DPDP Act 2023 Compliance Deadlines & Enforcement Dates (India)

The Digital Personal Data Protection Act, 2023 was passed in 2023 and comes into force in stages. Its obligations on Data Fiduciaries take effect on 13 May 2027, the same day as Rules 3, 5 to 16, 22 and 23. That date is fixed in the Gazette. The work it requires is not a quarter of effort: notices, consent records, withdrawal and erasure propagation, breach procedure and rights handling are multi-month builds. An organisation that starts in 2027 will not be ready.

This timeline maps every material date in the DPDP enforcement roadmap. Print it. Share it with your legal counsel. Build your project plan around it.

August 11, 2023: Presidential Assent

The DPDP Act received Presidential assent on August 11, 2023, and was published in the Gazette of India the same day. This established the legislative foundation for India’s first dedicated data protection statute.

The Act itself does not prescribe specific compliance timelines. It delegates that authority to the Central Government, which determines enforcement dates through subordinate rules and official notifications.

What this means for your organisation: assent fixed the text, not the start date. Section 1(2) leaves commencement to the Central Government, which may appoint different dates for different provisions. It did. The obligations arrived with those notifications, not with assent.

2024: The Rules Drafting Period

Through 2024, the Ministry of Electronics and Information Technology (MeitY) undertook the drafting of the Digital Personal Data Protection Rules. This period involved consultations with industry bodies, legal experts, and data protection practitioners.

No draft was made publicly available during this period. Organisations operated in a planning vacuum, knowing the Act existed but lacking the procedural specifics required to build compliant systems.

Companies that used this window to begin internal data mapping, consent architecture planning, and vendor assessments now hold a measurable advantage. Those that waited have compressed their remediation window significantly.

January 3, 2025: Draft DPDP Rules Published

The Draft Digital Personal Data Protection Rules, 2025 were released for public consultation on January 3, 2025. This was the first detailed specification of how the Act’s provisions would be operationalised.

Key provisions addressed in the January 2025 draft include:

• Consent Manager registration requirements. The rules define who qualifies as a Consent Manager, the registration process with the Data Protection Board, and the technical and financial criteria applicants must satisfy.
• Data Fiduciary obligations. Specific requirements for notice content, consent collection mechanisms, data retention timelines, and the 72-hour breach notification procedure.
• Rights of Data Principals. Operational procedures for handling access requests, correction requests, and consent withdrawal.
• Significant Data Fiduciary classification. Criteria for determining which organisations face enhanced obligations, including mandatory Data Protection Impact Assessments and independent audits.
• Cross-border data transfer provisions. Transfers outside India are permitted unless the Central Government restricts a country by notification under Section 16(1).

The public consultation period invited written comments from stakeholders. The final rules are expected to incorporate revisions based on this feedback.

For a full breakdown of the Act’s provisions, see What is the DPDP Act?.

November 13, 2025: DPDP Rules Notified

The Digital Personal Data Protection Rules were notified on 13 November 2025, converting the January 2025 draft into notified Rules. Only Rules 1, 2 and 17 to 21 took effect that day; the rest follow on 13 November 2026 and 13 May 2027. The notification activated several processes at once:

The commencement notification of 13 November 2025 also brought the Act’s own framework sections into force on that date: Section 2 (definitions), Sections 18 to 26 (the Data Protection Board), and the rule-making powers. The obligations on Data Fiduciaries were not among them.

1. Data Protection Board constitution. The Data Protection Board of India is established in law as the adjudicatory authority. As of September 2026 it has no Chairperson or Members appointed.
2. Consent Manager registration framework. The criteria for registering as a Consent Manager are fixed in Rule 4, which applies from 13 November 2026.
3. Operative obligations defined. Breach notification procedure, Significant Data Fiduciary duties, and consent and notice requirements now sit in the Rules rather than in a draft.

The draft-to-final delta was procedural, not structural. Organisations that began implementation against the January 2025 draft did not lose work. Those that waited for notification face a compressed runway to 13 May 2027.

November 2026: Consent Manager Registration Becomes Mandatory

Rule 4 of the DPDP Rules 2025 applies from 13 November 2026. From that date, registration with the Data Protection Board is mandatory for anyone operating as a Consent Manager in India. The Rules are final, notified on 13 November 2025, not draft. Organisations intending to operate as Consent Managers must complete registration to continue.

Registration requirements, as specified in the Rules, include:

• A company incorporated in India
• Net worth of not less than ₹2 crore
• Sound financial condition
• An interoperable platform
• Memorandum and articles that prevent conflicts of interest
• Fit and proper directors and key managerial personnel

This registration creates a regulatory moat. From 13 November 2026, unregistered entities cannot operate as Consent Managers in India. Organisations building consent infrastructure should evaluate whether Consent Manager registration aligns with their strategic position.

13 May 2027: The Obligations Take Effect

On 13 May 2027 the substantive obligations of the Act commence: notice under Section 5, consent under Section 6, general obligations and security safeguards under Section 8, children’s data under Section 9, Significant Data Fiduciary duties under Section 10, and Data Principal rights under Sections 11 to 14. The penalty provisions, Sections 28 to 34, commence the same day, as do Rules 3, 5 to 16, 22 and 23. This is the date by which organisations must demonstrate operational compliance. For a plain statement of which instruments are notified, in force, or still pending, see the DPDP Rules notification status page.

The window to reach compliance readiness must accommodate:

• Data mapping and classification. Identifying all personal data processing activities, data flows, and storage locations.
• Consent infrastructure deployment. Implementing compliant consent collection, storage, and withdrawal mechanisms across all data touchpoints.
• Policy and notice updates. Revising privacy policies, consent notices, and data processing agreements to meet DPDP Act requirements.
• Technical controls. Deploying data retention enforcement, access controls, breach detection, and audit logging.
• Organisational readiness. Appointing a Data Protection Officer (where required), training staff, and establishing grievance redressal procedures.
• Vendor compliance. Ensuring all Data Processors (third-party vendors processing personal data) meet contractual and regulatory obligations.

The runway is not generous. Organisations with complex data architectures, multiple product lines, or significant third-party integrations should treat this as a compressed timeline.

Track the full obligation set in the 26-point DPDP Compliance Checklist.

Post-Enforcement: The Penalty Regime

From 13 May 2027, non-compliance carries material financial consequences. The DPDP Act’s highest penalty tier is INR 250 crore (approximately USD 30 million), reserved for failure to implement reasonable security safeguards under Section 8(5). Failure to notify the Data Protection Board and affected Data Principals of a breach carries a separate tier of up to INR 200 crore under Section 8(6).

The penalty structure is designed to make non-compliance more expensive than compliance. The Data Protection Board will have adjudicatory powers to investigate complaints, conduct inquiries, and impose penalties.

For the complete penalty framework, see DPDP Penalties and Enforcement.

What This Means for Your Organisation

The timeline compresses from this point forward. Every month of delay reduces the implementation runway and increases the likelihood of non-compliance at enforcement.

The organisations that will be compliant on 13 May 2027 are the ones acting now. If you have not started, the next step is a structured gap assessment to identify your current posture and prioritise remediation.

Run a Free DPDP Gap Assessment to identify where your organisation stands against the DPDP Act’s requirements and receive a prioritised remediation roadmap.

To see what operational compliance costs before the runway shortens further, review ConsentOS plans. Implementation plus operation from ₹2,999 per month.