10 November 2026
Mono Team
DPDP Rules 2025 Compliance Calendar: Every Date from November 2025 to 13 May 2027
Data protection
The DPDP Act and Rules start in three stages: 13 November 2025, 13 November 2026 and 13 May 2027. Which sections and rules start when, and a plan for the months that are left.
The DPDP Act and the DPDP Rules, 2025 start in three stages: 13 November 2025, 13 November 2026 and 13 May 2027. For most companies only the last one matters. It is when the duties on notices, consent, rights requests, security, breach reporting and retention begin.
This calendar lists which sections of the Act and which rules start on each date, what has changed since the Rules were notified, and how to use the months that are left.
The three dates
Two notifications set the dates. One brings the Act into force in stages (G.S.R. 843(E)). The other is the Rules themselves (G.S.R. 846(E)), whose Rule 1 does the same for each rule. Both give a stage "on publication", a stage one year later and a stage eighteen months later.
| Date | What starts | Who it affects |
|---|---|---|
| 13 November 2025 | What starts: Definitions, and the provisions that set up the Data Protection Board of India | Who it affects: The Government and the Board |
| 13 November 2026 | What starts: Registration of Consent Managers: Rule 4 and Section 6(9) | Who it affects: Companies that want to run a consent platform for others |
| 13 May 2027 | What starts: The core duties: notices, consent, security, breach reporting, retention, children's data, rights and penalties | Who it affects: Every organisation that handles digital personal data |
The Gazette is dated 13 November 2025. Some advisers count from 14 November 2025, which moves each later date by one day.
Phase 1: what took effect on 13 November 2025
The first stage created the machinery, not the duties. Rules 1, 2 and 17 to 21 started, along with the sections of the Act that define terms and establish the Data Protection Board. Nothing in this stage asks an ordinary company to change its systems.
Phase 2: Rule 4 from 13 November 2026
The second stage opens registration for Consent Managers. Rule 4 starts, with Section 6(9), which requires every Consent Manager to be registered with the Board.
For most companies this is not a deadline. It applies to companies that want to run a consent platform for others: an Indian company with a net worth of at least ₹2 crore. Our Consent Manager decision guide covers who that is.
Phase 3: substantive duties from 13 May 2027
The third stage is the one to plan for. Sections 3 to 17 of the Act start, apart from Section 6(9), and with them the Board's powers to inquire and to impose penalties. Rules 3, 5 to 16, 22 and 23 start on the same day.
Until then, the existing law still applies. The Act removes Section 43A of the Information Technology Act, 2000, but that change also waits for 13 May 2027.
Commencement table
The same three stages, by section and rule.
| Stage | Sections of the Act | Rules |
|---|---|---|
| On publication (13 November 2025) | Sections of the Act: 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) | Rules: 1, 2 and 17 to 21 |
| One year later (13 November 2026) | Sections of the Act: 6(9) and 27(1)(d) | Rules: 4 |
| Eighteen months later (13 May 2027) | Sections of the Act: 3 to 5, 6(1) to 6(8) and 6(10), 7 to 17, the rest of 27, 28 to 34, 36, 37 and 44(2) | Rules: 3, 5 to 16, 22 and 23 |
The rules in the last stage that most companies will work with:
- Rule 3: what a notice must contain.
- Rule 6: the minimum security safeguards.
- Rule 7: breach reporting, including the detailed report to the Board within 72 hours.
- Rule 8: retention and erasure periods.
- Rule 9: publishing a contact who can answer questions.
- Rule 10: verifiable parental consent.
- Rule 13: extra duties of a Significant Data Fiduciary.
- Rule 14: how people exercise their rights, and the 90-day ceiling on grievance responses.
- Rule 15: transfers outside India.
What has changed since November 2025
Two official instruments have touched the text since the Rules were notified. Neither changed a date.
- 10 December 2025: a corrigendum to the Rules (G.S.R. 892(E)) fixed typographical errors.
- October 2026: a Removal of Difficulties Order (S.O. 5458(E)) adjusted wording in Sections 9 and 10 of the Act.
As of 10 November 2026 we have found no notification that moves any of the three dates. We review this page when anything changes.
