DPDP Act updates and timeline
Every DPDP Act milestone, deadline and government move, newest first. We update this page whenever MeitY or the Data Protection Board publishes something new.
As of 26 October 2026, the DPDP Rules, 2025 are notified, consent manager rules start on 13 November 2026, and the main duties for businesses apply from 13 May 2027 (188 days away). A proposal to bring the deadline forward to 13 November 2026 has not been notified.
- Upcoming
Main DPDPA duties apply
Rules 3, 5–16, 22 and 23 take effect: notice, security safeguards, breach reporting, retention, contact person, children's data, rights, Significant Data Fiduciary duties and cross-border transfers. The Data Protection Board can impose penalties for breaches of these duties.
- Upcoming
Consent manager rules take effect
Rule 4 starts: consent managers (companies incorporated in India with net worth of at least ₹2 crore) can register with the Data Protection Board.
- Done
Removal of Difficulties Order clarifies Sections 9 and 10
MeitY's DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated 5 October 2026) fixes two wording points: verifiable consent covers personal data 'of a child or of a person with disability who has a lawful guardian' (Section 9(1)), and Significant Data Fiduciaries need a periodic 'data audit' (Section 10(2)(c)(ii)). No new duties and no change to the 13 May 2027 date.
Source: Mondaq
- Done
Applications invited for the Data Protection Board
MeitY invited applications for the Chairperson and Members of the Data Protection Board of India. As of October 2026, no appointments had been reported.
Source: Storyboard18
- Proposed, not notified
Proposal to shorten the compliance window to 12 months
MeitY consulted stakeholders (comments by 4 February 2026) on cutting the 18-month window to 12 months, which would move the main deadline to 13 November 2026, and on bringing forward Significant Data Fiduciary and cross-border provisions. As of October 2026, no amendment had been notified, so 13 May 2027 stands.
Source: Chambers and Partners
- Done
DPDP Rules, 2025 notified
The government notified the Digital Personal Data Protection Rules, 2025. Rules 1, 2 and 17–21 (the Data Protection Board) took effect immediately; the rest are phased over 12 and 18 months.
- Done
Draft DPDP Rules published
MeitY published the draft DPDP Rules for public consultation.
- Done
DPDP Act, 2023 enacted
The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) received Presidential assent.
Latest DPDP news
- Consent manager rules under the DPDP Act start on 13 November 2026: what businesses should know (2026-10-27)
- Government clarifies DPDP Act wording on children, persons with disability and data audits (2026-10-06)
- SBI data breach exposes 3,897 customers' details: what it means under the DPDP Act (2026-10-21)
What to do now: follow the DPDPA 2027 roadmap, take the readiness checker, or read the complete DPDP Act guide.