DPDP Act and Rules 2025: The 2026 Compliance Milestones Businesses Can’t Afford to Miss

India’s data protection regime has moved well past the discussion stage. With the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) notified by the Ministry of Electronics and Information Technology (“MeitY”) on 13 November 2025, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) now has a defined implementation roadmap, and 2026 is the year businesses should be using to prepare for substantive compliance.

For many organisations, the temptation is to treat 13 May 2027 as “the” deadline and push compliance planning to next year. That would be a mistake. The DPDP Act and Rules have been designed for phased implementation, with an important intermediate milestone falling in November 2026. Businesses should therefore use 2026 to identify and address compliance gaps before the substantive obligations take effect.

Who the DPDP Act Applies To

The DPDP Act applies to the processing of digital personal data within India where the personal data is collected in digital form or is collected in non-digital form and subsequently digitised. It also applies to processing outside India where such processing is in connection with an activity related to offering goods or services to Data Principals within India, subject to the exclusions provided under the Act.

This extraterritorial reach means that a foreign SaaS company, an e-commerce platform based outside India, or another offshore business offering goods or services to individuals in India may fall within the scope of the DPDP Act, even where the relevant processing takes place outside India.

Under the Act, any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data is a “Data Fiduciary”. A person who processes personal data on behalf of a Data Fiduciary is a “Data Processor”.

Certain Data Fiduciaries may also be notified as “Significant Data Fiduciaries” (“SDFs”) by the Central Government, having regard to factors including the volume and sensitivity of personal data processed, the risk to Data Principals, and the potential impact on India’s sovereignty and integrity, security of the State, electoral democracy and public order. SDFs are subject to enhanced obligations, including the appointment of a Data Protection Officer based in India, appointment of an independent Data Auditor, and periodic Data Protection Impact Assessments and audits.

In short, businesses that collect or otherwise process digital personal data should assess whether and how the DPDP Act applies to their activities, taking into account the specific scope and exclusions under the legislation.

The Phased Rollout: What’s Already Live, and What’s Coming

The DPDP Act and the DPDP Rules, as notified in the Gazette of India, structure implementation across three broad phases.

Phase 1: November 2025, Institutional Framework:

Certain provisions of the DPDP Act and Rules came into force immediately upon notification on 13 November 2025. These include the provisions relating to the establishment and framework of the Data Protection Board of India (“DPBI”), as well as provisions dealing with matters such as the Board’s digital functioning and related institutional arrangements.

The DPBI has therefore been legally established under Section 18 of the DPDP Act. However, it is important to distinguish between the Board’s statutory establishment and its full operationalisation as an adjudicatory authority.

In May 2026, MeitY issued a notice inviting applications for the statutory posts of Chairperson and four Members of the DPBI. Accordingly, as of the date of this article, businesses should not describe the DPBI as a fully operational adjudicatory body already hearing complaints and imposing penalties. The institutional framework is nevertheless now in place, and organisations should monitor developments concerning the constitution and functioning of the Board.

Phase 2: 13 November 2026, Consent Manager Framework:

This is the next major implementation milestone for businesses to plan around. Rule 4 of the DPDP Rules will come into force one year after the Rules were notified, i.e. on 13 November 2026. Rule 4 establishes the framework for registration and functioning of “Consent Managers”. A Consent Manager is a person registered with the Board that provides an accessible, transparent and interoperable platform through which a Data Principal can give, manage, review and withdraw consent.

The First Schedule to the DPDP Rules prescribes eligibility and other requirements for registration as a Consent Manager, including that the applicant be an Indian-incorporated company and have a minimum net worth of ₹2 crore. The November 2026 milestone is therefore relevant to organisations that use, develop or intend to integrate with Consent Manager infrastructure. However, it should not be interpreted as a blanket requirement for every business to register as a Consent Manager or to integrate with one.

Businesses should instead use the period leading up to November 2026 to assess their consent-management architecture and determine whether their systems, records and processes can accommodate the emerging Consent Manager framework where relevant.

