The DPDP dates: 13 Nov 2026 and 13 May 2027, and what applies on each

Under the Gazette notifications dated 13 November 2025, registration of Consent Managers starts on 13 November 2026, and nearly every duty the DPDP Act places on businesses, together with the Data Protection Board's power to impose penalties, starts on 13 May 2027 G.S.R. 843(E) Rule 1 of the DPDP Rules, G.S.R. 846(E). The text counts from "the date of publication" and names no calendar date, and the eGazette copies were digitally signed on 14 November 2025, so some sources give 14 November 2026 and 14 May 2027. A business ready by 12 November 2026 and 12 May 2027 is ready on either reading.

What does the Gazette text say?

Rule 1 of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), as corrected, sets three starts:

As first printed, sub-rules (3) and (4) ended "of this Gazette". The corrigenda of 10 December 2025 (G.S.R. 892(E)) replaced both with "in the Official Gazette". Neither wording names a calendar date.

For the Act itself, G.S.R. 843(E), issued under s.1(2) of the Act on the same day, appoints the same three points: (a) "the date of publication of this notification in the Official Gazette"; (b) "one year from the date of publication of this gazette" for s.6(9) and s.27(1)(d); and (c) "eighteen months from the date of publication of this gazette" for the rest of the Act's operative provisions.

Is it 13 or 14 November?

The printed date is 13 November. Both notifications appear in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), whose masthead reads "Thursday, November 13, 2025", and each notification is headed "New Delhi, the 13th November, 2025". Counted from that date, the starts are 13 November 2026 and 13 May 2027.

Three things point to the 14th. The eGazette numbers end in the 14th (CG-DL-E-14112025-267647 for G.S.R. 843(E) and CG-DL-E-14112025-267650 for G.S.R. 846(E)); both copies were digitally signed on 14 November 2025, at 10:37 and 10:43 IST; and the PIB explainer of 17 November 2025 says the Rules were "notified on 14 November 2025". Counted from the 14th, the starts are 14 November 2026 and 14 May 2027.

What has applied since 13 November 2025?

The definitions (s.2) and the provisions that set up the Data Protection Board and its procedure (ss.18 to 26), with ss.35 and 38 to 43 and s.44(1) and (3) of the Act G.S.R. 843(E), item (a). On the Rules side, Rules 1 and 2 and Rules 17 to 21, which deal with appointing the Board's members, their terms, the Board's meetings, its working as a digital office and its staff Rule 1(2).

None of these places a duty on a business.

What starts on 13 November 2026?

Only the Consent Manager framework:

• s.6(9) Every Consent Manager must be registered with the Board, on the conditions the Rules set.
• s.27(1)(d) The Board may inquire into a breach of a condition of a Consent Manager's registration.
• Rule 4 and the First Schedule Who may apply (Part A) and what a registered Consent Manager must do (Part B).

For most businesses nothing changes on this date. A business that accepts consent through a Consent Manager should check that the Board has registered it. The Act's other Consent Manager provisions, s.6(7) and s.6(8), start with the main tranche on 13 May 2027. The Consent Managers post explains the role, and the DPDP Consent Managers page covers registration from 13 November 2026.

What starts on 13 May 2027?

Sections 3 to 5, s.6(1) to (8) and (10), sections 7 to 17, s.27 except s.27(1)(d), sections 28 to 34, 36 and 37, and s.44(2) of the Act G.S.R. 843(E), item (c); and Rules 3, 5 to 16, 22 and 23 Rule 1(4). In practice:

The penalties in the Schedule to the Act start the same day s.33. They go up to ₹250 crore for failing to take reasonable security safeguards (item 1), ₹200 crore for failing to notify a breach to the Board or an affected person (item 2), ₹200 crore for breaching the duties on children's data (item 3), ₹150 crore for a Significant Data Fiduciary's additional duties (item 4), ₹10,000 for an individual's breach of the duties in s.15 (item 5), and ₹50 crore for any other breach of the Act or the Rules (item 7).

The same day, s.44(2) omits s.43A from the Information Technology Act, 2000. Until then, s.43A and the rules made under it continue to apply.

Can the dates move?

The dates come from two notifications in the Gazette. Two later Gazette instruments changed the text without moving any date: corrigenda to the Rules (G.S.R. 892(E), 10 December 2025), which reword Rule 1(3) and (4) as quoted above and correct other typographical slips, and the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated 5 October 2026), which rewords s.9(1) and s.10(2)(c)(ii) of the Act. Any change to a start date would need a new notification. Fohrkast publishes a dated note for each signed rulebook version at fohrkast.com/law/changes.

What should be ready by each date?

By 12 Nov 2026

If the business uses, or plans to use, a Consent Manager, a record of checking that it is registered with the Board (duty). Nothing else in the Rules starts on that date.

By 12 May 2027

The duties that start with the main tranche. Among them:

• A notice before or with every request for consent, in English or a language of the Eighth Schedule (s.5, Rule 3), and a notice to people who consented before that date (s.5(2)) (duty, legacy notice).
• A published way to make requests and a published grievance period of at most 90 days (Rule 14(1) and (3)) (duty).
• A way to tell affected people and the Board about a breach, with the detailed report within 72 hours of becoming aware (Rule 7) (duty). The DPDP breach reporting page sets out each notice and the 72 hour report.
• Reasonable security safeguards, with logs kept for one year (s.8(5), Rule 6(1)(e)) (duty).

How does Fohrkast use these dates?

Rulebook in.dpdp version 1 dates each of its 27 duties from these notifications, counting from 12 November 2026 and 12 May 2027. Until a duty's start date, Fohrkast shows it as a recommended step rather than a legal deadline. The DPDP compliance checklist lists the 27 duties with their clauses and start dates.

Fohrkast dates each of these duties for the business and keeps the evidence. Request access »