The DPDP Rules were notified on 13 November 2025. Board provisions took effect then, consent-manager registration follows after one year (around 13 November 2026), and most duties for businesses are scheduled for 13 May 2027. A proposal to shorten the 18-month period was discussed in January 2026, but we found no notification confirming it.
- Dates come from the Gazette notifications of 13 November 2025.
- Treat any shorter timeline as a possibility and verify before relying on dates.
- A 90-day plan can cover data mapping, notices, access and vendors.
Key dates
| Date | What happens |
|---|---|
| 13 November 2025 | Act commencement and Rules notified; provisions that set up the Data Protection Board take effect |
| About 13 November 2026 | Consent-manager registration framework (Rule 4) starts, one year after publication |
| 13 May 2027 | Most substantive duties for Data Fiduciaries scheduled, eighteen months after publication |
Last checked: 3 November 2026.
The proposal to shorten the timeline
In January 2026, trade press reported that MeitY was considering shortening the 18-month period to as little as 12 months for some obligations, particularly for Significant Data Fiduciaries. In the sources we checked on 3 November 2026 we did not find a notification that does this. Read the Gazette and MeitY’s site for updates, and plan so that a shorter period would not catch you off guard.
A 90-day plan to use the time
| Month | Focus | Output |
|---|---|---|
| Month 1 | Map data and vendors | Data list, vendor list, owners |
| Month 2 | Fix the basics | Updated notices, access clean-up, retention rules |
| Month 3 | Prepare to respond | Request process, incident plan, staff briefing |
After the first 90 days
Readiness is not a one-time project. Schedule a review each quarter, keep an eye on notifications and update your records when you add new tools or services.
Frequently asked questions
Do I have to wait until 2027 to do anything?
No. Mapping data, tightening access and improving notices are good practice now, and they take time.
Where will changes be published?
In the Gazette of India and on MeitY’s website. Check those rather than relying on summaries, including ours.
Sources
- Gazette: G.S.R. 843(E), Act commencement notification, 13 November 2025
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
- MeitY: DPDP Rules, 2025 publication page
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.