Phase 3: 13 May 2027, Substantive Compliance Framework:

Rules 3, 5 to 16, 22 and 23 are scheduled to come into force eighteen months after publication of the DPDP Rules, i.e. on 13 May 2027. The principal substantive provisions of the DPDP Act relating to Data Fiduciaries, Data Principals, consent, notices, security safeguards, personal data breaches, children’s personal data, rights and other compliance obligations are similarly scheduled to commence in accordance with the notified implementation framework.

This phase will therefore mark the commencement of the core substantive compliance framework under the DPDP Act and Rules.

Why November 2026 Deserves Immediate Attention

Although November 2026 does not represent a universal compliance deadline for every Data Fiduciary, it is an important milestone in the implementation of India’s data protection framework. Organisations that intend to use Consent Managers, or whose technology and consent infrastructure may interact with the Consent Manager ecosystem, should begin assessing technical and operational readiness well before Rule 4 takes effect.

More broadly, businesses should not wait until May 2027 to begin compliance implementation. Data mapping, consent management, privacy notices, vendor contracts, retention practices, security safeguards and internal governance arrangements can require significant operational and technological changes.

Practically, this means:

• Consent flows, cookie banners and onboarding journeys should be reviewed now against the requirements that will apply when the substantive DPDP provisions commence.
• Legacy databases should undergo a data governance and compliance review. Organisations should identify what personal data they hold, why it was collected, the purposes for which it continues to be processed, applicable retention requirements, and the availability of relevant notices or consent records.
• Vendor and processor contracts should be reviewed and updated to appropriately reflect the respective obligations of Data Fiduciaries and Data Processors under the DPDP framework.
• Incident-response mechanisms should be tested and strengthened in preparation for the personal data breach notification requirements that will apply once the relevant provisions of the Rules commence.

The Cost of Getting This Wrong

The DPDP Act empowers the Data Protection Board of India to impose penalties of up to ₹250 crore per instance of non-compliance, with no indication so far of a grace period once the substantive obligations bite. For Significant Data Fiduciaries in particular, the compliance bar is higher and the reporting obligations more frequent, making early readiness even more critical.

Beyond the monetary exposure, there is reputational and operational risk. An active DPBI, functioning grievance mechanisms, and rising public awareness of data rights mean complaints are already possible today, not just after full enforcement begins.

A Practical Compliance Checklist for the Rest of 2026

1. Map your data: Identify every category of personal data you collect or process, the purposes for which it is processed, where it is stored, who has access to it and the applicable retention requirements.
2. Review your notice and consent mechanisms: Assess whether your existing notices and consent flows can be aligned with the requirements that will apply when the relevant provisions of the DPDP Act and Rules commence.
3. Prepare for Consent Manager Framework: Assess your current consent infrastructure and determine whether your systems will need to interact with Consent Managers or otherwise accommodate the framework taking effect in November 2026.
4. Audit legacy data: Review historical datasets to determine what personal data is held, why it continues to be retained or processed, what notices or consent records exist, and whether retention and processing remain necessary and appropriate.
5. Build your breach response protocol: The DPDP Rules establish detailed personal data breach notification requirements, including prescribed timelines and information requirements. Although the relevant provisions are scheduled to commence in May 2027, organisations should begin preparing and testing their incident-response processes now.
6. Review vendor contracts: Data processing arrangements with third parties should appropriately reflect the respective responsibilities of Data Fiduciaries and Data Processors and provide suitable contractual protections.
7. Appoint the right people: Organisations that may be notified as Significant Data Fiduciaries should begin preparing for the appointment of an India-based Data Protection Officer and an independent Data Auditor, as well as the applicable assessment and audit requirements.

The Bottom Line

The DPDP Act’s compliance framework was designed to give businesses time to prepare, but that preparation should begin well before the substantive provisions take effect. The next significant milestone is 13 November 2026, when the Consent Manager framework under Rule 4 is scheduled to come into force. The principal substantive provisions of the DPDP Act and the remaining operational Rules are scheduled to follow on 13 May 2027.

Businesses that begin remediation only when the substantive provisions become operational may find themselves trying to redesign systems, renegotiate contracts and establish governance processes under significant time pressure. 2026 should therefore be treated as the year to close the gap between existing data practices and the requirements of India’s emerging data protection regime.

Frequently Asked Questions