DPDP Rules 2025 timeline: every compliance deadline your team needs to know

The Digital Personal Data Protection (DPDP) Rules, 2025 were notified on 13 November 2025 and take effect in three phases. The Data Protection Board and the rules on how it works came into force that day. Consent manager registration starts one year later, on 13 November 2026. Nearly every obligation on businesses, from consent notices and security safeguards to breach reporting and user rights, applies from 13 May 2027, eighteen months after notification.

As of 24 October 2026, we have found no notification changing those dates, although the government has said publicly that it wants to shorten the 18-month window. This guide sets out each date, what it means in practice, and what HR, compliance and business teams should finish before it arrives.

What are the key DPDP compliance dates?

The dates come from two notifications published in the Gazette of India on 13 November 2025. G.S.R. 843(E) brings sections of the DPDP Act, 2023 into force, and G.S.R. 846(E) contains the Rules themselves.

A note on counting. The notifications say “one year” and “eighteen months” from the date of publication. In an August 2026 Lok Sabha answer, MeitY gave the notification date as 13 November 2025, and most commentators therefore use 13 November 2026 and 13 May 2027. Some law firms count the later dates as 14 November 2026 and 14 May 2027. The difference is one day. Plan to the earlier date.

What came into force on 13 November 2025?

Phase one built the regulator. It did not yet regulate businesses. The provisions that started that day were:

• Definitions (section 2) and the sections that establish the Data Protection Board of India and set out its composition, members’ terms and procedure (sections 18 to 26).
• The government’s rule-making powers and other general provisions (sections 35 and 38 to 43).
• Two amendments to other laws. TDSAT becomes the appellate tribunal for DPDP matters (section 44(1)), and the Right to Information Act’s exemption for personal information is widened (section 44(3)). The second matters to public authorities answering RTI requests.
• Rules 1, 2 and 17 to 21, which cover the search-cum-selection committees for Board appointments, members’ pay, Board meetings, the Board working as a digital office, and its staff.

Notice and consent requirements, security safeguards, breach reporting, data principal rights and penalties did not start. The Board’s power to inquire into complaints against data fiduciaries also waits until May 2027.

Is the Data Protection Board working yet?

Not fully, on the public record. MeitY invited applications for one Chairperson and four Members on 6 May 2026, and told the Lok Sabha on 12 August 2026 that the advertisement appeared in Employment News on 6 June 2026. LiveLaw reported on 1 August 2026 that no Chairperson or Members had been appointed.

In early October 2026, in a public interest case about Digi Yatra passenger data, the Centre told the Kerala High Court that the Board had been constituted but not yet made functional. The court said it expected the Board to be made functional within eight weeks. As of 24 October 2026, we have not seen an official announcement of appointments.

What to do now

• Name one person who owns DPDP readiness and give them a budget and a deadline.
• List where personal data sits: HR and payroll systems, CRM, helpdesk, shared drives, CCTV, vendor tools.
• Remember the current law still applies. Section 43A of the IT Act, 2000, and the rule-making power behind the 2011 “reasonable security practices” rules, are removed only when section 44(2) commences on 13 May 2027.

What happens on 13 November 2026?

Section 6(9) of the Act and Rule 4 commence. From this date, every consent manager must be registered with the Data Protection Board. The Act defines a consent manager as a person registered with the Board who acts as a single point of contact for individuals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.

Part A of the First Schedule sets the conditions. They include:

• The applicant must be a company incorporated in India.
• Its net worth must be at least ₹2 crore.
• It needs sufficient technical, operational and financial capacity, sound management, and directors and senior staff with a record of fairness and integrity.
• Its platform must be independently certified as meeting the data protection standards the Board publishes.

The Board decides applications and publishes the details of registered consent managers on its website.

Who this affects. Mainly companies that want to become consent managers. For most organisations, 13 November 2026 creates no new duty. The individual’s right to give or withdraw consent through a consent manager (section 6(7)) commences with the rest of section 6 in May 2027.

What is uncertain. Rule 4 says applicants must furnish the particulars the Board publishes on its website. When asked in the Lok Sabha in August 2026 whether any consent managers had been registered, the government’s answer described the phases but gave no date for applications to open. With the Board not yet functional in early October, it is unclear whether applications will be accepted from 13 November itself.

What must be in place by 13 May 2027?

