On this page · 9 sections
Summary. India's Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) and the Act's commencement notification (G.S.R. 843(E)) sit in Gazette issues dated 13 November 2025. Rule 4 on Consent Managers starts one year after publication, on or about 13 November 2026. Rules 3, 5 to 16, 22 and 23, with most of the Act's operative sections, start eighteen months after publication, which computes to 13 May 2027, 193 days from 1 November 2026. That date switches on standalone notices, provable consent, security safeguards with one-year log retention, breach reports within 72 hours, erasure duties, a 90-day ceiling on grievances, verifiable parental consent, Significant Data Fiduciary audits and penalties of up to ₹250 crore. Nothing published in 2026 moves it. A proposal reported in January 2026 has not been notified. S.O. 5458(E) made two wording fixes. The Supreme Court issued notice on a publishers' challenge on 27 October 2026 and reportedly refused an interim stay. We found no published appointment to the Data Protection Board, and the Kerala High Court expects it to be functional by about 2 December 2026.
About this article. This is for compliance leads, data protection officers and CTOs at organisations handling personal data of people in India. On 1 November 2026 we checked every section and rule number against the English Gazette copies on MeitY's site: the Act as published on 11 August 2023, G.S.R. 843(E), G.S.R. 846(E) with the corrigenda G.S.R. 892(E), and S.O. 5458(E). This is general information, not legal advice; confirm with counsel before you act. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
Where the DPDP clock stands on 1 November 2026
Two Gazette notifications dated 13 November 2025 set the timetable, and neither names a calendar date: both count periods from publication.
| Item | Status on 1 November 2026 |
|---|---|
| DPDP Rules, 2025, G.S.R. 846(E) | Gazette No. 760, dated 13 November 2025 |
| Act commencement, G.S.R. 843(E) | Gazette No. 757, same date: on publication, one year, eighteen months |
| Phase 1: Rules 1, 2, 17 to 21; Act sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and (3) | In force since 13 November 2025 (Rule 1(2); G.S.R. 843(E)(a)) |
| Phase 2: Rule 4; Act sections 6(9) and 27(1)(d) | On or about 13 November 2026 (Rule 1(3); G.S.R. 843(E)(b)) |
| Phase 3: Rules 3, 5 to 16, 22, 23; Act sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37, 44(2) | On or about 13 May 2027 (Rule 1(4); G.S.R. 843(E)(c)) |
| Proposal to cut 18 months to 12 | Reported January 2026; no amending notification found |
| S.O. 5458(E), Removal of Difficulties Order | Gazette No. 5248, 6 October 2026; wording fixes to sections 9(1) and 10(2)(c)(ii) only |
| Supreme Court challenge by news publishers | Notice issued 27 October 2026; stay reportedly refused; returnable 17 November 2026 |
| Data Protection Board | Established by G.S.R. 844(E); no appointment published; applications invited 6 May 2026 |
MeitY's document index, read on 1 November 2026, shows S.O. 5458(E) as its newest DPDP record. That order inserts of before the words on a person with disability in section 9(1), and changes audit to data audit in section 10(2)(c)(ii). It does not amend Rule 1 or the commencement notification.
The 12-month proposal. dpdprules.org traces this to a Business Standard report of 22 January 2026 about a shorter window for Significant Data Fiduciaries, and records a Lok Sabha answer of 12 August 2026 that still described eighteen months. S.S. Rana & Co. wrote that feedback was due by 4 February 2026 and that faster starts for transfer limits and Rule 8(3) retention were also proposed. A 12-month window would land on 13 November 2026, yet we found no draft or amendment. Changing Rule 1 needs previous publication under section 40(1). A fresh commencement notification under section 1(2) has no such condition, so absence of a draft is not proof. Plan to 13 May 2027, and keep SDF and retention workstreams able to move earlier.