A plan for the months that are left
Working back from 13 May 2027, a mid-size company has about two quarters. This is the order we suggest.
| When | What to finish | What you have at the end |
|---|---|---|
| November and December 2026 | What to finish: Find every system and vendor that holds personal data. Compare each one against the Act and Rules. | What you have at the end: A data map, a gap register and a costed plan |
| January to March 2027 | What to finish: Build the consent log, versioned notices, the rights-request workflow and withdrawal across systems. | What you have at the end: Consent and request records in production |
| April to 13 May 2027 | What to finish: Run deletion jobs, finish the breach runbook, review vendor contracts with your lawyers, and run a drill. | What you have at the end: Evidence that each duty works, before the date |
The first row is a DPDP gap assessment. The second and third are DPDP implementation. Our guide for engineering teams covers the build in detail.
Penalty schedule
Penalties become available to the Board on 13 May 2027. The Schedule to the Act sets the upper limits.
| Breach | Section | Upper limit |
|---|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | Section: 8(5) | Upper limit: ₹250 crore |
| Failing to give the Board or affected people notice of a breach | Section: 8(6) | Upper limit: ₹200 crore |
| Breaching the additional duties on children's data | Section: 9 | Upper limit: ₹200 crore |
| Breaching the additional duties of a Significant Data Fiduciary | Section: 10 | Upper limit: ₹150 crore |
| A Data Principal breaching their own duties | Section: 15 | Upper limit: ₹10,000 |
| Breaching a voluntary undertaking accepted by the Board | Section: 32 | Upper limit: Up to the limit for the breach the proceedings were about |
| Any other breach of the Act or the Rules | Section: Any other provision | Upper limit: ₹50 crore |
These are ceilings. The Board can impose a penalty when it finds, after an inquiry, that a breach is significant, and it weighs factors such as how serious the breach was and what you did to limit the harm (Section 33). The DPDP Act explained covers each duty.
This guide is not legal advice. Our partner law firm gives the written legal opinion on how the Act applies to you. See everything we do for DPDP compliance.
Sources: G.S.R. 843(E) and G.S.R. 846(E), Gazette of India, 13 November 2025. G.S.R. 892(E), December 2025. S.O. 5458(E), October 2026. Digital Personal Data Protection Act, 2023, Section 33 and the Schedule. Last reviewed 10 November 2026.
The DPDP Act and the DPDP Rules, 2025 start in three stages: 13 November 2025, 13 November 2026 and 13 May 2027. For most companies only the last one matters. It is when the duties on notices, consent, rights requests, security, breach reporting and retention begin.
This calendar lists which sections of the Act and which rules start on each date, what has changed since the Rules were notified, and how to use the months that are left.
The three dates
Two notifications set the dates. One brings the Act into force in stages (G.S.R. 843(E)). The other is the Rules themselves (G.S.R. 846(E)), whose Rule 1 does the same for each rule. Both give a stage "on publication", a stage one year later and a stage eighteen months later.
| Date | What starts | Who it affects |
|---|---|---|
| 13 November 2025 | What starts: Definitions, and the provisions that set up the Data Protection Board of India | Who it affects: The Government and the Board |
| 13 November 2026 | What starts: Registration of Consent Managers: Rule 4 and Section 6(9) | Who it affects: Companies that want to run a consent platform for others |
| 13 May 2027 | What starts: The core duties: notices, consent, security, breach reporting, retention, children's data, rights and penalties | Who it affects: Every organisation that handles digital personal data |
The Gazette is dated 13 November 2025. Some advisers count from 14 November 2025, which moves each later date by one day.
Phase 1: what took effect on 13 November 2025
The first stage created the machinery, not the duties. Rules 1, 2 and 17 to 21 started, along with the sections of the Act that define terms and establish the Data Protection Board. Nothing in this stage asks an ordinary company to change its systems.
Phase 2: Rule 4 from 13 November 2026
The second stage opens registration for Consent Managers. Rule 4 starts, with Section 6(9), which requires every Consent Manager to be registered with the Board.
For most companies this is not a deadline. It applies to companies that want to run a consent platform for others: an Indian company with a net worth of at least ₹2 crore. Our Consent Manager decision guide covers who that is.
Phase 3: substantive duties from 13 May 2027
The third stage is the one to plan for. Sections 3 to 17 of the Act start, apart from Section 6(9), and with them the Board's powers to inquire and to impose penalties. Rules 3, 5 to 16, 22 and 23 start on the same day.
Until then, the existing law still applies. The Act removes Section 43A of the Information Technology Act, 2000, but that change also waits for 13 May 2027.
