DPDP deadline

DPDP Compliance Deadline: 13 May 2027 Explained

By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules

Short answer

The main DPDP compliance deadline is 13 May 2027. On that date the DPDP Act’s core obligations (Sections 3 to 17: notice, consent, security, breach reporting, children’s data, individual rights) and the Data Protection Board’s powers to inquire and impose penalties (Sections 28 to 34) come into force, together with DPDP Rules 3, 5 to 16, 22 and 23. Consent Manager registration starts earlier, on 13 November 2026.

Main deadline: 13 May 2027: core obligations and penalties
Already in force: Since 13 Nov 2025: definitions, the Data Protection Board, Rules 1, 2 and 17–21
Next milestone: 13 Nov 2026: Section 6(9) and Rule 4 (Consent Managers)
Penalties apply from: 13 May 2027 (Sections 28–34 and the Schedule)

The official DPDP commencement timeline

The Act’s commencement notification and Rule 1 of the DPDP Rules, 2025 bring the law into force in three phases from the Rules’ publication on 13 November 2025:

DPDP Act and DPDP Rules commencement dates
Date	What comes into force	What it means for businesses
13 Nov 2025	Act: Sections 1(2), 2, 18–26, 35, 38–43, 44(1) and 44(3). Rules 1, 2 and 17–21	Definitions and the Data Protection Board of India are set up. No business obligations yet
13 Nov 2026	Act: Section 6(9) and Section 27(1)(d). Rule 4	Consent Managers can register with the Board
13 May 2027	Act: Sections 3–5, 6(1)–(8) and 6(10), 7–17, 27 (except 27(1)(d)), 28–34, 36, 37, 44(2). Rules 3, 5–16, 22 and 23	Notice, consent, security safeguards, breach reporting, children’s data, rights, retention, and the Board’s penalty powers all apply

Has the DPDP Act come into force?

Partly. The Act was passed in August 2023 and the DPDP Rules were notified on 13 November 2025, which brought the institutional provisions into force. The obligations that affect day-to-day business and the penalty provisions start on 13 May 2027. Preparation takes months, so businesses should start well before the deadline.

A readiness plan for the months before 13 May 2027

Now: map personal data across websites, apps, CRM, HR and vendors (a data inventory)
Next: run a gap assessment against the Act and Rules and prioritise the fixes
Then: rewrite notices to meet Rule 3 and rebuild consent and withdrawal flows
Then: implement security safeguards, one-year access logs (Rule 6) and a 72-hour breach procedure (Rule 7)
Then: set up rights requests and grievance handling within 90 days (Rule 14) and retention limits
Before May 2027: update vendor contracts, train staff and run a breach drill

Need this done in your own systems?

Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.

See our DPDP compliance services

Frequently asked questions

What is the deadline for DPDP compliance?+

The main deadline is 13 May 2027, when the DPDP Act’s core obligations (Sections 3 to 17), the Board’s inquiry and penalty powers (Sections 28 to 34) and DPDP Rules 3, 5 to 16, 22 and 23 come into force.

When did the DPDP Act come into force?+

The DPDP Act came into force in phases. Definitions and the Data Protection Board provisions took effect on 13 November 2025, Consent Manager registration on 13 November 2026, and the main business obligations and penalties on 13 May 2027.

Can penalties be imposed under the DPDP Act before May 2027?+

No. The Board’s powers to inquire and impose penalties (Sections 28 to 34) and the obligations they enforce come into force on 13 May 2027.

When were the DPDP Rules notified?+

The Digital Personal Data Protection Rules, 2025 were published in the Official Gazette on 13 November 2025.

How long does DPDP compliance take?+

It depends on the number of systems and processes, but mapping data, fixing notices and consent, implementing safeguards and setting up rights handling usually takes several months, so starting early is important.

Related guides

Sources

This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.