The Supreme Court petition. LiveLaw reports that the Digital News Publishers Association challenges sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) and Rules 16, 17 and 23, with notice returnable on 17 November 2026. The Federal and The Tribune report that the court declined an interim stay without first hearing the Centre. We read press reports, not the order, so check after that hearing.
The Board. G.S.R. 844(E) established it from 13 November 2025. MeitY invited applications for one chairperson and four members on 6 May 2026. On 7 October 2026, Central Government Counsel told the Kerala High Court the Board was constituted but not yet functional, and the court said it expects that within eight weeks, which ends on 2 December 2026. India Data Law records no appointment and dates the recruitment advertisement to 6 June 2026, so be wary of posts treating June as an appointment date. Most Board powers (section 27) and the penalties (section 33) only start in May 2027 anyway. Section 27(1)(d), on a Consent Manager's breach of registration conditions, starts with Rule 4.
13 May or 14 May?
The Rules issue is printed Thursday 13 November 2025, but its e-Gazette code carries 14112025, its digital signature is dated 14 November and PIB announced the Rules that day. Trackers such as MirvoLegal compute 13 May 2027; our legacy data remediation guide uses 14 May. Corrigenda G.S.R. 892(E) reworded the closing words of Rules 1(3) and 1(4) and left both periods alone. Set 12 May 2027 as your internal go-live and the one-day argument stops mattering.
What this checklist adds to our earlier DPDP guides
The DPDP engineering playbook maps systems to rules, the consent manager readiness checklist covers Rule 4 integration, the DPDP compliance cost guide covers budgets, and DPDP consent for GA4, ad pixels and CRM is for marketing teams. This article is the audit view: the evidence a compliance lead should be able to show on the morning of 13 May 2027.
The rule-by-rule map
This map follows the Rules and the Schedule to the Act. Rules 5 and 16 cover State benefits and the research exemption, so we leave them out.
| Rule | What it requires | Act provision | Maximum penalty |
|---|---|---|---|
| Rule 3 | Standalone, plain-language notice; itemised data; specified purpose; links to withdraw, exercise rights and complain | Sections 5, 6 | ₹50 crore |
| Rule 4 (from about 13 Nov 2026) | Consent Manager registration and obligations | Section 6(9); sections 6(7) and 6(8) start in May 2027 | ₹50 crore |
| Rule 6 | Reasonable security safeguards, one-year log retention, processor contract clauses | Section 8(5) | ₹250 crore |
| Rule 7 | Breach intimation to individuals and the Board, detailed report within 72 hours | Section 8(6) | ₹200 crore |
| Rule 8 | Erasure after three years' inactivity for large platforms, 48 hours' notice, one-year minimum retention | Section 8(7), 8(8) | ₹50 crore |
| Rule 9 | Publish DPO or contact person details | Section 8(9) | ₹50 crore |
| Rules 10 to 12 | Verifiable consent for children and lawful guardians; listed exemptions | Section 9 | ₹200 crore |
| Rule 13 | SDF annual DPIA and data audit, algorithm due diligence, localisation of specified data | Section 10 | ₹150 crore |
| Rule 14 | Rights requests, grievance period capped at 90 days, nomination | Sections 8(10), 11 to 14 | ₹50 crore |
| Rule 15 | Transfers outside India subject to government orders | Section 16 | ₹50 crore |
| Rules 22, 23 | Digital appeals to TDSAT; government calls for information | Sections 29, 36 | Not applicable |
Consent Manager registration needs a working Board, so Rule 4's start may have little practical effect until appointments are made.
The final checklist
1. Notices that stand on their own (Rule 3, sections 5 and 6)
Rule 3 requires a notice that can be understood without any other document, in clear and plain language, with an itemised description of the personal data, the specified purpose, and a specific description of the goods, services or uses the processing enables. It must give the link and other means to withdraw consent, exercise rights and complain to the Board. Section 5(3) adds the option to read it in English or any Eighth Schedule language. Section 5(2) also requires a notice, as soon as reasonably practicable, to people whose consent predates commencement; read with section 1(2), that likely means all consent collected before section 5 starts in May 2027.
