DPDP Act Compliance Countdown
India's Digital Personal Data Protection Act is being brought into force in phases. The date below is an internal planning target our team uses to pace readiness work — not an official statutory deadline. Penalties can reach up to ₹250 crore per contravention once enforcement is notified.
Get the deadline readiness checklist now
Enter your work email to download the board-ready 10-step checklist immediately. We also record your address so we can send milestone alerts if — and when — new DPDP Rules or enforcement dates are officially notified. Alert delivery depends on our notification configuration and is not a fixed monthly cadence.
The 10 things to have signed off before the deadline
Aligned to the DPDP Act 2023 and the draft DPDP Rules 2025. Each item maps to an operating owner — DPO, engineering, legal or the Board.
Appoint or engage a Data Protection Officer
Significant Data Fiduciaries must have a DPO based in India reporting to the Board. Most mid-market orgs use an outsourced DPO retainer.
Map every data flow with a Record of Processing
Inventory personal data by purpose, lawful basis, retention, third parties, and cross-border transfers.
Ship a lawful, versioned consent notice
Notices must be clear, itemised by purpose, in English and every applicable Eighth-Schedule language, with a withdraw path as easy as consent.
Implement Data Principal Rights (DPR) intake
Access, correction, erasure, nomination and grievance — with a 30-day SLA and audit trail.
Deploy a Consent Management Platform
Consent capture, versioning, receipts, and withdrawal propagation to every downstream processor.
Encrypt, log, and monitor personal data (Rule 6)
Encryption in transit and at rest, monitored access logs retained for at least a year, tested backups.
Build a 72-hour breach notification runbook (Rule 7)
Board-notified within 72 hours, affected principals notified promptly, evidence retained.
Contractualise every Data Processor
DPDP-compliant DPAs with vendors covering security safeguards, sub-processors, breach reporting and deletion.
Verifiable parental consent for children's data
Verified parental consent for under-18s, plus profiling and behavioural-ad restrictions.
Board-level attestation of DPDP readiness
Independent audit and DPIA outputs signed off at Board level with remediation timelines.
What is already on the enforcement clock
A snapshot of the phased rollout. Full detail lives on the enforcement timeline.
- January 2025
Draft DPDP Rules, 2025 Published for Consultation
The Ministry of Electronics and Information Technology published the draft DPDP Rules, 2025 for public consultation, providing the detailed framework for implementation of the Act.
- October 2025
DPDP Rules, 2025 Finalised
The final version of the DPDP Rules, 2025 was notified, covering consent management, security safeguards, breach notification, children's data, Board operations, and cross-border transfers.
- 2025-2026
Phased Implementation Begins
Different provisions of the Act and Rules are brought into force on different dates through government notifications. Companies are expected to start implementing compliance measures during this period.
- Expected 2026
Data Protection Board of India Becomes Fully Operational
The Board is expected to be fully constituted and operational, capable of receiving complaints, conducting investigations, and imposing penalties.
- Expected 2026
Significant Data Fiduciaries to Be Notified
The Central Government is expected to notify the first set of Significant Data Fiduciaries who will have additional compliance obligations including DPO appointment, audits, and impact assessments.
- Expected 2026-2027
Consent Manager Registration Opens
The Board is expected to begin accepting registration applications from Consent Managers who want to provide consent management services.
What is your exposure on Day 1?
The Board can impose penalties up to ₹250 crore per contravention. Our free calculator gives a defensible, board-ready number in under 3 minutes.
Keep moving before the deadline
From self-assessment to independent audit — the shortest path to a defensible position.