Skip to content
Data Privacy · Enforcement timeline

DPDP Act deadlines: what happens in 2026 vs 2027

A few items on this page are marked Confirmation pending. What’s pending

2026 is the build year. 13 May 2027 is the hard deadline for notice, consent, security, breach response, and retention.

Last updated: 1 November 2026Written and edited by Sandesh Kokate

Checked against primary sources where marked. Items marked Confirmation pending are not yet checked.

Confirmation pending on this page (2)

Last checked 1 Nov 2026 · next check 8 Nov 2026

  • Whether later instruments change commencement periods. Ask a person to search eGazette Part II 3(i) and 3(ii), PIB and Parliament.
  • Whether Board members and registration are available. Ask the Board or your lawyer for the appointment order and application route. Recruitment is not appointment.

Short answer

The DPDP Act started phasing in on 13 November 2025, but the obligations that affect most businesses do not become enforceable until 13 May 2027. Use 2026 to build your compliance systems; after May 2027, penalties apply.

The three dates

13 Nov 2025Already in force

Definitions, the Board sections, and some general sections started on this date. The rule-making Rules 1, 2 and 17 to 21 also started.

Act: Section 1(2), 2, 18–26, 35, 38–43, 44(1) and 44(3) · Rules 1, 2, 17–21 · G.S.R. 843(E)(a), Rule 1(2)

13 Nov 2026One year later

The Consent Manager sections and Rule 4 (Consent Manager registration) start.

Act: Section 6(9), 27(1)(d) · Rule 4 · G.S.R. 843(E)(b), Rule 1(3)

13 May 2027Eighteen months later

Most duties start. This covers notice, consent, security, breach reports, children's data, rights, cross-border transfers, penalties and the change to the IT Act.

Act: Sections 3–5, 6(1)–(8) and 6(10), 7–17, 27 (except 27(1)(d)), 28–34, 36, 37, 44(2) · Rules 3, 5–16, 22, 23 · G.S.R. 843(E)(c), Rule 1(4)

Official text — G.S.R. 843(E), 13 November 2025
(a) the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2, sections 18 to 26 sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44 of the said Act shall come into force; (b) one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force. (c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
Official text — DPDP Rules, 2025, Rule 1(2)–(4), read with G.S.R. 892(E) corrigenda
(2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette. (3) Rule 4 shall come into force one year after the date of publication in the Official Gazette. (4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.

The corrigenda dated 10 December 2025 replace “of this Gazette” with “in the Official Gazette” in Rule 1(3) and (4). They do not change the one-year or eighteen-month periods. Opened on 1 November 2026; a complete later-amendment check remains unconfirmed.

The old IT Act data rule ends on 13 May 2027

Today, Section 43A of the IT Act and its SPDI Rules still apply to your data security. Section 44(2) of the DPDP Act removes Section 43A. G.S.R. 843(E) starts Section 44(2) eighteen months after 13 November 2025. That is 13 May 2027.

Official text — DPDP Act, 2023, Section 44(2)
(2) The Information Technology Act, 2000 shall be amended in the following manner, namely:— (a) section 43A shall be omitted; (b) in section 81, in the proviso, after the words and figures “the Patents Act, 1970”, the words and figures “or the Digital Personal Data Protection Act, 2023” shall be inserted; and (c) in section 87, in sub-section (2), clause (ob) shall be omitted.

What's still open

Reported, not confirmed

Reported, not confirmed: a January 2026 proposal to cut eighteen months to twelve. Our targeted MeitY check on 1 November 2026 did not establish a DPDP period-amending instrument. The Gazette search returned an error, so this is not a complete absence finding. The opened Rule 1(4) still says eighteen months after publication; we keep 13 May 2027 for planning with the publication caveat.

Penalty ceilings from 13 May 2027

The Schedule sets these ceilings. The highest figure in the Act is ₹250 crore — there is no ₹10,000 crore tier.

Up to ₹250 croreSecurity — s.8(5)
Up to ₹200 croreBreach notices — s.8(6)
Up to ₹200 croreChildren — s.9
Up to ₹150 croreSignificant Data Fiduciary — s.10
Up to ₹10,000Data Principal duties — s.15
the amount applicable to the underlying breachVoluntary undertaking — s.32
Up to ₹50 croreOther breaches

What this means for you

Founders

Treat 13 May 2027 as a ship date, not a kickoff. Notice, consent, breach response, and retention must be live by then.

Freelancers

Processor clauses in active client contracts need to be DPDP-ready before the deadline, not renegotiated under pressure.

Creators

Email lists, community sign-ups, and paid newsletters all fall under consent rules from 13 May 2027. Start documenting opt-ins now.

Status

EnforceablePhase 1 in force since 13 November 2025. Core obligations enforceable 13 May 2027.

Read next

Primary sources

Source
MeitY — DPDP Act (Gazette PDF)

Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).

We opened this on 2026-11-01

Source
MeitY — DPDP Rules, 2025 (Gazette PDF)

G.S.R. 846(E), 13 November 2025. Rule 1 sets when each rule starts.

We opened this on 2026-11-01

Source
MeitY — DPDP Rules corrigenda, G.S.R. 892(E), 10 December 2025

Rule 1 publication wording corrected; transition periods unchanged by this instrument. Opened 1 November 2026.

Status not confirmed

Status not confirmed — checked 2026-11-01

Source
G.S.R. 843(E) — DPDP Act commencement notification

Gazette of India, Extraordinary, 13 November 2025. Sets when each section of the Act starts.

Verified — 2026-11-01

Notified — checked 2026-11-01. Opened G.S.R. 843(E) (Gazette PDF).

Citation

Kokate, S. (2026). DPDP Act deadlines: what happens in 2026 vs 2027. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/dpdp-deadlines-2026-2027. Educational content, not legal advice.

Planning dates — How we count the dates.