DPDPA compliance deadlines
Updated 6 October 2026
The DPDP Rules were notified on 13 November 2025. Consent Manager registration becomes mandatory on 13 November 2026, and every substantive Data Fiduciary obligation, together with the penalty provisions, commences on 13 May 2027. Nothing penalises a Data Fiduciary yet, which is exactly why the work starts now rather than then.
The three dates that matter
| Date | What commences | Who it affects |
|---|---|---|
| 13 Nov 2025 | Rules notified. Scope, definitions, and the rules establishing the Data Protection Board and its procedures take effect. | The framework only |
| 13 Nov 2026 | Rule 4: registration and obligations of Consent Managers. | Anyone operating as a Consent Manager |
| 13 May 2027 | Notice and consent, security safeguards, breach notification, data retention and erasure, rights requests, grievance redressal, children’s data, Significant Data Fiduciary duties, cross-border transfers, and the penalty provisions. | Every Data Fiduciary |
The sequencing is deliberate. The Board had to exist, and be able to make rules, before anyone could be held to them.
Could the deadline move earlier?
Plan to 13 May 2027, but sequence the work so that nothing important depends on having all eighteen months.
What to do, in order
Working back from 13 May 2027, in the order that makes the rest possible:
- Know what personal data you hold. You cannot write a notice, honour an erasure request or report a breach accurately without an inventory. Everything depends on it, and it takes longest.
- Map who you share it with. Every processor and sub-processor, what they receive, and under what contract.
- Fix the consent mechanism. An itemised notice in plain language, with withdrawal as easy as giving consent. Existing consents usually need refreshing.
- Build the request workflow. Access, correction, completion, updating, erasure and nomination, with an auditable record of each.
- Stand up breach procedures. Notification to the Board and to every affected individual. The exposure is up to ₹200 crore, and it is a process problem rather than a software one.
- Publish grievance redressal. A named contact and a response process.
Not sure which of these apply to you? Answer six questions and see each obligation explained.
If you are notified as a Significant Data Fiduciary
The Central Government designates Significant Data Fiduciaries on the basis of the volume and sensitivity of the data they process, the risk to Data Principals, and wider considerations including the sovereignty and integrity of India, electoral democracy, security of the State and public order.
Additional duties include a Data Protection Officer based in India who reports to the board, an independent data auditor, periodic Data Protection Impact Assessments and audits, and due diligence that algorithmic systems do not put Data Principals’ rights at risk. You do not opt in, and size alone does not keep you out of scope.
What happens if you are not ready
From 13 May 2027 the penalty provisions apply: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for breach-notification and children’s-data failures. These are maxima, and the Board weighs the gravity of each breach, but the exposure is large enough that being mid-project on the day is an uncomfortable place to be.
Frequently asked questions
When were the DPDP Rules notified?
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025.
What is the final DPDPA compliance deadline?
13 May 2027. That is when the substantive Data Fiduciary obligations and the penalty provisions commence.
What happens on 13 November 2026?
Rule 4 commences: anyone operating as a Consent Manager must be registered with the Data Protection Board.
Are any DPDPA obligations already in force?
The framework provisions commenced on notification: scope, definitions, and the rules establishing the Data Protection Board and its procedures. Duties on Data Fiduciaries commence on 13 May 2027.
Could the deadline move earlier?
In January 2026 MeitY proposed shortening the 18-month window to 12 months for some obligations, which would bring them forward to 13 November 2026. As of early October 2026 no such amendment has been notified.
What is the maximum penalty under the DPDPA?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach.