The DPDP compliance deadlines
Verified August 2026 · Checked monthly
Consent Manager registration falls due by November 2026. Full compliance, which covers data principal rights, security safeguards and breach reporting, falls due by May 2027. The Government stated both dates in a written answer in the Lok Sabha on 12 August 2026.
The Government has said the dates will not move. The Secretary of the Ministry of Electronics and Information Technology said in August 2026 that no extension is under consideration. The parliamentary answer of 12 August 2026 says the same thing and is the better source to cite, because it is a document rather than a report of a speech.
Every date, past and future
| Date | What happened, or what falls due | Status |
|---|---|---|
| 11 Aug 2023 | The President assented to the Act. No provision came into force. | Done |
| 13 Nov 2025 | Two notifications issued. One appointed the commencement dates for the Act. The other made the DPDP Rules, 2025. | Done |
| 14 Nov 2025 | Publication in the Gazette. Section 2, sections 18 to 26, sections 35 and 38 to 43, sections 44(1) and 44(3), and Rules 1, 2 and 17 to 21 came into force. | Done |
| 6 May 2026 | The Government sought nominations for appointment to the Data Protection Board. | Done |
| 6 Jun 2026 | Employment News published the recruitment advertisement for a chairperson and four members of the Board. | Done |
| 7 Aug 2026 | The Supreme Court heard the challenges and gave the Union Government two weeks to reply. The reference to a larger bench, and the refusal of a stay, were made on 16 February 2026. | Done |
| 12 Aug 2026 | A written answer in the Lok Sabha confirmed the November 2026 and May 2027 deadlines. | Done |
| 13 Nov 2026 | Section 6(9) and section 27(1)(d) of the Act start. Rule 4 starts. Consent Manager registration falls due. | Ahead |
| 13 May 2027 | Sections 3 to 17, 27 to 34, 36, 37 and 44(2) of the Act start. Rules 3, 5 to 16, 22 and 23 start. Full compliance falls due. | Ahead |
Both notifications carry the date 13 November 2025. Several sources record publication in the Gazette on 14 November 2025. The twelve month and eighteen month periods run from the date of publication, so every future date on this page can fall one day later than shown. Read the commencement clause yourself where a single day matters.
What the May 2027 date covers
The parliamentary answer of 12 August 2026 lists the obligations falling due by May 2027. A Data Fiduciary must give notice in any of the twenty-two languages of the Eighth Schedule if the Data Principal asks for it. A Data Fiduciary must complete grievance redressal within ninety days (see what is in force). A Data Fiduciary must hold a valid contract with every data processor it uses. Data principal rights, security safeguards and breach reporting all take effect on the same date.
Penalties take effect on that date too. Sections 33 and 34 of the Act, which carry the penalty and adjudication machinery, are in the same group. See the penalties page.
One proposal that has not been notified
MeitY consulted in early 2026 on compressing the compliance window for Significant Data Fiduciaries from eighteen months to twelve. Comments closed in February 2026. The proposal has not been notified and no Significant Data Fiduciary has been designated, so it currently changes nothing.
A notification in the Gazette of India changing a commencement date. A statement in Parliament revising a deadline. A judgment staying a provision. Notification of the proposal to compress the window for Significant Data Fiduciaries.