Evidence for 13 May 2027: one versioned notice per purpose, with a record of the exact text each person saw; a language switch; links that work on web and app.
2. Consent you can prove, and withdraw as easily (section 6, Rule 4)
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs. Withdrawal must be comparably easy, and processing must stop within a reasonable time afterwards, at your processors too. Section 6(10) makes you prove, in any proceeding, that notice was given and consent obtained.
Section 6(7) lets a person act through a registered Consent Manager. In our reading it does not oblige a business to use one, and it starts in May 2027. A Consent Manager must be a company incorporated in India with net worth of at least ₹2 crore and must keep consent records for at least seven years, under the First Schedule.
Evidence: a consent ledger tying each record to a notice version and timestamp; a withdrawal control that is one click if consent was one click; a fan-out that stops downstream processors.
3. Security safeguards (Rule 6, section 8(5))
Rule 6 sets minimum measures: encryption, obfuscation, masking or virtual tokens; access control; logging, monitoring and review to detect unauthorised access; backups for continued processing; one-year retention of those logs and related personal data unless another law says otherwise; security clauses in processor contracts; and organisational measures. This is the ₹250 crore line, and it covers processing your vendors do for you.
Evidence: a control matrix mapped to Rule 6(1)(a) to (g); at least 12 months of logs in your SIEM and cloud logging; signed processor addenda with security terms.
4. Breach intimation on two clocks (Rule 7, section 8(6))
Tell each affected person without delay, through their user account or registered contact channel, in plain terms: what happened, the likely consequences, what you have done, what they can do, and who to contact. The Board gets a description without delay, then within 72 hours of becoming aware (or longer if it allows on a written request) a detailed report covering updated facts, causes, mitigation, any findings about who caused it, remedial steps and the notices sent. Neither section 8(6) nor Rule 7 sets a risk threshold, so every personal data breach triggers both duties.
Evidence: a runbook with both clocks; pre-approved templates; a tabletop exercise on record with timings.
5. Retention and erasure (Rule 8, section 8(7) and 8(8))
Erase personal data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make your processors erase their copies. The Third Schedule covers e-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh. They must erase three years after the person last engaged, or three years from the Rules' commencement if later, with notice at least 48 hours before. Account access and stored virtual tokens are carved out.
Rule 8(3) pulls the other way for everyone: keep personal data, traffic data and processing logs for at least one year from processing for the Seventh Schedule purposes, then erase unless another law requires more. Its illustration has an e-book platform keeping order records for a year even after the buyer deletes her account.
Evidence: a retention schedule per data store; deletion jobs that reach backups, warehouses and processors; a 48-hour notice path if you fall in the Third Schedule.
6. A named contact and a 90-day grievance ceiling (Rules 9 and 14)
Publish the business contact details of your Data Protection Officer, or of a person who can answer questions about processing, prominently on your website or app and in every reply to a rights request. Publish how people can exercise their rights, which identifier you need, and your grievance response period, which Rule 14(3) caps at 90 days. Section 13(3) makes people exhaust that route before going to the Board, and section 14 lets them nominate someone to act on death or incapacity.
Evidence: a rights form or portal; an identity check that does not over-collect; an SLA dashboard measured against your published period.
7. Children and persons with disability (Rules 10 to 12, section 9)
Before processing a child's personal data you need verifiable consent from a parent, and you must check that the person claiming to be the parent is an identifiable adult of at least 18. Rule 10 allows that check against reliable details you already hold, or details or a virtual token from an authorised entity, including through a Digital Locker service provider. For a person with disability, verify that the guardian was appointed by a court, a designated authority or a local level committee.
Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. The Fourth Schedule exempts some classes, such as clinical establishments, educational institutions, creches and school transport, and some purposes, such as real-time location for a child's safety, each within stated limits.
