FAQ
DPDP timeline FAQ
Each DPDP milestone in order, where the Board stands, and what to work on now.
Short answer
The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025, with the commencement notification G.S.R. 843(E). Rule 1 phases them in: Rules 1, 2 and 17 to 21 from 13 November 2025, Rule 4 (Consent Manager registration) from 13 November 2026, and Rules 3, 5 to 16, 22 and 23 from 13 May 2027. As of 4 November 2026, no Data Protection Board members have been appointed.
The three dates and what starts on each
| Date | Rules | What starts |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21 | Short title and commencement, definitions, and the Board's set-up |
| 13 November 2026 | Rule 4 | Consent Manager registration |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23 | Notice, consent, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances |
What to work on before 13 May 2027
- Map where personal data sits, including SaaS tools and employee devices.
- Review notices against Rule 3 and plan the s.5(2) notice to existing users.
- Set up breach intimation for the Board and Data Principals under Rule 7.
- Publish how to make requests and a grievance period of at most 90 days (Rule 14(3)).
- Check processor contracts for security terms (s.8(2), Rule 6). The May 2027 checklist has the full list.
All questions
Educational, not legal advice.
When were the DPDP Rules notified?
On 13 November 2025, as G.S.R. 846(E), with the commencement notification G.S.R. 843(E). The Press Information Bureau announced them on 14 November 2025. See DPDP Rules, 2025.
What took effect on 13 November 2025?
Rules 1, 2 and 17 to 21: short title and commencement, definitions, and the Data Protection Board's set-up.
What starts on 13 November 2026?
Rule 4, Consent Manager registration. As of 4 November 2026, the application form has not been published. See the Consent Manager FAQ.
When do core obligations begin?
On 13 May 2027, eighteen months after publication. Rules 3, 5 to 16, 22 and 23 then apply: notice, consent, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances.
Is the Data Protection Board working yet?
No Chairperson or Members have been appointed, as of 4 November 2026. MeitY advertised the posts in 2026.
What is G.S.R. 892(E)?
A corrigendum of December 2025 that corrects the English text of the DPDP Rules, 2025.
What did the October 2026 Removal of Difficulties Order change?
S.O. 5458(E), published in the Gazette on 6 October 2026, is editorial only: it inserts “of” in s.9(1) and changes “audit” to “data audit” in s.10(2)(c)(ii). It adds no new duty. See the Order explained.
When does the SPDI regime end?
The SPDI regime continues until s.44(2) of the Act commences; check the commencement notification G.S.R. 843(E). We do not give s.44(2) a date.
Has any company been designated a Significant Data Fiduciary?
None that we know of, as of 4 November 2026. SDFs are notified by the Central Government under s.10.
What should we do this quarter?
Start with a data map, notices, consent records, breach intimation steps and a grievance process. The May 2027 checklist lists the steps, and the readiness quiz shows where to begin.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin