, 2025 (G.S.R. 846(E)), Rules 1, 2 and 17 to 21 started on 13 November 2025, Rule 4 (Consent Manager registration) starts on 13 November 2026, and Rules 3, 5 to 16, 22 and 23 start on 13 May 2027. Core obligations for Data Fiduciaries therefore begin on 13 May 2027. As of 4 November 2026, no Board members have been appointed and the Consent Manager application form has not been published.
The three dates and what starts on each
The Act was published in the Gazette on 11 August 2023. Its provisions come into force in three groups under the commencement notification G.S.R. 843(E) (s.1(2)), and the Rules start in three phases under Rule 1.
| Date | What starts | Rules in force from that date |
|---|---|---|
| 13 November 2025 | Definitions and the set-up of the Data Protection Board | Rules 1, 2 and 17 to 21 |
| 13 November 2026 | Registration and obligations of Consent Managers | Rule 4 |
| 13 May 2027 | Core obligations for Data Fiduciaries: notice, consent, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances | Rules 3, 5 to 16, 22 and 23 |
Where things stand on 4 November 2026
- Data Protection Board: no Chairperson or Members have been appointed yet. MeitY advertised the posts in 2026.
- Consent Manager application form: not published yet, although Rule 4 starts on 13 November 2026.
- Significant Data Fiduciaries: none designated under s.10 that we know of.
- Corrigendum: G.S.R. 892(E), December 2025, corrected the English text of the Rules.
- Removal of Difficulties Order: S.O. 5458(E), Gazette 6 October 2026, made editorial changes to s.9(1) and s.10(2)(c)(ii) and added no new duty.
The dates in Rule 1 do not depend on the Board being in place. Treat 13 May 2027 as fixed and build your evidence now, so you are ready when the Board starts work.
A phased preparation plan
A suggested sequence for the six months before 13 May 2027. Adjust it to your size and risk.
- 01November to December 2026: find and map personal data
Inventory the systems, tables and files that hold personal data, and record each processing activity with its purpose and lawful ground (s.4).
- 02January 2027: fix notices and consent
Rewrite notices to Rule 3, make withdrawal as easy as giving consent (s.6(4)), and plan the s.5(2) notice to people whose data you collected before commencement.
- 03February 2027: build rights and grievance handling
Publish how people make requests and which identifier they need, publish a grievance response period of no more than 90 days (Rule 14(3)), and name your contact person (Rule 9).
- 04March 2027: prepare for breaches
Write a Rule 7 runbook, rehearse both intimations and the 72-hour report, and check that processors must tell you about breaches without delay.
- 05April 2027: contracts, security and retention
Put processors under valid contracts with security terms (s.8(2), Rule 6), set retention and erasure rules (s.8(7), Rule 8), and check whether s.9 or s.10 applies to you.
- 06Early May 2027: test and keep evidence
Run a rights request, a consent withdrawal and a breach drill end to end, and keep the records that prove notice and consent (s.6(10)).
The May 2027 checklist turns this plan into tasks.
What to watch for next
- s.44(2): omits section 43A of the IT Act, on which the SPDI Rules, 2011 rest. It was not in the group that commenced on 13 November 2025, so the SPDI regime continues until s.44(2) commences. Check the commencement notification G.S.R. 843(E).
- Board appointments: once members are appointed, the Board can inquire into breaches and decide penalties.
- Consent Manager form: registration under Rule 4 needs the application form, which has not been published.
- SDF designation: the Central Government designates Significant Data Fiduciaries by notification under s.10.
- Transfer restrictions: s.16 lets the Central Government restrict transfers to countries it notifies. No list has been notified.
For how the old and new regimes compare, see DPDP and the IT Act SPDI Rules.
How TruePrivacy helps
The DPDP checklist in TruePrivacy marks each control compliant, partial or non-compliant, with a posture score worked out from live records, so you can track progress towards 13 May 2027. It is a readiness view, not a sign-off.
Start with data discovery and records of processing, then move to notices, consent management, rights requests and breach management. Bulk notice campaigns by email help with the s.5(2) notice to existing users.
When does the DPDP Act come into force?
In phases. Rules 1, 2 and 17 to 21 started on 13 November 2025, Rule 4 starts on 13 November 2026, and core obligations for Data Fiduciaries begin on 13 May 2027 (Rule 1).
When can Consent Managers register?
Rule 4 starts on 13 November 2026, but the application form had not been published as of 4 November 2026.
Is the Data Protection Board functioning?
No Chairperson or Members had been appointed as of 4 November 2026. The Rules on the Board's set-up have applied since 13 November 2025.
Do the SPDI Rules, 2011 still apply?
The SPDI regime rests on section 43A of the IT Act, which s.44(2) of the DPDP Act omits. It continues until s.44(2) commences, so check the commencement notification G.S.R. 843(E).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin