DPDP: 180 Days to May 2027. A Readiness Plan, Starting With Consent Managers This Week
DPDP readiness now has a hard date: the main obligations of the Rules apply from May 2027, and the consent manager provisions commence this week. What is in force today, what arrives in May, how the penalties work, and a 180-day plan in three phases that gets the evidence in place before the Board can ask for it.
Regulatory Compliance
The Digital Personal Data Protection Rules were notified on 13 November 2025 with a staged clock. One year on, the consent manager provisions come into force this week. Eighteen months on, in May 2027, so does everything else: security safeguards, breach notification, retention and erasure, children's data, the rights of data principals. That is roughly 180 days from now, and the penalties attached to those duties run to ₹250 crore. This is a plan for using the 180 days well: what is in force today, what arrives in May, what the Rules actually require, and a three-phase programme that leaves you with evidence rather than only policies.
In short. Since November 2025 the Data Protection Board exists in law and the Rules that set it up are in force. From this week, Rule 4 on consent managers commences. From May 2027, the operative duties apply: notice and consent, reasonable security safeguards with a defined minimum, breach intimation to individuals and the Board with a 72-hour detailed report, erasure after three years of inactivity for large platforms, verifiable parental consent, significant data fiduciary obligations and the rights regime. A proposal to shorten the eighteen months to twelve was floated in January 2026 and, as far as the public record shows, has not been notified; plan for May 2027 but do not count on it. Spend the first 60 days on inventory, notices and consent; the next 60 on safeguards, processors and retention; the last 60 on a breach drill, rights handling and the evidence file.
The timeline, precisely
Rule 1 of the Digital Personal Data Protection Rules, 2025, notified as G.S.R. 846(E), sets three commencement dates, each keyed to the date of publication in the Gazette:
| Rules | Commencement | What they cover |
|---|---|---|
| 1, 2 and 17 to 21 | On publication, November 2025 | Definitions and the Data Protection Board: its constitution, functioning as a digital office, and procedures |
| 4 | "One year after the date of publication": 13 November 2026, or 14 November on some counts | Registration and obligations of consent managers |
| 3, 5 to 16, 22 and 23 | "Eighteen months after the date of publication": mid-May 2027 | Notice, security safeguards, breach intimation, erasure, contact details, children's data, significant data fiduciaries, rights, cross-border transfer, research exemption, appeals and information requests |
Three things to know about the dates. First, the notification is dated 13 November 2025 but the government's own press material refers to 14 November, so practitioners count the anniversaries either way; treat the earlier date as the safe one. Second, in January 2026 MeitY proposed compressing the eighteen months to twelve for some provisions and bringing certain cross-border and retention rules into effect immediately; comments closed in February and, on the public record as of autumn 2026, no amending notification has been issued. Third, the only instrument since then is a Removal of Difficulties Order of early October 2026, which corrected two drafting points in the Act and changed no dates.
One more fact that matters for this week: the Board exists in law, but as of the latest public reporting it had no appointed chairperson or members, despite nominations being sought in May and June 2026, and no portal is live. Consent manager registration is made to the Board, so the provisions commencing now may not be practically operable until appointments are made. Check the position on the day.
Consent managers: what commences this week
A consent manager is a registered intermediary through which a data principal can give, manage, review and withdraw consent across data fiduciaries on an interoperable platform. Rule 4(1) says a person who meets the conditions in Part A of the First Schedule "may apply to the Board for registration as a Consent Manager". The conditions include being "a company incorporated in India" with a net worth of "not less than two crore rupees", sufficient technical, operational and financial capacity, directors and key personnel of good reputation, articles that restrict conflicts of interest, and independent certification that the platform meets "such data protection standards and assurance framework as may be published by the Board", a framework that has not yet been published.
Part B sets the obligations: the consent manager acts in a fiduciary capacity to the data principal, cannot read the personal data that passes through it, keeps records of consents, notices and sharing for at least seven years, may not sub-contract, must publish its promoters, directors and significant shareholders, is audited and reports to the Board, and may not transfer control without the Board's approval. For most organisations the action this week is not to become one; it is to decide whether you will integrate with them, and to design notice and consent so that integration is possible later. Our earlier guide, consent management is not DPDP compliance, explains why consent tooling alone is not the job.
What applies from May 2027
| Rule | Obligation | What it means in practice |
|---|---|---|
| 3 | Notice | An itemised, plain-language notice accompanying or preceding every request for consent, with a way to withdraw as easily as consent was given |
| 6 | Reasonable security safeguards | At the minimum: "encryption, obfuscation, masking or the use of virtual tokens"; access control; "visibility on the accessing of such personal data, through appropriate logs, monitoring and review"; continuity measures such as backups; retention of logs and personal data "for a period of one year" unless another law requires otherwise; security provisions in processor contracts; and appropriate technical and organisational measures |
| 7 | Breach intimation | Each affected data principal told "in a concise, clear and plain manner and without delay"; the Board told without delay, with a description of nature, extent, timing, location and likely impact; then "within seventy-two hours of becoming aware of the breach" a detailed report covering facts, mitigation, findings on who caused it, remedial measures and the intimations given |
| 8 and Third Schedule | Erasure | E-commerce entities and social media intermediaries with at least two crore registered users, and online gaming intermediaries with at least fifty lakh, must erase personal data three years after the principal last engaged, with at least 48 hours' notice before erasure; logs and associated data retained at least one year |
| 9 | Contact details | Published contact for the data protection officer or the person who answers questions about processing |
| 10 to 12 and Fourth Schedule | Children and persons with disabilities | Verifiable parental consent before processing a child's data, with due diligence that the parent "is an adult who is identifiable", using details the fiduciary holds or a virtual token from an authorised entity such as Digital Locker; exemptions for clinical and mental health establishments, allied health professionals, educational institutions, crèches and school transport, with conditions |
| 13 | Significant data fiduciaries | Once notified: a data protection impact assessment and an audit "once in every period of twelve months", due diligence that algorithmic software does not pose a risk to data principals' rights, and no transfer outside India of personal data the government specifies. No class of significant data fiduciary has been notified yet |
| 14 | Rights of data principals | Published means to exercise access, correction, erasure, grievance and nomination rights, with grievances answered within a published period of up to 90 days |
| 15 | Cross-border transfer | Permitted subject to any requirements the government specifies by order about making data available to a foreign state or its agencies |
The penalties, and who pays them
The Act's Schedule sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach, up to ₹200 crore for breaching the children's data provisions, up to ₹150 crore for a significant data fiduciary's additional duties, and up to ₹50 crore for anything else. Two features matter for planning. The penalties attach to the data fiduciary, the organisation that decides why and how data is processed, whoever actually holds it; section 8(5) makes the fiduciary responsible for safeguards "including in respect of any processing undertaken by it or on its behalf by a Data Processor". And the largest penalty is for the security duty, not for consent, which is why the second phase of the plan below is the one most organisations under-invest in.
The Act also changed the surrounding law. Section 44 omits section 43A of the IT Act, the old compensation provision for negligent handling of sensitive personal data, once the relevant provisions commence; until then the IT Act rules continue. It also amends the Right to Information Act to exempt "information which relates to personal information".
Where organisations actually are
An EY India survey of more than 150 professionals, published in January 2026, found that about 70% were not very familiar with the Act and Rules, 48% had initiated a gap assessment, 44% had documented their processing activities, roughly 81% had not updated or drafted DPDP-aligned policies and more than 83% had not begun comprehensive implementation. Ten months later, our own assessments suggest the first two numbers have improved and the last two have not: many organisations have a gap report, far fewer have closed the gaps. The plan below is written for an organisation that has a gap assessment and little else.
The 180-day plan
Days 1 to 60: know what you hold, fix notice and consent
Data inventory and processing register
Every category of personal data, where it came from, why it is processed, where it is stored, who it is shared with, how long it is kept. Include the systems the business set up without IT: spreadsheets, marketing tools, chat exports. Nothing else in the plan works without this.
Lawful basis for each processing activity
Consent, or one of the legitimate uses in the Act. Record the decision; the Board may ask for it.
Notices and consent flows
Rewrite notices to the itemised, plain-language standard of Rule 3; build withdrawal that is as easy as consent; design the flows so a consent manager can be integrated later without a rebuild; plan re-consent for legacy data where the original consent would not meet the standard.
Children and age
Decide whether you process children's data at all, and if so, how you will verify a parent. Check whether a Fourth Schedule exemption applies.
Ownership
Name the person who answers data principals' questions, publish their contact, and decide whether you need a data protection officer, which the Rules require for significant data fiduciaries and which is good practice for everyone else at scale.