This is the main compliance deadline. From this date, Rules 3, 5 to 16, 22 and 23 apply, together with the core sections of the Act. In plain terms:

• Notices (Rule 3). A standalone notice in clear, plain language, listing the personal data collected and the specific purpose, with a link to withdraw consent as easily as it was given.
• Security safeguards (Rule 6). Encryption, masking or similar measures, access controls, logs and monitoring, backups, and security clauses in contracts with data processors. Logs must be kept for one year unless another law says otherwise.
• Breach reporting (Rule 7). Tell each affected person without delay. Tell the Board without delay, then send a detailed report within 72 hours of becoming aware, unless the Board allows longer.
• Retention and erasure (Rule 8). Large e-commerce entities and social media intermediaries (2 crore or more registered users in India) and online gaming intermediaries (50 lakh or more) must erase data three years after a user’s last contact, with 48 hours’ notice before erasure. All data fiduciaries must keep personal data, traffic data and processing logs for at least one year.
• A contact point (Rule 9). Publish the contact details of a Data Protection Officer or another person who can answer questions about processing.
• Children and persons with disabilities (Rules 10 to 12). Verifiable consent from a parent or lawful guardian, with limited exemptions such as healthcare and education.
• Significant data fiduciaries (Rule 13). A Data Protection Impact Assessment and an audit every twelve months, due diligence on algorithmic software, and localisation of any personal data the government specifies.
• Rights and grievances (Rule 14). Publish how people can request access, correction or erasure, and respond to grievances within 90 days.

Penalties start on the same date. Under the Schedule to the Act, failing to take reasonable security safeguards can attract up to ₹250 crore, failing to notify a breach or meet children’s data obligations up to ₹200 crore each, and other breaches of the Act or Rules up to ₹50 crore.

HR teams should note that the Act allows employee data to be processed for employment purposes without consent (section 7(i)). The security, breach reporting and retention duties still apply to that data.

Could the 18-month deadline be brought forward?

It could, but it has not happened yet. On 17 November 2025, four days after the Rules were notified, Electronics and IT Minister Ashwini Vaishnaw was quoted as saying, “We are in discussions with the industry to further compress the timeline required for compliance.”

On 22 January 2026, Business Standard reported, citing unnamed sources, that MeitY was likely to cut the timeline for certain provisions to 12 months for significant data fiduciaries. Law firm S.S. Rana & Co. later described proposals from a 23 January stakeholder meeting. They included a 12-month deadline of 13 November 2026, bringing cross-border transfer restrictions into force immediately, and starting the one-year log retention rule within three months. Comments were sought by 4 February 2026.

These were reported proposals, not law. As of 24 October 2026, we have found no gazette notification amending the commencement dates, so 13 May 2027 remains the legal deadline. Any change would most likely bring dates forward, not push them back. Plan for May 2027, but aim to be ready earlier if your organisation is likely to be named a significant data fiduciary.

What should your team do before each date?

Before 13 November 2026

• Finish the data inventory. You cannot write notices or retention schedules for data you have not found.
• If you plan to become a consent manager, check the ₹2 crore net worth condition, your memorandum and articles, and the independent certification requirement.
• Review vendor contracts that involve personal data and note which need security and breach clauses.

December 2026 to February 2027

• Draft standalone notices for each purpose, starting with customers and job applicants.
• Write a breach response procedure that can meet the 72-hour report to the Board, with named people and out-of-hours contacts.
• Set retention periods for each data set, including the one-year minimum for logs.
• Check whether you process children’s data and how you will verify parental consent.

March 2027 to 13 May 2027

• Publish your contact point and the process for rights requests, and test that you can answer within 90 days.
• Run a breach drill using a realistic scenario, such as a payroll sheet sent to the wrong email list.
• Train staff on the new procedures once they exist, so the training matches what people will actually do.

After 13 May 2027

• Keep evidence: notices issued, consents recorded, breaches logged, requests answered.
• Review the programme after the first few months and after any Board guidance or rule change.

How does awareness training fit into the timeline?

Most DPDP duties are carried out by ordinary staff, not the compliance team. A support agent decides whether a caller is really the account holder. An HR executive chooses who receives the salary file. A manager notices a misdirected email and either reports it in time for the 72-hour report or does not. Rule 6 asks for appropriate technical and organisational measures, and training is one common organisational measure.

Timing matters. Training before your procedures are written tends to stay abstract, and training after May 2027 is late. For most organisations, the useful window is early 2027, with role-based sessions for teams that handle the most personal data. The Act and Rules do not set up any official certification for DPDP training; what counts is that people know what to do.

AuditDPDP runs DPDP awareness sessions built around specific industries and the applications your teams use every day, such as HR and payroll systems. If you want to plan sessions around these dates, get in touch.

This article is general information, not legal advice. AuditDPDP is an independent training provider and is not affiliated with MeitY or the Data Protection Board of India. Dates are as notified in the Gazette and reported up to 24 October 2026.