DPDP Rules 2025 timeline: key dates to May 2027
Reviewed against the law as of 28 September 2026
The DPDP Rules 2025 were notified on 14 November 2025 with an 18-month phase-in. What applied first, what starts in November 2026 and in May 2027.
India passed the Digital Personal Data Protection Act in August 2023, but most of it could not operate until the government made rules. The DPDP Rules, 2025 were notified on 14 November 2025, and they bring the Act into force in phases over eighteen months.
The three phases
| Phase | When | What applies |
|---|---|---|
| 1 | From notification, November 2025 | Establishment and functioning of the Data Protection Board of India, and related provisions |
| 2 | Twelve months after notification, November 2026 | Registration and obligations of Consent Managers |
| 3 | Eighteen months after notification, May 2027 | The substantive obligations of Data Fiduciaries: notice, consent, security safeguards, breach notification, erasure, children's data, rights of Data Principals and Significant Data Fiduciary duties |
The exact commencement date of each provision is set by notification in the Official Gazette. Commentators differ by a day on some dates, so confirm against the Gazette rather than secondary sources, including this one.
Earlier milestones
| Date | Event |
|---|---|
| 11 August 2023 | The DPDP Act, 2023 (No. 22 of 2023) receives Presidential assent and is published |
| January 2025 | Draft DPDP Rules published for consultation |
| 14 November 2025 | Final DPDP Rules notified, after thousands of consultation inputs |
What eighteen months means in practice
Eighteen months sounds long, but the work has long lead times:
- Inventory first. Finding every system that holds personal data, including test copies and exports, often takes the first quarter.
- Engineering changes. Consent capture, withdrawal propagation, retention jobs and erasure across systems need design and release cycles.
- Contracts. Processor agreements need renegotiation to cover security, breach notice and deletion.
- Processes. Breach playbooks, rights request handling within ninety days and grievance redressal need owners and rehearsal.
A reasonable plan is to finish discovery and the security baseline by the end of 2026, notices, consent and rights processes in early 2027, and spend the final months on evidence and rehearsal.
Obligations that already apply
The CERT-In Directions of 28 April 2022 are already in force. They require reportable cyber incidents to be reported within six hours, logs to be kept for 180 days within India, and clocks synchronised to NIC or NPL time servers. Security work done for CERT-In also supports the DPDP duty to take reasonable security safeguards.
Sector regulators such as the RBI, SEBI and IRDAI also have their own data and cyber security requirements, which continue to apply.
What to do this quarter
- Name an owner for DPDP readiness and agree the plan with leadership.
- Start an automated inventory of systems and personal data.
- Fix the obvious security gaps: public storage, missing MFA, missing encryption and logging.
- List your processors and start contract reviews.
- Draft updated notices and the consent withdrawal process.
See the DPDP compliance checklist for the full list of work.
Frequently asked questions
What is the DPDP compliance deadline?
Most Data Fiduciary obligations apply eighteen months after the Rules were notified on 14 November 2025, which is May 2027. Confirm the exact commencement date for each provision in the Gazette notifications.
Is there a grace period after May 2027?
No general grace period has been announced. The eighteen-month phase-in is the transition period.
When do Consent Managers start?
The Consent Manager provisions apply twelve months after notification, in November 2026, so registered Consent Managers can be operating before the main obligations begin.
Sources
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
- Digital Personal Data Protection Rules, 2025 (MeitY)meity.gov.in
- Digital Personal Data Protection Act, 2023 (MeitY)meity.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.