DPDP Rules 2025 Timeline: What Applies from November 2026 and May 2027?

The DPDP implementation window has been running for months. Now, in November 2026, organisations must assess which privacy processes are working, where gaps remain and what needs to be ready by May 2027.

The DPDP Rules 2025 timeline marks two important upcoming milestones: Consent Manager registration provisions take effect on 13 November 2026, followed by most remaining operational obligations on 13 May 2027.

Understanding these dates helps organisations prioritise their compliance efforts.

Is the DPDP Act in Force Now?

Yes, partially. The Digital Personal Data Protection Act, 2023 has a staggered commencement schedule rather than one universal effective date.

MeitY’s notification brought specified institutional provisions into force first, followed by Section 6(9) on Consent Manager registration after twelve months. Most substantive Data Fiduciary obligations take effect after eighteen months. The DPDP Rules, 2025 follow the same phased approach.

What Changes in November 2026 Under the DPDP Act?

The November milestone centers on Rule 4 and Section 6(9), which establish the registration framework for Consent Managers under the Data Protection Board of India.

A Consent Manager enables Data Principals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.

This requirement applies to entities seeking to operate as registered Consent Managers, not every business. However, Data Fiduciaries should independently review their consent collection, management and withdrawal processes.

A useful checkpoint: Can your teams trace consent from collection through withdrawal?

DPDP Rules 2025 Implementation Timeline: Rule-by-Rule Commencement Dates

As of November 2026, the DPDP Rules, 2025 have entered their second phase of implementation.

The implementation follows three key milestones, calculated from the Gazette notification dated 13 November 2025:

1. 13 November 2025 | Already in Effect

• Rules 1–2: Commencement provisions and key definitions.
• Rules 17–21: Board appointments, service conditions, meetings and administrative functioning.

2. 13 November 2026 | Taking Effect This Month

– Rule 4: Consent Manager registration and operational requirements.

3. 13 May 2027 | Prepare for Implementation

• Rule 3: Privacy notices.
• Rule 5: Specified State processing.
• Rules 6–7: Security safeguards and breach notifications.
• Rules 8–9: Data erasure and contact information requirements.
• Rules 10–12: Children’s data and applicable exemptions.
• Rule 13: Significant Data Fiduciary obligations.
• Rule 14: Data Principal rights.
• Rules 15–16: Overseas transfers and research exemptions.
• Rules 22–23: Appeals and information requests.

The priority for organisations in November 2026 is to identify compliance gaps, assign responsibilities and test privacy processes ahead of 13 May 2027.

When Does DPDP Breach Notification Become Applicable?

Rule 7 forms part of the May 2027 phase.

On becoming aware of a personal data breach, a data fiduciary must notify affected individuals and provide initial information to the Board without delay. More detailed information must follow to the Board within 72 hours, unless it allows additional time on a written request.

The 72-hour provision does not permit organizations to postpone the initial notification.

Businesses should test how quickly security findings reach privacy decision-makers and become accurate notifications.

What Must Companies Comply With by May 2027?

By 13 May 2027, organisations acting as Data Fiduciaries must be prepared to meet the applicable operational requirements under the DPDP Act and Rules. Use this checklist to assess what is already in place and what needs attention.

• Map personal data: Identify what is collected, where it is stored, why it is processed and who can access it.
• Review privacy notices: Ensure notices clearly explain the personal data collected, processing purposes and how consent can be withdrawn.
• Test consent workflows: Verify that consent records and withdrawals are handled appropriately across relevant systems.
• Establish rights request processes: Prepare workflows for access, correction, erasure and grievance redressal.
• Review data retention: Check retention periods, erasure procedures and applicable contact information requirements.
• Strengthen security safeguards: Review access controls, monitoring, backups and data processor safeguards.
• Prepare for breach notifications: Establish incident escalation, assessment and notification workflows.
• Review vendor arrangements: Verify data processor responsibilities, contractual safeguards and incident reporting procedures.
• Assess additional obligations: Determine whether Significant Data Fiduciary requirements, children’s data provisions or other specific obligations apply.
• Track compliance gaps: Assign owners, deadlines and supporting evidence for outstanding actions.

A structured DPDP compliance roadmap for Indian enterprises should track not just implementation progress, but whether these processes work in practice.

Simplify DPDP Implementation with Zycato

Putting this checklist into practice means connecting personal data, requests, responsibilities and evidence across departments. Zycato, SQ1’s Data Privacy Intelligence platform, helps your teams manage that work in one place.

• Find and map personal data: Discover what you hold, classify it and understand where it moves.
• Manage consent and rights requests: Maintain consent records and coordinate withdrawal, access, correction and erasure workflows.
• Coordinate privacy tasks: Manage retention, vendor assessments and breach-response workflows with clear ownership.
• Track readiness and evidence: Identify outstanding gaps, monitor actions and maintain records for reviews and audits.

By connecting these activities, Zycato helps teams put their DPDP compliance roadmap into action before May 2027.

Prepare for the May 2027 DPDP Deadline

Use the remaining implementation window to close privacy gaps, test operational workflows and establish accountability across departments.

Build DPDP readiness with Zycato and SQ1’s end-to-end DPDP compliance services.

Frequently Asked Questions

1. When do the DPDP Rules come into force?

They commence in phases: specified Rules from November 2025, Rule 4 after twelve months in November 2026, and most operational Rules after eighteen months in May 2027.

2. How long do companies have to comply with the DPDP Rules 2025?

Most operational requirements follow an eighteen-month transition from Gazette publication. Organizations should use this period to implement and test applicable processes before the May 2027 phase.

3. What is the penalty for non-compliance with the DPDP Act?

Penalties depend on the contravention. The Act provides ceilings of ₹250 crore for failure to take reasonable security safeguards and ₹200 crore for breach-notification failures. These are maximum amounts, not automatic fines.