Evidence: a documented age-assurance decision; a parental consent flow; ad targeting and profiling switched off for accounts flagged as under 18.
8. Significant Data Fiduciary duties (Rule 13, section 10)
Only an entity the Central Government notifies is a Significant Data Fiduciary, section 10 starts with the eighteen-month group, and we found no notification. If designated, you need a Data Protection Officer based in India who answers to your board and an independent data auditor. You also need a DPIA and data audit every 12 months with a report of significant observations to the Board, due diligence that your algorithmic software does not put users' rights at risk, and measures to keep government-specified personal data and its traffic data in India.
Evidence for likely candidates: a DPIA template, an auditor shortlist, and a data map showing which datasets would have to stay in India.
9. Transfers outside India (Rule 15, section 16)
The Act allows transfers abroad unless the government restricts a country by notification. Rule 15 adds any requirements the Central Government sets by order about making personal data available to a foreign State or an entity under its control. We found no published country list or order.
Evidence: a transfer register listing destination, processor and data category, so you can reroute if a restriction lands.
10. Processors, government requests and appeals (section 8(2), Rules 22 and 23)
Engage processors only under a valid contract carrying the Rule 6 security clauses. Rule 23 and the Seventh Schedule let authorised government officers call for information within a set period and, on sovereignty or security grounds, bar you from telling the affected person. Appeals against Board orders go digitally to the Appellate Tribunal, TDSAT, under Rule 22.
Evidence: a processor inventory with contract status; a government-request procedure with legal sign-off; a request log.
Penalties: what the Schedule says
Section 33 is in the eighteen-month group and applies the Schedule, so no DPDP penalty can be imposed before 13 May 2027, and only a functioning Board can impose one.
| Breach | Act provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | Section 8(5) | ₹250 crore |
| Failure to notify the Board or affected individuals of a breach | Section 8(6) | ₹200 crore |
| Breach of additional obligations for children | Section 9 | ₹200 crore |
| Breach of additional SDF obligations | Section 10 | ₹150 crore |
| Breach of a Data Principal's own duties | Section 15 | ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board | Section 32 | Up to the penalty for the original breach |
| Breach of any other provision of the Act or Rules | Various | ₹50 crore |
Section 33(1) reserves penalties for breaches the Board finds significant. Section 33(2) tells it to weigh the nature, gravity and duration of the breach, the type of data, repetition, any gain made or loss avoided, mitigation, proportionality and the likely impact on the person. In our reading, a breach caused by weak access control and then reported late could sit in two rows at once.
A 27-week run-up plan
| Window | Milestone | Usual owner |
|---|---|---|
| November 2026 | Rule 4 starts; decide your position on Consent Managers; check the 17 November hearing; freeze the data inventory | Privacy lead, engineering |
| December 2026 to January 2027 | Check Board status after 2 December; rewrite notices to Rule 3; build withdrawal; decide the age-assurance approach | Product, legal |
| January to February 2027 | Close Rule 6 control gaps; set 12-month log retention; sign processor addenda | CISO, procurement |
| February to March 2027 | Breach runbook with both clocks; templates; tabletop exercise | Security, communications |
| March to April 2027 | Erasure jobs, 48-hour notices, published grievance period, DPO or contact details live | Engineering, support |
| 1 to 12 May 2027 | Change freeze, evidence pack, sign-off by the board or leadership | Compliance lead |
Notes for EU, US and multinational teams
Section 3 reaches processing outside India connected with offering goods or services to people in India. GDPR teams can reuse most of their machinery with three changes: no legitimate-interests basis (only consent or the section 7 list), every breach notifiable to individuals, and a child is anyone under 18. US teams can also read our guide to US state privacy laws in 2027.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services help compliance leads turn this checklist into evidence, from control mapping against Rule 6 to breach runbooks with both Rule 7 clocks. Talk to us at /contact-us/.
Last updated: 1 November 2026.
