DPDP Rules status: compliance window active. Read the update

Skip to content
Data Privacy · Enforcement timeline

DPDP Act deadlines: what happens in 2026 vs 2027

2026 is the build year. 13 May 2027 is the hard deadline for notice, consent, security, breach response, and retention.

Educational only · not legal adviceReviewed by Sandesh Kokate, Editor

Short answer

The DPDP Act started phasing in on 13 November 2025, but the obligations that affect most businesses do not become enforceable until 13 May 2027. Use 2026 to build your compliance systems; after May 2027, penalties apply.

The three dates

13 Nov 2025Done — institutional switch-on

The Data Protection Board provisions, definitions, and rule-making powers came into force. The Board exists in law, but members are not yet appointed and it is not hearing complaints.

Sections 2, 18–26 · Rules 1, 2, 17–21

13 Nov 2026Build year checkpoint

Consent Manager registration opens. This is the point at which Consent Managers can be registered with the Board, giving businesses a ready channel for consent management.

Section 6(9), Section 27(1)(d) · Rule 4

13 May 2027Hard deadline — full enforcement

Core obligations become enforceable: notice, consent, security and breach reporting, retention, children's data, Significant Data Fiduciary duties, Data Principal rights, cross-border transfers, exemptions — and the penalties that back them.

Sections 5, 6, 8, 9, 10, 11–14, 16, 17, 33 + the Schedule · Rules 3, 5–16, 22, 23

Penalty ceilings from 13 May 2027

The Schedule sets these ceilings. The highest figure in the Act is ₹250 crore — there is no ₹10,000 crore tier.

Up to ₹250 croreFailure to take reasonable security safeguards
Up to ₹200 croreFailure to notify a personal data breach
Up to ₹200 croreFailure of the extra duties around children's data
Up to ₹150 croreFailure of the extra duties of a Significant Data Fiduciary
Up to ₹10,000Breach of a Data Principal's own duties
capped at the original breachBreaking a voluntary undertaking accepted by the Board
Up to ₹50 croreBreaking any other part of the Act or Rules

What this means for you

Founders

Treat 13 May 2027 as a ship date, not a kickoff. Notice, consent, breach response, and retention must be live by then.

Freelancers

Processor clauses in active client contracts need to be DPDP-ready before the deadline, not renegotiated under pressure.

Creators

Email lists, community sign-ups, and paid newsletters all fall under consent rules from 13 May 2027. Start documenting opt-ins now.

Status

EnforceablePhase 1 in force since 13 November 2025. Core obligations enforceable 13 May 2027.

Read next

Is the DPDP Act in force yet?

In force vs enforceable, explained.

Consent Manager

What a Consent Manager does and when registration opens.

Data Fiduciary obligations

Notice, consent, security, breach, and retention duties.

Retention & erasure

How long you may keep personal data and when you must delete it.

Primary sources

Source
MeitY — DPDP Act (Gazette PDF)

Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).

Status unverified — no status check recorded

Source
MeitY — DPDP Rules, 2025 (Gazette PDF)

G.S.R. 846(E), 13 November 2025 (Gazette ID CG-DL-E-14112025-267650) — sets the phased commencement dates.

Status unverified — no status check recorded

Citation

Kokate, S. (2026). DPDP Act deadlines: what happens in 2026 vs 2027. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/dpdp-deadlines-2026-2027. Educational content, not legal advice.

← Back to Data Privacy hubData Fiduciary obligations →

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.