DPDP Rules 2025 Timeline: What Changes on 13 May 2027 and How Businesses Should Prepare

India's Digital Personal Data Protection Act, 2023 (DPDP Act) became operational when the Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The Rules did not switch everything on at once. They set out a phased timeline, and the phase that matters most to businesses begins on 13 May 2027.

For boards and compliance teams, that date is now close. This note sets out what is already in force, what changes in November 2026 and May 2027, and how to sequence the work.

Phase one: the institutional framework (in force since 13 November 2025)

Rules 1, 2 and 17 to 21 took effect on notification. They cover definitions, the constitution and functioning of the Data Protection Board of India, the terms of its members, and appeals to the Appellate Tribunal. These provisions build the regulator. They create no new obligations for businesses yet, but they mean the Board can be ready to act once substantive duties apply.

Phase two: Consent Managers (13 November 2026)

Rule 4, which governs the registration and obligations of Consent Managers, commences one year after notification. Consent Managers are Board-registered platforms through which individuals can give, manage, review and withdraw consent across businesses. Businesses that want to use, or become, a Consent Manager should plan for this date. We discuss the framework in a separate note.

Phase three: the operational core (13 May 2027)

Rules 3, 5 to 16, 22 and 23 commence 18 months after notification. This is where most obligations on Data Fiduciaries sit:

• Notice (Rule 3). A notice that stands on its own, uses clear and plain language, and itemises the personal data and the specified purpose. It must link to withdrawal of consent, the exercise of rights and complaints to the Board.
• Security safeguards (Rule 6). Reasonable measures, including encryption, masking or tokenisation, access controls, monitoring, back-ups and contractual safeguards with Data Processors, plus logs retained for at least one year.
• Breach intimation (Rule 7). Notice to affected individuals without delay, and a two-stage report to the Board, with the detailed report due within 72 hours.
• Retention and erasure (Rule 8). Erasure once the purpose is served. For large e-commerce, online gaming and social media platforms, a three-year outer limit applies, with advance notice to the user before erasure.
• Children and persons with disabilities (Rules 10 and 11). Verifiable consent of a parent or lawful guardian.
• Significant Data Fiduciaries (Rule 12). Annual Data Protection Impact Assessments and audits, and due diligence on algorithmic software.
• Data Principal rights and cross-border transfers (Rules 14 and 15). Published means to exercise rights, and compliance with any transfer conditions the Government specifies.

Is the timeline likely to change?

In January 2026, press reports said MeitY had discussed shortening the 18-month window to 12 months for Significant Data Fiduciaries. As of mid-October 2026, we have not found a notified amendment to the commencement periods. Businesses should plan to 13 May 2027 while monitoring the Gazette, and those likely to be designated Significant Data Fiduciaries should build in contingency.

What is at stake

The Schedule to the DPDP Act sets penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore each for failure to notify a breach and for breaching obligations relating to children. The Board determines penalties case by case, with regard to factors such as the nature, gravity and duration of the breach.

A sequenced compliance plan

Seven months is enough time if the work is sequenced. In our experience, the order matters more than the speed.

1. Map personal data first. Identify what is collected, why, where it is stored, who receives it and how long it is kept. Every later step depends on this.
2. Fix the legal basis. For each purpose, decide whether consent or a legitimate use under Section 7 applies, and redesign notices and consent journeys accordingly.
3. Re-paper vendors. Contracts with Data Processors need security, breach-reporting, retention and audit terms. Negotiation takes time, so start early.
4. Build the breach process. Align the DPDP breach workflow with existing CERT-In reporting, so one incident triggers one coordinated response.
5. Set retention schedules. Define erasure triggers and log retention, and test that deletion actually happens.
6. Operationalise rights and grievances. Publish contact details, set internal response times and train the teams who will handle requests.
7. Train and evidence. Brief functional teams and keep records that show the programme operates in practice.

Conclusion

The DPDP framework is no longer prospective. The regulator exists, Consent Managers arrive in November 2026, and the operational core applies from 13 May 2027. Businesses that map their data and re-paper their vendors now will spend the final months testing, not drafting.

Frequently asked questions

When do the DPDP Rules 2025 come into force?

In three phases: Rules 1, 2 and 17 to 21 on 13 November 2025; Rule 4 on Consent Managers after one year; and Rules 3, 5 to 16, 22 and 23 after 18 months, widely computed as 13 May 2027.

Do the DPDP Rules apply to foreign companies?

The DPDP Act applies to processing outside India if it is connected with offering goods or services to Data Principals in India.

What is the maximum penalty under the DPDP Act?

Up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach.

This article is for general information only and is not legal advice. It reflects the law as understood on 14 October 2026.