Deadlines

Two clocks, not one. They tick on the same dates, but they are different instruments.

G.S.R. 843(E) brings the Act's sections into force; Rule 1 brings the Rules into force. Citing one for the other is the most common mistake in DPDP explainers.

247 days to 13 May 2027

In force since

13 November 2025

Act ss.1(2), 2, 18–26 (the Board), 35, 38–43, 44(1) and (3)
Rules 1, 2, 17–21

The Board exists on paper; it has no chairperson yet.

One year

November 2026

Act s.6(9) — Consent Manager registration; s.27(1)(d)
Rule 4 and the First Schedule

Only matters if you are, or want to be, a Consent Manager.

Eighteen months

13 May 2027

Act ss.3–17, 27–34, 36, 37, 44(2)
Rules 3, 5–16, 22, 23

This is when substantive obligations bite. Notice, consent, security, breach, retention, children, rights, cross-border.

Proposed, not final

MeitY has proposed shortening the window for Significant Data Fiduciary duties to twelve months, which would move them to November 2026. Nothing has been notified. If you are in a signalled sector — healthcare, finance, e-commerce, social media, AI — plan as if it lands.

Last checked against meity.gov.in: 8 September 2026.

Which of these dates lands on you?

Start the check