Three dates are in the Gazette. Everything else is a proposal.

For nearly every obligation on businesses, 13 May 2027. Rule 1 of the DPDP Rules, 2025 brings rules 3, 5 to 16, 22 and 23 into force eighteen months after the Rules were published on 13 November 2025. Those rules cover notice, security safeguards, breach intimation, erasure, children’s data, Significant Data Fiduciary duties, rights and cross-border transfer. Rule 4, on Consent Managers, starts earlier, on 13 November 2026. A proposal to shorten the window has been discussed but, as of our review, not notified. Our readiness assessment is built around the May 2027 date.

Not as of our review. In January 2026 MeitY proposed in stakeholder discussions to cut the 18-month window to 12 months, which would have moved the deadline for some obligations to 13 November 2026, and invited comments until 4 February 2026. A proposal changes nothing until an amendment is published in the Gazette, and we have found no amending notification. If one is published, the dates on this page will change — check the review date at the top.

Rule 4 comes into force: the registration and obligations of Consent Managers. A Consent Manager is an India-incorporated company, registered with the Data Protection Board, that lets a person give, manage, review and withdraw consent across Data Fiduciaries through one platform. Registration requires, among other conditions, a net worth of at least two crore rupees. It does not oblige ordinary businesses to use a Consent Manager, and it does not bring the main obligations forward. It is a sensible moment to check whether your consent records could accept an instruction from one.

It exists in law — the rules that constitute it have applied since 13 November 2025 — but as of our review no Chairperson or Members had been announced. MeitY invited applications for the Chairperson and four other Members in May 2026. Until Members are appointed the Board cannot hear a complaint or make an order. That changes nothing about what is owed from 13 May 2027, and appointments could be made at any time; do not build a plan on the Board staying empty.

The Act’s Schedule sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching the children’s-data obligations, up to ₹150 crore for breaching the additional duties of a Significant Data Fiduciary, up to ₹50 crore for any other breach, and up to ₹10,000 for a Data Principal who breaches their own duties. They attach to obligations as those obligations commence, which for most is 13 May 2027. The Board sets the actual amount by weighing gravity, duration, harm and mitigation.

Two steps on two clocks, from 13 May 2027. On becoming aware of a breach you must intimate each affected Data Principal and the Data Protection Board without delay. Then, within 72 hours of becoming aware — or a longer period the Board allows on written request — you send the Board a detailed report covering the facts, cause, mitigation and findings. Separately, a CERT-In direction already requires listed cyber incidents to be reported within six hours; the two duties run side by side. See our DPDP checklist for the breach workstream.

Not under rule 4. Consent Managers are an option the Act gives individuals, not a mandate on businesses. What you need is a consent record that can tell, for each person and purpose, what they agreed to and whether they withdrew — and the ability to act on a withdrawal that reaches you through any channel the person is entitled to use, including a registered Consent Manager. If your consent lives in a marketing tool and nowhere else, that is the gap to close first.

Yes. The Act has no size or revenue threshold: if you process the digital personal data of people in India, you are a Data Fiduciary for that data and the May 2027 obligations apply. The government may exempt notified classes, including startups, from a short list of duties, but the security-safeguard and breach-notice duties were never on that list. What changes for a small company is the size of the work, not whether it exists. Our startup page covers the order to do it in.