Days 61 to 120: safeguards, processors and retention
Rule 6, item by item
Encryption or masking for personal data at rest and in transit, access control with reviews, logs that show who accessed personal data with monitoring and review of those logs, backups that are tested, and the one-year retention of logs and data. For each, the question is not whether a policy says so but whether the auditor can see it working.
Processor contracts
Section 8(2) allows processors "only under a valid contract" and Rule 6 requires that contract to provide for reasonable security safeguards. The Rules do not oblige a processor to tell you about a breach, so the contract must, on a clock short enough for your 72 hours. Our guide to third-party cyber risk sets out the clauses.
Retention and erasure
A retention schedule for every category in the inventory, erasure that actually works across systems and backups, and, for platforms over the Third Schedule thresholds, the three-year inactivity rule with its 48-hour notice.
Test the safeguards
A penetration test of the systems holding personal data, including the APIs and portals through which principals will exercise rights, because a rights portal that leaks other people's data is a breach you built yourself.
Days 121 to 180: breach drill, rights, evidence
Breach notification drill
Run a simulated breach against the clocks: without delay to individuals and the Board, 72 hours for the detailed report, and six hours to CERT-In under its 2022 directions, which continue in parallel. Write the templates. Decide who signs. Measure how long it really took.
Rights handling
A channel for access, correction, erasure, nomination and grievances; identity verification that is strong enough not to leak data to impostors; and a response period published and met.
Training
For the people who handle personal data and the people who will receive a rights request or notice a breach, which is everyone.
The evidence file
The inventory, the lawful basis decisions, the notices, the contracts, the safeguard evidence, the drill results, the training records and the board minutes approving all of it. Rule 23 lets the Board call for information; this is what you will send.
If you are likely to be a significant data fiduciary
No class has been notified, and the figures circulating for a user threshold are speculation. But if you process personal data at scale, or data whose misuse would cause serious harm, prepare as if you will be: an annual data protection impact assessment and audit, due diligence on algorithms, and the ability to keep specified data inside India. Our guide to data protection impact assessments covers the first.
How this fits with your other regulators
DPDP does not replace sector rules; it sits beside them. CERT-In's six-hour incident reporting continues, and so do RBI's six-hour DAKSH reporting for banks and NBFCs, SEBI's and IRDAI's incident rules, and the data localisation requirements in RBI's digital lending directions. A single incident can therefore trigger four notifications on four clocks, which is an argument for the breach drill above and for the kind of incident response retainer that comes with templates for each. If you hold ISO/IEC 27001, the 2025 edition of ISO/IEC 27701 is now a standalone privacy standard that maps naturally onto these duties.
A DPDP assessment and implementation engagement with us follows the three phases above and is measured by the evidence file at the end, not by the number of policies written. For organisations without a privacy lead, a virtual CISO can own the programme for the 180 days.
Frequently Asked Questions
Click any question to expand the answer.
QWhen do the DPDP Rules come into force?
In three stages, each keyed to the date of publication in the Gazette, 13 November 2025. Rules 1, 2 and 17 to 21, which set up the Data Protection Board, came into force on publication. Rule 4 on consent managers commences one year later, in November 2026. Rules 3, 5 to 16, 22 and 23, the main operative duties, commence eighteen months later, in May 2027. Some practitioners count from 14 November; treat 13 as the safe date.
QHas the DPDP timeline been shortened to 12 months?
Not on the public record. MeitY proposed in January 2026 to compress the eighteen-month period to twelve for some provisions, with comments closing in February 2026, but no amending notification had been issued as of autumn 2026. The only subsequent instrument, a Removal of Difficulties Order of early October 2026, corrected two drafting points and changed no dates.
QWhat is a consent manager under DPDP?
A registered intermediary through which a data principal can give, manage, review and withdraw consent across data fiduciaries on an interoperable platform. It must be a company incorporated in India with a net worth of at least two crore rupees, act in a fiduciary capacity to the data principal, be unable to read the data passing through it, keep records for at least seven years and not sub-contract. Registration is with the Data Protection Board.
QIs the Data Protection Board functioning?
It exists in law since November 2025 and its procedural rules are in force, but as of the latest public reporting it had no appointed chairperson or members, despite nominations being sought in mid-2026, and no portal was live. Until appointments are made it cannot receive consent manager applications, complaints or impose penalties. Check the current position.
QWhat security safeguards does DPDP require?
