India’s data protection regime now runs on two different kinds of clock, and organisations routinely track only the first. There is the implementation calendar, the phased dates on which provisions of the DPDP Act and Rules switch on, ending 13 May 2027. And there are the operational clocks, the 72 hours, 90 days and 48 hours that start running the moment something happens, and that keep running for as long as you process personal data.
This is a reference for both. If you want the narrative version of how we got here and what the Rules changed, read our companion piece on the countdown to 13 May 2027. What follows is the dates themselves, in one place, with what has to be true by each one.
Where we are today
The Digital Personal Data Protection Rules, 2025 were notified in the Gazette on 13 November 2025, which simultaneously established the Data Protection Board of India and started an eighteen-month phased commencement. As of July 2026, that puts most organisations in an uncomfortable but useful position: the Board exists and can receive complaints, but the substantive obligations have not yet bitten. This is build time, and there is less of it than the 2027 headline suggests.
Roughly four months remain to the Consent Manager milestone in November 2026, and under ten months to full compliance in May 2027. Consent architecture, data mapping and retention engineering are quarter-scale projects, not sprint-scale ones.
Clock one: the implementation calendar
Data Protection Board established; definitions and transitional provisions go live.
Consent Manager framework commences; registration with the Board opens.
Full compliance deadline for the substantive obligations.
The Act does not commence all at once. Section 1 lets the Central Government appoint different dates for different provisions, and the November 2025 notifications used that power to create three phases.
| Date | Phase | What switches on |
|---|---|---|
| 13 November 2025 | Phase 1, immediate | The Data Protection Board of India is established and operational. The Act’s definitions become legally live, along with the miscellaneous and transitional provisions and the Rules governing Board procedure, appointments and terms of service. |
| 13 November 2026 | Phase 2, 12 months | The Consent Manager framework commences: registration with the Board opens and the obligations attaching to Consent Managers take effect. |
| 13 May 2027 | Phase 3, 18 months | Full compliance. The core operational duties land together, notice and consent, the obligations of Data Fiduciaries, security safeguards, breach reporting, children’s data, Data Principal rights, cross-border transfer conditions, Significant Data Fiduciary duties, and the penalty regime. |
The practical consequence of that shape is that almost everything arrives on one day. There is no staggered on-ramp for notice, consent, rights handling and security safeguards, they become enforceable together, on a date the whole market is working towards. Organisations that leave the build to early 2027 will be competing for the same scarce privacy and engineering capacity as everyone else, and will be remediating under live enforcement rather than ahead of it.
Clock two: the operational deadlines that never stop
These are the ones that matter after May 2027, and the ones most likely to be missed, because they are triggered by events rather than by the calendar. Each requires a process, an owner and evidence that the process ran.
| Clock | Deadline | What it demands |
|---|---|---|
| Breach, notify individuals | Without delay | Affected Data Principals must be told promptly, in plain language: what happened, what data was involved, the likely consequences, what you are doing about it, and how to reach you. |
| Breach, report to the Board | 72 hours | An initial intimation without delay, followed by a detailed report to the Data Protection Board within 72 hours of becoming aware, including root cause, remediation and preventive measures. Extensions are at the Board’s discretion, not yours. |
| Data Principal rights & grievances | 90 days maximum | Requests to access, correct, update, erase or nominate, and complaints raised through your grievance mechanism, must be resolved within 90 days. Treat it as a tracked SLA with identity verification built in. |
| Advance notice before erasure | 48 hours | Where data is due for erasure under the retention rules, the Data Principal must be given at least 48 hours’ notice, giving them the chance to re-engage and prevent deletion. |
| Log retention | Minimum 1 year | Processing logs and related records must be retained for at least a year. This overrides shorter log-rotation defaults, so most organisations need an explicit hold policy. |
| Erasure for specified classes | 3 years of inactivity | Certain classes of larger Data Fiduciary must erase personal data after three years of Data Principal inactivity, unless retention is required by law or the user re-engages. |
| Significant Data Fiduciary duties | Annual | SDFs carry an annual cycle: a Data Protection Impact Assessment, an audit, and due diligence on algorithmic software that could risk Data Principals’ rights, plus a DPO based in India. |
The overlap most teams miss: CERT-In runs a faster clock
CERT-In runs the faster clock. One personal-data breach can trigger both regimes at once: CERT-In requires reporting within 6 hours, while the DPDP Board report is due within 72 hours. Six hours is the binding constraint, so build a single incident-response playbook that serves both.
