DPDP Timeline

The DPDP Act — Where Things Stand

The compliance runway is shorter than it looks. Here’s the map from today to full enforcement.

The 18-month compliance runway

From notification of the DPDP Rules to full enforcement of Chapter II obligations.

Live Upcoming Critical deadline

Today · Oct 2026

Nov 2025 Phase 1

13 Nov 2026 Phase 2

13 May 2027 Phase 3

Phase 1 — Board established

Live since Nov 2025

Phase 2 — Consent managers

~2 weeks to go

Phase 3 — Core obligations

~28 weeks to go

The three phases

What’s in force, what’s next and what changes everything

The Digital Personal Data Protection Act moved from law to an operational reality in stages. Organisations that wait for enforcement to begin — before mapping their data, updating notices and standing up consent and grievance mechanisms — will be starting too late.

Phase 01 — Immediate

Data Protection Board goes live

11+ months in effect

Live

November 2025Effective on notification

These provisions took effect the day the rules were published in the Official Gazette.

Data Protection Board of India (DPBI) — the four-member Board has been formally established with powers to investigate complaints, conduct inquiries, and impose penalties.
Administrative provisions — rules governing the Board’s functioning, complaint procedures, and inquiry timelines.
Six-month inquiry deadline — all Board inquiries must be completed within six months (extendable by three months with written reasons).

Phase 02 — 12 months

Consent manager framework comes into force

~2 weeks from today

Upcoming

13 November 202612 months post-notification

By this date, the following provisions come into force.

Consent Manager Registration — organisations operating as consent managers must register with the Data Protection Board and comply with conditions for operation.
Consent Manager Conditions — registered consent managers must meet specific operational, technical, and financial requirements.
Board jurisdiction over consent managers — the DPBI gains authority to oversee consent manager compliance and investigate breaches of registration conditions.

Phase 03 — 18 months

The full compliance obligations begin

~28 weeks from today

Critical deadline

13 May 202718 months post-notification

This is when the core compliance obligations take effect — the deadline that shapes every planning conversation from here on.

Consent requirements — all personal data processing must have free, specific, informed, unconditional, and unambiguous consent.
Privacy notices — mandatory consent notices with the eight required elements (identity, data types, purpose, withdrawal method, rights, grievance mechanism, retention period, third-party sharing).
Data principal rights — businesses must have systems to handle access, correction, erasure, grievance, and nomination requests.
Security safeguards — reasonable security measures including encryption, access controls, and monitoring.
Breach notification — mandatory breach reporting to the Board and affected data principals.
Data retention limits — personal data must be deleted once the purpose is fulfilled.

Where does your organisation stand today?

A short readiness conversation is often enough to see whether you are on track for November 2026 — and, more importantly, for May 2027.

Check Your Readiness See How We Help