The DPDPA compliance deadline is 13 May 2027. From that date, every business that processes digital personal data in India must give DPDP Rule 3 notices, collect valid consent, apply Rule 6 security safeguards, report breaches to the Data Protection Board within 72 hours, follow retention and erasure rules, protect children's data and answer rights requests within 90 days. A typical business needs 4 to 6 months to get ready, so work should start by November 2026.
- Main deadline
- 13 May 2027
- Consent managers
- 13 November 2026
- Time needed
- Typically 4–6 months
- Max penalty
- ₹250 crore
Why 13 May 2027?
The DPDP Rules, 2025 were notified on 13 November 2025. Rule 1 brings most of them into force 18 months later, on 13 May 2027. The Data Protection Board rules applied at once, and the consent manager rules (Rule 4) apply after 12 months, from 13 November 2026. In January 2026 MeitY consulted on cutting the 18 months to 12; as of October 2026 no amendment had been notified, so 13 May 2027 stands.
| From | What applies | Rules |
|---|---|---|
| 13 November 2025 | Definitions and the Data Protection Board of India (set-up, procedure, appeals) | Rules 1, 2, 17–21 |
| 13 November 2026 | Registration and duties of consent managers | Rule 4 |
| 13 May 2027 | All remaining duties: notice, consent, security, breach reporting, retention, children's data, rights, significant data fiduciaries, cross-border transfer | Rules 3, 5–16, 22, 23 |
What becomes mandatory on 13 May 2027
| Duty | Rule | What you must have in place |
|---|---|---|
| Notice | Rule 3 | A standalone, plain-language notice for every collection point |
| Consent | Section 6 | Unticked opt-ins, purpose-wise consent, easy withdrawal and consent records |
| Security | Rule 6 | Encryption or masking, access control, logs kept for 1 year, backups, processor contracts |
| Breach reporting | Rule 7 | Process to notify individuals and the Board, with a detailed report in 72 hours |
| Retention | Rule 8 | Retention schedule and erasure; 3-year inactivity rule for large platforms |
| Contact person | Rule 9 | Published DPO or contact details on website and app |
| Children's data | Rules 10–12 | Verifiable parental consent for under-18s |
| Rights | Rule 14 | Access, correction, erasure, nomination and grievance process, answered within 90 days |
| Significant Data Fiduciaries | Rule 13 | India-based DPO, annual DPIA and audit |
| Cross-border transfer | Rule 15 | Follow any government restrictions on transfers |
Month-by-month plan to 13 May 2027
| Month | Focus | Output |
|---|---|---|
| November 2026 | Ownership and data mapping | A named owner, a list of systems and a record of processing |
| December 2026 | Gap assessment | Gaps against each duty, ranked by risk |
| January 2027 | Notices and consent | New notice, privacy policy, opt-in wording and withdrawal flow |
| February 2027 | Vendors and security | Data processing clauses signed; access control, encryption and log retention checked |
| March 2027 | Breach and retention | Breach response plan with 72-hour report template; retention schedule |
| April 2027 | Rights and training | Rights request process, published contact person, staff training |
| 1–12 May 2027 | Final check | Go-live review against the checklist; new forms and notices live |
Starting later? Prioritise what carries the biggest penalties and is visible from outside: security safeguards (₹250 crore), breach reporting and children's data (₹200 crore each), then notices and consent on your website and forms. The full task list is in the DPDP compliance checklist.
What to do before 13 November 2026
- Decide whether you will use a registered consent manager; registrations open under Rule 4 from 13 November 2026.
- Re-permission old marketing lists, since consent collected before the Act needs a fresh notice (Section 5(2)).
- Budget for the work: the DPDPA has no transition period after 13 May 2027.
Frequently asked questions
What is the DPDPA compliance deadline?
13 May 2027 for most duties of businesses (notice, consent, security, breach reporting, retention, children's data and rights). Consent manager rules apply from 13 November 2026.
Has the DPDPA 2027 deadline been brought forward?
No, not as of October 2026. MeitY consulted in January 2026 on shortening the period to 12 months (13 November 2026), but no amendment had been notified.
Is there a grace period after 13 May 2027?
No. From 13 May 2027 the duties apply in full and the Data Protection Board can inquire into breaches and impose penalties.
How long does DPDPA compliance take?
Typically 4 to 6 months for a small or mid-sized business, longer for companies with many systems, vendors or children's data.
What happens if my business is not DPDPA compliant by May 2027?
You risk penalties up to ₹250 crore per breach, set by the Data Protection Board after an inquiry, plus loss of customer and partner trust. Larger clients are already asking vendors to show DPDPA readiness in contracts.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.