A security incident involving personal data can trigger two regimes at once, on very different timescales. CERT-In’s directions require reporting of specified cyber incidents within six hours of noticing them. The DPDP framework requires intimation to affected individuals without delay and a detailed report to the Data Protection Board within 72 hours.
Six hours is the binding constraint, and it is short enough that it cannot be met by a process invented during the incident. In practice this means one incident-response playbook with both regulators built into it: a rapid CERT-In notification path, a parallel assessment of whether personal data was involved, and a 72-hour Board reporting pack that is drafted while the investigation is still running. We cover the tighter obligation in detail in CERT-In’s six-hour incident reporting rule.
Working backwards from 13 May 2027
A deadline is only useful if it decomposes into work. Below is a realistic sequence for an organisation starting in the second half of 2026, adjust the pace to your data volumes and system estate, but resist the temptation to compress the first step.
| Window | Focus | What “done” looks like |
|---|---|---|
| Now – Q3 2026 | Know what you hold | Data inventory and flow mapping complete; personal data located across systems, vendors and backups; lawful basis and purpose recorded for each processing activity; a named owner for privacy. |
| Q4 2026 | Decide and design | Retention schedule defined per purpose; notice and consent architecture designed; Consent Manager position decided ahead of the November milestone; processor contracts reviewed for flow-down obligations. |
| Q1 2027 | Build | Consent capture, withdrawal and audit trail implemented; rights-request and grievance workflow live with the 90-day SLA tracked; security safeguards, logging and one-year retention in place; breach playbook covering both CERT-In and the Board. |
| Q2 2027 (to 13 May) | Test and evidence | Rights and erasure journeys tested end to end; breach response rehearsed against both clocks; SDF assessment concluded and, if in scope, DPIA and audit scheduled; evidence assembled so compliance can be demonstrated, not merely asserted. |
Five ways the timeline gets misread
- “Nothing applies until May 2027.” The Board has existed and been able to receive complaints since November 2025. The obligations are phased; the scrutiny is not.
- “There will be an extension.” The eighteen-month runway was the accommodation, granted in place of immediate commencement. Planning on a further one is a strategy, not a schedule.
- “72 hours is our breach deadline.” For anything CERT-In classifies as a reportable incident, six hours governs, and the obligation to tell affected individuals begins without delay, not at hour 72.
- “Retention means keeping less.” It cuts both ways: purpose-bound deletion for personal data, but a mandatory floor of at least one year for logs. Deleting logs too aggressively is now a compliance failure of its own.
- “We are not an SDF, so the annual duties do not apply.” Significant Data Fiduciary status is notified by the government based on volume and sensitivity, not self-declared. If your scale makes designation plausible, plan for the annual DPIA and audit rather than waiting to be told.
The bottom line
Two dates and four clocks. The dates, 13 November 2026 for Consent Managers, 13 May 2027 for everything else, determine when you must be ready. The clocks, without delay, 72 hours, 90 days, 48 hours, determine whether you stay compliant afterwards. Organisations that treat May 2027 as a project deadline will meet it and then drift; the ones that build the operational clocks into ordinary business process are the ones that will still be compliant in 2028.
Our DPDPA readiness assessment maps your current position against these obligations and returns a dated remediation plan built backwards from 13 May 2027. If you would rather start with the fundamentals, our overview of what the DPDPA requires is the place to begin.
Regulatory note: dates and obligations above reflect the DPDP Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. Commencement details and schedule-specific thresholds should be confirmed against the current gazette text and any subsequent notifications before you rely on them for a compliance decision.