DPDP Rules status: compliance window active. Read the update

Skip to content
Data Privacy · Enforcement timeline

DPDP Act deadlines: what happens in 2026 vs 2027

2026 is the build year. 13 May 2027 is the hard deadline for notice, consent, security, breach response, and retention.

Educational only · not legal adviceLast updated: 5 October 2026Written and edited by Sandesh Kokate

Short answer

The DPDP Act started phasing in on 13 November 2025, but the obligations that affect most businesses do not become enforceable until 13 May 2027. Use 2026 to build your compliance systems; after May 2027, penalties apply.

The three dates

13 Nov 2025Already in force

Definitions, the Board sections, and some general sections started on this date. The rule-making Rules 1, 2 and 17 to 21 also started.

Act: Section 1(2), 2, 18–26, 35, 38–43, 44(1) and 44(3) · Rules 1, 2, 17–21 · G.S.R. 843(E)(a), Rule 1(2)

13 Nov 2026One year later

The Consent Manager sections and Rule 4 (Consent Manager registration) start.

Act: Section 6(9), 27(1)(d) · Rule 4 · G.S.R. 843(E)(b), Rule 1(3)

13 May 2027Eighteen months later

Most duties start. This covers notice, consent, security, breach reports, children's data, rights, cross-border transfers, penalties and the change to the IT Act.

Act: Sections 3–5, 6(1)–(8) and 6(10), 7–17, 27 (except 27(1)(d)), 28–34, 36, 37, 44(2) · Rules 3, 5–16, 22, 23 · G.S.R. 843(E)(c), Rule 1(4)

Official text — G.S.R. 843(E), 13 November 2025
(a) the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2, sections 18 to 26 sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44 of the said Act shall come into force; (b) one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force. (c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
Official text — DPDP Rules, 2025, Rule 1
(2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette. (3) Rule 4 shall come into force one year after the date of publication of this Gazette. (4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.

The old IT Act data rule ends on 13 May 2027

Today, Section 43A of the IT Act and its SPDI Rules still apply to your data security. Section 44(2) of the DPDP Act removes Section 43A. G.S.R. 843(E) starts Section 44(2) eighteen months after 13 November 2025. That is 13 May 2027.

Official text — DPDP Act, 2023, Section 44(2)
(2) The Information Technology Act, 2000 shall be amended in the following manner, namely:— (a) section 43A shall be omitted; (b) in section 81, in the proviso, after the words and figures “the Patents Act, 1970”, the words and figures “or the Digital Personal Data Protection Act, 2023” shall be inserted; and (c) in section 87, in sub-section (2), clause (ob) shall be omitted.

What's still open

Reported, not confirmed

Press reports say MeitY may cut the 18-month period to 12 months. We have not found a MeitY document that says this. Until one exists, 13 May 2027 stands.

Penalty ceilings from 13 May 2027

The Schedule sets these ceilings. The highest figure in the Act is ₹250 crore — there is no ₹10,000 crore tier.

Up to ₹250 croreFailure to take reasonable security safeguards
Up to ₹200 croreFailure to notify a personal data breach
Up to ₹200 croreFailure of the extra duties around children's data
Up to ₹150 croreFailure of the extra duties of a Significant Data Fiduciary
Up to ₹10,000Breach of a Data Principal's own duties
capped at the original breachBreaking a voluntary undertaking accepted by the Board
Up to ₹50 croreBreaking any other part of the Act or Rules

What this means for you

Founders

Treat 13 May 2027 as a ship date, not a kickoff. Notice, consent, breach response, and retention must be live by then.

Freelancers

Processor clauses in active client contracts need to be DPDP-ready before the deadline, not renegotiated under pressure.

Creators

Email lists, community sign-ups, and paid newsletters all fall under consent rules from 13 May 2027. Start documenting opt-ins now.

Status

EnforceablePhase 1 in force since 13 November 2025. Core obligations enforceable 13 May 2027.

Read next

Is the DPDP Act in force yet?

In force vs enforceable, explained.

Consent Manager

What a Consent Manager does and when registration opens.

Data Fiduciary obligations

Notice, consent, security, breach, and retention duties.

Retention & erasure

How long you may keep personal data and when you must delete it.

Primary sources

Source
MeitY — DPDP Act (Gazette PDF)

Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).

Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).

Source
MeitY — DPDP Rules, 2025 (Gazette PDF)

G.S.R. 846(E), 13 November 2025. Rule 1 sets when each rule starts.

Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).

Source
G.S.R. 843(E) — DPDP Act commencement notification

Gazette of India, Extraordinary, 13 November 2025. Sets when each section of the Act starts.

Notified — checked 2026-10-06. Opened G.S.R. 843(E) (Gazette PDF).

Citation

Kokate, S. (2026). DPDP Act deadlines: what happens in 2026 vs 2027. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/dpdp-deadlines-2026-2027. Educational content, not legal advice.

← Back to Data Privacy hubData Fiduciary obligations →

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.