DPDP Compliance Timeline: Every Deadline Between Now and Full Enforcement

Who this is for: business leaders, DPOs and compliance heads who need to know exactly what is due when, and to build a plan that works back from the deadline.

Most DPDP coverage gives you the 18-month headline and stops there. The detail matters more. Different obligations commence on different dates, one category of business may face an earlier deadline, and the regulator that will enforce the law is still being staffed. This page brings every date together in one place and is updated as MeitY issues new notifications. If you are new to the law itself, start with The DPDP Act, Explained: The Complete 2026 Guide.

The DPDP timeline at a glance

The Act received Presidential assent on 11 August 2023. Its sections only take effect on dates the government appoints under Section 1(2). On 13 November 2025, MeitY issued two notifications together: one bringing parts of the Act into force, and the Digital Personal Data Protection Rules, 2025 themselves. Rule 1 of those Rules sets out the staggered commencement.

Phase 1: the regulator exists (since 13 November 2025)

Phase 1 is institutional. It created the Data Protection Board of India as a legal entity, fixed its size at a Chairperson and four Members, and set out how it will operate, largely as a digital office.

What it means for you: no new operational obligations yet. But the legal machinery for enforcement is in place, and the direction of travel is settled. Treat this phase as the start of your preparation window, not a grace period.

Phase 2: Consent Managers go live (13 November 2026)

Under Rule 4 and the First Schedule, companies can apply to the Board for registration as Consent Managers. These are interoperable platforms through which individuals give, review and withdraw consent across many businesses. Registered Consent Managers must meet conditions including a minimum net worth of ₹2 crore, must not be able to read the personal data that flows through them, and must keep consent records for at least seven years.

What it means for you: unless you plan to register as a Consent Manager, this date imposes no direct obligation. It does, however, mean individuals may soon arrive with consents managed through a third-party platform. Your systems will need to accept and act on them.

Phase 3: full compliance (13 May 2027)

This is the date that matters for nearly every business. On 13 May 2027, the core obligations of the Act and Rules become enforceable together:

• itemised, plain-language notices and valid consent (Section 5, Section 6, Rule 3)
• reasonable security safeguards, including one-year log retention (Section 8(5), Rule 6)
• breach notification to individuals and the Board, with a detailed report within 72 hours (Section 8(6), Rule 7)
• purpose-limited retention, the three-year erasure rule for large platforms, and 48-hour advance notice of erasure (Section 8(7), Rule 8)
• verifiable parental consent for children (Section 9, Rule 10)
• published contact details, rights handling and grievance redressal within 90 days (Rules 9, 14)
• annual DPIA and audit for Significant Data Fiduciaries (Section 10, Rule 13)
• the Board's full inquiry and penalty powers, with penalties of up to ₹250 crore

There is no further transition period after this date. Data collected before May 2027 is covered too. Section 5(2) requires notice to existing users for data processed on the basis of consent given before commencement.

For a full explanation of each obligation, read The DPDP Act, Explained.

What could change these dates

The three-phase structure is fixed in the notified Rules. Three live issues could still affect how and when obligations bite.

1. A possible earlier deadline for Significant Data Fiduciaries. In early 2026, MeitY consulted stakeholders on shortening the runway for Significant Data Fiduciaries from 18 months to 12. That would move their deadline from May 2027 to November 2026. As of the latest available reporting, no gazette amendment has been issued and the criteria for designating SDFs have not been notified. Large banks, platforms, telecom operators and health data processors should still plan as if the earlier date could apply.

2. Staffing the Data Protection Board. The Board exists in law, but MeitY only invited applications for its Chairperson and four Members in May 2026. Enforcement depends on the Board being fully constituted. A slow appointment process may delay the first enforcement actions, but it does not move the legal deadline.

3. A constitutional challenge. The Supreme Court has issued notice on petitions challenging the Act's amendment to the Right to Information Act. It has not stayed the law, and the challenge does not concern business obligations under the Act.

Working back from 13 May 2027

With around seven months remaining from October 2026, the work has to run in parallel, not in sequence. This plan assumes a mid-sized organisation starting with a privacy policy and limited operational controls.

Two items consistently take longest: re-papering vendor contracts and integrating consent into downstream systems. Start both in the first month, even before the design work is finished. If your consent model needs rebuilding, our guide to what makes consent valid under DPDP sets out the standard your new flows must meet.

Common timeline mistakes

• Reading "18 months" as "plenty of time". The runway started in November 2025. Organisations beginning now have around seven months.
• Confusing the Consent Manager date with your own deadline. 13 November 2026 is not the general compliance date. 13 May 2027 is, unless you are designated an SDF and the deadline is brought forward.
• Assuming enforcement will start slowly. Penalties apply to breaches from the commencement date. Evidence you did not create in time cannot be produced afterwards.
• Planning only for new customers. Existing users need notices too, and that is often the largest single workload.

How ConsentifyAI helps

ConsentifyAI's compliance dashboard maps each DPDP requirement to its commencement date, owner, control status and evidence. Leadership can see exactly what will be ready by 13 May 2027 and what is at risk. Because it is built on the platform's ROPA, consent, rights and breach modules, the dashboard reflects what your systems actually do, not what a spreadsheet says they do.