DPDP Act deadline: what actually changes on 13 November 2026

The Digital Personal Data Protection Rules were notified on 13 November 2025, and the dates that followed are misquoted everywhere. The version I hear most is "DPDP goes live in November 2026." It doesn't, at least not in the way most people mean.

13 November 2026 is the day the plumbing switches on, not the day your obligations do. If you use that confusion as a reason to wait until 2027, you will be building under pressure, possibly under a shorter deadline than you planned for, and with a regulator that will have had a year to staff up.

I'm building DPDP readiness programs for Indian companies right now, and the sentence I hear most is "we have till 2027." Here is what that sentence leaves out.

The three dates in the DPDP Rules

The Rules were phased. The provisions that set up the Data Protection Board took effect on notification in November 2025. Rule 4, which governs consent managers, takes effect one year later, on 13 November 2026. Almost everything else, the rules that create work for you, takes effect 18 months after notification, on 13 May 2027.

That third group is the one that matters for most companies. It includes Rule 3 on notices, Rule 6 on reasonable security safeguards, Rule 7 on breach intimation, Rule 8 on erasure and retention, Rule 10 on verifiable parental consent for children, Rule 13 on Significant Data Fiduciaries and Rule 14 on data principal rights.

What switches on in November

From 13 November, companies can register with the Board as consent managers. These are intermediaries that let a person give, review and withdraw consent across many companies from one place. If you've used an RBI Account Aggregator, you've seen the model already.

For most businesses, November changes nothing you are legally required to do that day. It does change who might start sitting between you and your users, and your consent records will eventually need to work with theirs. I've covered that separately in the consent manager explainer.

The proposal that could move everything

On 23 January 2026, MeitY met industry stakeholders and floated cutting the compliance runway from 18 months to 12. If notified, that would move the May 2027 obligations to 13 November 2026. Comments were due by 4 February.

As of early September no amendment had been notified, and no withdrawal either. You are planning against a date that might move forward by six months with very little warning. A plan that only works if the government changes nothing is not much of a plan.

The Board nobody has met yet

LiveLaw described the Data Protection Board in August as "established in law, absent in fact". MeitY circulated calls for a chairperson and four members in May and June, and as of August no appointments had been made.

You might read that as a reason to relax. I read it as the calm period. The Board will be staffed before May 2027, and the first complaints it hears will be about companies whose notices and consent flows are visibly wrong on their own websites.

If your privacy policy still says "we may share your data with trusted partners" and nothing more, you know who I mean.

What to build between now and May

A data map comes first: what personal data you collect, why, where it is stored, who can access it and which processors touch it. Every other obligation depends on it.

Then a Rule 3 notice that stands on its own, lists the data and the specific purpose, and tells people how to withdraw consent, exercise their rights and complain to the Board. Then consent records per purpose, with withdrawal that actually stops the processing.

Rule 6 asks for reasonable security safeguards, including encryption or masking, access control, and logs kept for at least a year. Rule 7 asks you to tell affected people without delay and send the Board a detailed report within 72 hours of becoming aware of a breach. Rule 14 gives you up to 90 days to answer rights requests, so you need a process that can find a person's data in every system.

Finally, your processor contracts. This is the slowest part, because it depends on vendors who are in no hurry.

The penalties are in the Schedule to the Act: up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach. They are per instance, which is worth reading twice.

We track each DPDP obligation in Steppe against the rule that creates it, so when a date moves, the plan moves with it. Whatever you use, make sure your plan is tied to the rule numbers, not to a single deadline someone wrote on a slide.

The companies that treat May 2027 as a starting line will spend the following year explaining to customers why they weren't ready.