Updated · RuleFix by Vinkura
The timeline at a glance
The Digital Personal Data Protection Act, 2023 (DPDP Act) only bites once its Rules are in force. The Rules were notified on 13 November 2025 and switch on in three phases counted from that date.
| When | Rules | What it covers |
|---|---|---|
| 13 Nov 2025 (on notification) | Rules 1, 2 and 17–21 | Definitions and the Data Protection Board of India: how it is constituted and works. |
| About 13 Nov 2026 (12 months) | Rule 4 | Registration and duties of Consent Managers. |
| About 13 May 2027 (18 months) | Rules 3, 5–16, 22 and 23 | The obligations most products must build: notice, security safeguards, breach notification, retention and erasure, children's data, Significant Data Fiduciaries, data principal rights, cross-border transfer and government requests. |
Some trackers count the dates as 14 November and 14 May. MeitY has discussed shortening the 18-month window, but no shorter timeline had been notified as of October 2026; a Removal of Difficulties Order on 5 October 2026 corrected wording in sections 9(1) and 10(2)(c)(ii) without changing the phases.
What applies today
The Data Protection Board exists and the Act's definitions are settled, so this is the period to design systems that will comply on day one rather than retrofit them. Engineering work that takes longest — consent records, data inventories, retention jobs and audit logging — should start now.
- Map where personal data enters, is stored, logged and sent to third parties (including analytics and LLM providers).
- Stop writing personal data and identifiers such as Aadhaar or PAN into logs; logs are kept for at least a year under Rule 6 and widen any breach.
- Record consent as data: who agreed, to which notice version, for which purpose, and when they withdrew.
November 2026: Consent Managers (Rule 4)
Consent Managers are registered intermediaries that let people give, review and withdraw consent across many services. Rule 4 and the First Schedule set who can register (an Indian company with a net worth of at least ₹2 crore, among other conditions) and how they must operate.
Most products will not become Consent Managers, but should be ready to accept and honour consent artefacts from one: keep consent machine-readable, versioned and revocable through an API, not just a checkbox in a database column.
May 2027: the obligations to build
| Rule | Requirement | Engineering work |
|---|---|---|
| Rule 3 | Clear, itemised notice before consent | Versioned notices, plain-language purpose lists, a link to withdraw consent as easily as it was given. |
| Rule 6 | Reasonable security safeguards | Encryption, access control, monitoring, and logs of access to personal data kept for at least one year. |
| Rule 7 | Breach notification | Inform affected people and the Board without delay, then a detailed report to the Board within 72 hours. |
| Rule 8 | Retention and erasure | Erase data once its purpose is served; warn the person 48 hours before erasure where a retention period applies. |
| Rule 10 | Children's data | Verifiable consent of a parent or guardian before processing a child's personal data. |
| Rule 13 | Significant Data Fiduciaries | A Data Protection Impact Assessment and an audit every 12 months, plus checks on algorithmic software. |
| Rule 14 | Data principal rights | Publish how to exercise rights; resolve grievances within at most 90 days. |
Penalties under the Act's Schedule reach ₹250 crore for failing to take reasonable security safeguards, and ₹200 crore for failing to notify a breach.
Checking your code for DPDP issues
Many DPDP failures are visible in code: personal data in logs, Aadhaar numbers stored in plaintext, sign-ups that never record consent. RuleFix checks for these on every change.
npx -y @rulefix-ai/cli scan --framework dpdpThis guide explains engineering work, not legal advice. Dates are counted from the Rules' notification on 13 November 2025; confirm them against the official Gazette text and your counsel, as MeitY may amend the timeline.
Related RuleFix rules
FAQ
When were the DPDP Rules notified?
On 13 November 2025, as G.S.R. 846(E). Their obligations phase in over 18 months from that date.
When do most DPDP obligations apply?
About 13 May 2027, 18 months after notification. That phase brings in notice, security safeguards, breach notification, retention and erasure, children's data and data principal rights.
When do the Consent Manager rules apply?
About 13 November 2026, 12 months after notification (Rule 4).
Has the DPDP timeline been shortened?
MeitY has discussed it, but as of October 2026 no shorter timeline had been notified. The October 2026 Removal of Difficulties Order fixed wording only.
