DPDP Act deadlines: what happens in 2026 vs 2027
A few items on this page are marked Confirmation pending. What’s pending
2026 is the build year. 13 May 2027 is the hard deadline for notice, consent, security, breach response, and retention.
Checked against primary sources where marked. Items marked Confirmation pending are not yet checked.
Confirmation pending on this page (2)
Last checked 1 Nov 2026 · next check 8 Nov 2026
- Whether later instruments change commencement periods. Ask a person to search eGazette Part II 3(i) and 3(ii), PIB and Parliament.
- Whether Board members and registration are available. Ask the Board or your lawyer for the appointment order and application route. Recruitment is not appointment.
Short answer
The DPDP Act started phasing in on 13 November 2025, but the obligations that affect most businesses do not become enforceable until 13 May 2027. Use 2026 to build your compliance systems; after May 2027, penalties apply.
The three dates
Definitions, the Board sections, and some general sections started on this date. The rule-making Rules 1, 2 and 17 to 21 also started.
Act: Section 1(2), 2, 18–26, 35, 38–43, 44(1) and 44(3) · Rules 1, 2, 17–21 · G.S.R. 843(E)(a), Rule 1(2)
The Consent Manager sections and Rule 4 (Consent Manager registration) start.
Act: Section 6(9), 27(1)(d) · Rule 4 · G.S.R. 843(E)(b), Rule 1(3)
Most duties start. This covers notice, consent, security, breach reports, children's data, rights, cross-border transfers, penalties and the change to the IT Act.
Act: Sections 3–5, 6(1)–(8) and 6(10), 7–17, 27 (except 27(1)(d)), 28–34, 36, 37, 44(2) · Rules 3, 5–16, 22, 23 · G.S.R. 843(E)(c), Rule 1(4)
Official text — G.S.R. 843(E), 13 November 2025
Official text — DPDP Rules, 2025, Rule 1(2)–(4), read with G.S.R. 892(E) corrigenda
The corrigenda dated 10 December 2025 replace “of this Gazette” with “in the Official Gazette” in Rule 1(3) and (4). They do not change the one-year or eighteen-month periods. Opened on 1 November 2026; a complete later-amendment check remains unconfirmed.
The old IT Act data rule ends on 13 May 2027
Today, Section 43A of the IT Act and its SPDI Rules still apply to your data security. Section 44(2) of the DPDP Act removes Section 43A. G.S.R. 843(E) starts Section 44(2) eighteen months after 13 November 2025. That is 13 May 2027.
Official text — DPDP Act, 2023, Section 44(2)
What's still open
Reported, not confirmed
Reported, not confirmed: a January 2026 proposal to cut eighteen months to twelve. Our targeted MeitY check on 1 November 2026 did not establish a DPDP period-amending instrument. The Gazette search returned an error, so this is not a complete absence finding. The opened Rule 1(4) still says eighteen months after publication; we keep 13 May 2027 for planning with the publication caveat.
No qualifying DPDP commencement amendment established from the limited official searches on 1 November 2026; Gazette coverage incomplete. No date changed.Ask the editor or your lawyer for the official source before relying on this.Penalty ceilings from 13 May 2027
The Schedule sets these ceilings. The highest figure in the Act is ₹250 crore — there is no ₹10,000 crore tier.
What this means for you
Treat 13 May 2027 as a ship date, not a kickoff. Notice, consent, breach response, and retention must be live by then.
Processor clauses in active client contracts need to be DPDP-ready before the deadline, not renegotiated under pressure.
Email lists, community sign-ups, and paid newsletters all fall under consent rules from 13 May 2027. Start documenting opt-ins now.
Status
Read next
Is the DPDP Act in force yet?
In force vs enforceable, explained.
Consent Manager
What a Consent Manager does and when registration opens.
Data Fiduciary obligations
Notice, consent, security, breach, and retention duties.
Retention & erasure
How long you may keep personal data and when you must delete it.
Primary sources
Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).
We opened this on 2026-11-01
G.S.R. 846(E), 13 November 2025. Rule 1 sets when each rule starts.
We opened this on 2026-11-01
Rule 1 publication wording corrected; transition periods unchanged by this instrument. Opened 1 November 2026.
Status not confirmed
Status not confirmed — checked 2026-11-01
Gazette of India, Extraordinary, 13 November 2025. Sets when each section of the Act starts.
Verified — 2026-11-01
Notified — checked 2026-11-01. Opened G.S.R. 843(E) (Gazette PDF).
Citation
Kokate, S. (2026). DPDP Act deadlines: what happens in 2026 vs 2027. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/dpdp-deadlines-2026-2027. Educational content, not legal advice.
Planning dates — How we count the dates.