Commencement table
The same three stages, by section and rule.
| Stage | Sections of the Act | Rules |
|---|---|---|
| On publication (13 November 2025) | Sections of the Act: 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) | Rules: 1, 2 and 17 to 21 |
| One year later (13 November 2026) | Sections of the Act: 6(9) and 27(1)(d) | Rules: 4 |
| Eighteen months later (13 May 2027) | Sections of the Act: 3 to 5, 6(1) to 6(8) and 6(10), 7 to 17, the rest of 27, 28 to 34, 36, 37 and 44(2) | Rules: 3, 5 to 16, 22 and 23 |
The rules in the last stage that most companies will work with:
- Rule 3: what a notice must contain.
- Rule 6: the minimum security safeguards.
- Rule 7: breach reporting, including the detailed report to the Board within 72 hours.
- Rule 8: retention and erasure periods.
- Rule 9: publishing a contact who can answer questions.
- Rule 10: verifiable parental consent.
- Rule 13: extra duties of a Significant Data Fiduciary.
- Rule 14: how people exercise their rights, and the 90-day ceiling on grievance responses.
- Rule 15: transfers outside India.
What has changed since November 2025
Two official instruments have touched the text since the Rules were notified. Neither changed a date.
- 10 December 2025: a corrigendum to the Rules (G.S.R. 892(E)) fixed typographical errors.
- October 2026: a Removal of Difficulties Order (S.O. 5458(E)) adjusted wording in Sections 9 and 10 of the Act.
As of 10 November 2026 we have found no notification that moves any of the three dates. We review this page when anything changes.
A plan for the months that are left
Working back from 13 May 2027, a mid-size company has about two quarters. This is the order we suggest.
| When | What to finish | What you have at the end |
|---|---|---|
| November and December 2026 | What to finish: Find every system and vendor that holds personal data. Compare each one against the Act and Rules. | What you have at the end: A data map, a gap register and a costed plan |
| January to March 2027 | What to finish: Build the consent log, versioned notices, the rights-request workflow and withdrawal across systems. | What you have at the end: Consent and request records in production |
| April to 13 May 2027 | What to finish: Run deletion jobs, finish the breach runbook, review vendor contracts with your lawyers, and run a drill. | What you have at the end: Evidence that each duty works, before the date |
The first row is a DPDP gap assessment. The second and third are DPDP implementation. Our guide for engineering teams covers the build in detail.
Penalty schedule
Penalties become available to the Board on 13 May 2027. The Schedule to the Act sets the upper limits.
| Breach | Section | Upper limit |
|---|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | Section: 8(5) | Upper limit: ₹250 crore |
| Failing to give the Board or affected people notice of a breach | Section: 8(6) | Upper limit: ₹200 crore |
| Breaching the additional duties on children's data | Section: 9 | Upper limit: ₹200 crore |
| Breaching the additional duties of a Significant Data Fiduciary | Section: 10 | Upper limit: ₹150 crore |
| A Data Principal breaching their own duties | Section: 15 | Upper limit: ₹10,000 |
| Breaching a voluntary undertaking accepted by the Board | Section: 32 | Upper limit: Up to the limit for the breach the proceedings were about |
| Any other breach of the Act or the Rules | Section: Any other provision | Upper limit: ₹50 crore |
These are ceilings. The Board can impose a penalty when it finds, after an inquiry, that a breach is significant, and it weighs factors such as how serious the breach was and what you did to limit the harm (Section 33). The DPDP Act explained covers each duty.
This guide is not legal advice. Our partner law firm gives the written legal opinion on how the Act applies to you. See everything we do for DPDP compliance.
Sources: G.S.R. 843(E) and G.S.R. 846(E), Gazette of India, 13 November 2025. G.S.R. 892(E), December 2025. S.O. 5458(E), October 2026. Digital Personal Data Protection Act, 2023, Section 33 and the Schedule. Last reviewed 10 November 2026.
FAQ
Questions and answers
On 13 November 2025, the date on the Gazette of India. Some advisers count from 14 November 2025, which moves each later date by one day.
Most duties start on 13 May 2027, 18 months after the DPDP Rules were notified on 13 November 2025. The rules for registering Consent Managers start earlier, on 13 November 2026.
Rules 1, 2 and 17 to 21, which cover definitions and the Data Protection Board. Rule 4, on registering Consent Managers, starts on 13 November 2026. The rules that place duties on ordinary companies start on 13 May 2027.
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Up to ₹200 crore for failing to report a breach or for breaching the duties on children's data. Other failures carry lower limits set out in the Act's Schedule.