Rule 6 sets a minimum: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review that give visibility of access to personal data; continuity measures such as backups; retention of logs and personal data for one year unless another law requires otherwise; security provisions in processor contracts; and appropriate technical and organisational measures. Failing to take reasonable safeguards carries a penalty of up to ₹250 crore.
QWhat are the breach notification requirements under DPDP?
Under Rule 7, each affected data principal must be told in a concise, clear and plain manner without delay; the Board must be told without delay with a description of the breach; and a detailed report must reach the Board within 72 hours of becoming aware, or longer if the Board allows on written request. Failing to notify carries a penalty of up to ₹200 crore. CERT-In's separate six-hour reporting duty continues to apply.
QWhat are the DPDP penalties?
Up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach, ₹200 crore for breaching the children's data provisions, ₹150 crore for a significant data fiduciary's additional obligations, ₹10,000 for a data principal breaching their duties, and ₹50 crore for any other provision. Penalties attach to the data fiduciary, whoever processes the data on its behalf.
QWho is a significant data fiduciary?
A data fiduciary or class notified by the Central Government based on factors such as the volume and sensitivity of data processed and the risk to data principals' rights. Once notified, it must conduct a data protection impact assessment and an audit every twelve months, exercise due diligence over its algorithms, and keep specified data within India. No class had been notified as of November 2026, and circulating user thresholds are speculation.
QWhat are the data retention rules under DPDP?
Personal data must be erased when its purpose is served or consent is withdrawn. For e-commerce entities and social media intermediaries with at least two crore registered users and online gaming intermediaries with at least fifty lakh, the Third Schedule requires erasure three years after the principal last engaged, with at least 48 hours' notice. Logs and associated data must be retained for at least one year.
QHow does DPDP handle children's data?
Verifiable parental consent is required before processing a child's data, with due diligence that the parent is an identifiable adult, using details the fiduciary already holds or a virtual token from an authorised entity such as Digital Locker. The Fourth Schedule exempts clinical and mental health establishments, allied health professionals, educational institutions, crèches and school transport, subject to conditions.
QDoes DPDP replace RBI, SEBI or CERT-In requirements?
No. It sits alongside them. CERT-In's six-hour incident reporting, RBI's six-hour DAKSH reporting, SEBI's and IRDAI's incident rules and the data localisation requirements in RBI's digital lending directions all continue, so one incident can trigger several notifications on different clocks.
QWhere should we start with 180 days left?
With the data inventory and processing register, because every other obligation depends on knowing what you hold. Then notices and consent in the first 60 days, security safeguards, processor contracts and retention in the next 60, and a breach drill, rights handling and the evidence file in the last 60.
Related reading
For the Act itself, see navigating the DPDP Act. For the Rules as notified, the DPDP Rules 2025 compliance roadmap. For why consent tooling is not the whole job, what a real DPDP assessment covers. For the security safeguards in practice, the ISO 27001 implementation guide.
Sources
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025).
- Ministry of Law and Justice, Digital Personal Data Protection Act, 2023.
- Press Information Bureau, DPDP Rules, 2025 notified: backgrounder (17 November 2025).
- S.S. Rana & Co., DPDP Removal of Difficulties Order, 2026.
- SCC Online, DPDP Removal of Difficulties Order, 2026 (October 2026).
- Legal 500 / Khurana & Khurana, Compression of DPDP enforcement timeline proposed by MeitY.
- MirvoLegal, DPDP Rules, 2025: compliance timeline for data fiduciaries (as at September 2026).
- LiveLaw, India's Data Protection Board: established in law (August 2026).
- Legal 500 / King Stubb & Kasiva, Building the consent layer: consent managers under the DPDP Rules, 2025.
- DSCI, Insight brief on the DPDP Rules.
- EY India, India's digital privacy crossroads: DPDP readiness survey (January 2026).
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (28 April 2022).
- DNV, Revision of ISO/IEC 27701 (2025).
Adayptus Consulting
Data Protection, Adayptus
Adayptus Consulting Private Limited is a cybersecurity consultancy based in Noida, India, running DPDP assessments and implementation programmes that produce evidence, not only policies.
On This Page
- The timeline, precisely
- Consent managers: what commences this week
- What applies from May 2027
- The penalties, and who pays them
- Where organisations actually are
- The 180-day plan
- If you are likely to be a significant data fiduciary
- How this fits with your other regulators
- Frequently Asked Questions
- Related reading
- Sources
