India notified the Digital Personal Data Protection Rules on 13 November 2025 and gave businesses an 18-month runway. Consent manager registration opens on 13 November 2026, and the core duties, backed by penalties of up to ₹250 crore, apply from 13 May 2027. This guide explains each phase, the January 2026 proposal to shorten the window, and the CERT-In rules that already apply.
Three phases, not one deadline
The DPDP Act, 2023 is being brought into force in stages by the DPDP Rules 2025. The Rules were published in the Gazette on 13 November 2025, and the provisions on the Data Protection Board and commencement took effect that day. The consent manager framework follows on 13 November 2026, and the bulk of the obligations start on 13 May 2027. That leaves an 18-month window between notification and full application. For most companies the real deadline is 13 May 2027, but the November 2026 date matters for anyone building or using consent manager services.
| Date | What happens |
|---|---|
| 13 November 2025 | DPDP Rules published; Data Protection Board and commencement provisions in force |
| January 2026 | MeitY consults on cutting the 18-month window to 12 months for some entities (proposal only) |
| 13 November 2026 | Consent manager registration framework (Rule 4) in force |
| 13 May 2027 | Notice, consent, security, breach reporting, children, rights, SDF duties and transfers in force; Section 43A of the IT Act repealed |
Phase one: the Board is already set up
Since 13 November 2025 the provisions establishing the Data Protection Board of India have been in force. Under the Rules, the Board is the body that receives breach reports and complaints from Data Principals once the substantive duties apply. The notice, consent and security duties themselves are not yet live in this phase. The time is meant for building the processes, contracts and systems those duties will need.
13 November 2026: consent managers
Rule 4, the consent manager registration framework, comes into force on 13 November 2026. It sets out how consent managers are registered under the DPDP regime, and it is the only major piece of the Rules that starts before May 2027.
If you plan to become a consent manager, this is when registration opens. If you are a Data Fiduciary, use the months before May 2027 to decide whether your consent flows will work with registered consent managers as well as with your own interface.
13 May 2027: the core obligations
On 13 May 2027 the main duties apply: notice, consent, reasonable security safeguards, breach reporting, children's data, data principal rights, Significant Data Fiduciary duties and cross-border transfers. Section 43A of the IT Act, 2000 is repealed on the same date, so contracts and policies that cite it will need updating. Breach reporting under Rule 7 will mean notifying the Board without delay and sending a detailed report within 72 hours of becoming aware, while also telling each affected Data Principal without delay.
The proposal to shorten the window
In January 2026, MeitY consulted on cutting the 18-month window to 12 months for some entities. This was a proposal only, and no amendment had been verified as notified at the time of writing. If the change were adopted, some companies could face the core duties earlier than 13 May 2027. Planning to be ready well before May 2027 removes that risk.
CERT-In rules already apply
The DPDP timeline does not delay cyber security reporting. CERT-In's Directions of 28 April 2022, in force since 28 June 2022, already require cyber incidents to be reported to CERT-In within 6 hours of noticing them, ICT logs to be kept for a rolling 180 days in India, and system clocks to be synchronised with NIC or NPL time servers. Failure to comply is punishable under Section 70B(7) of the IT Act with up to one year in prison, a fine of up to ₹1 lakh, or both.
Penalties from May 2027
Once the core duties apply on 13 May 2027, the penalties set in the Act come into play. The scale is high enough that security safeguards should be the first priority, followed by breach notification and children's data. Each figure below is a maximum for that type of failure.
| Failure | Maximum penalty |
|---|---|
| Reasonable security safeguards | Up to ₹250 crore per instance |
| Breach notification or children's obligations | Up to ₹200 crore |
| Significant Data Fiduciary duties | Up to ₹150 crore |
| Other breaches | Up to ₹50 crore |
A six-month plan
Between now and May 2027, map your personal data, redraft notices to the Rule 3 standard, rebuild consent and withdrawal flows, and test a breach process that meets both the 6-hour CERT-In and 72-hour DPDP clocks. Finish with a review of vendor contracts and transfer disclosures.
XDQ Labs builds web apps and SaaS for Indian teams preparing for these dates. To check a draft notice early, XDQ xAgents (https://xagents.xdqlabs.com) reviews a privacy policy against DPDP rules and lists the gaps. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
When do the DPDP Rules 2025 come into force?
In phases. The Rules were notified on 13 November 2025 with the Data Protection Board provisions in force immediately. Consent manager provisions apply from 13 November 2026, and the core obligations, including notice, consent and breach reporting, apply from 13 May 2027.
What happens on 13 November 2026 under DPDP?
Rule 4, the consent manager registration framework, comes into force. Entities that want to act as consent managers can register from that date. Most other Data Fiduciary duties still start on 13 May 2027.
Is the DPDP deadline being moved earlier?
In January 2026 MeitY consulted on cutting the 18-month window to 12 months for some entities. It was a proposal only, and no amendment had been verified as notified. Planning to be ready early is the safer course.
Does CERT-In reporting wait for the DPDP timeline?
No. CERT-In Directions have applied since 28 June 2022 and require incident reporting within 6 hours and 180 days of logs kept in India. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Khaitan & Co ERGO: Digital Personal Data Protection Rules (15 November 2025), Khaitan & Co, 2025
- AZB / Shardul Amarchand Mangaldas regulatory alert on DPDP Act enforcement and Rules, Shardul Amarchand Mangaldas & Co, 2025
- King Stubb & Kasiva: DPDP Act and Rules compliance deadline, King Stubb & Kasiva, 2026
- Mondaq: MeitY plans to cut short DPDP compliance timeline (proposal), Mondaq, 2026
- Digital Personal Data Protection Act, 2023 (India Code), India Code, Legislative Department, 2023
- DPDP Rules 2025, Rule 7 text (dpdpa.com), dpdpa.com, 2025
- Nishith Desai Associates: CERT-In Directions of 28 April 2022, Nishith Desai Associates, 2022
