DPDP Compliance Timeline 2025 to 2027: What Is Due When

Published on 10/18/2026 • Updated on 10/22/2026

A plant manager asks a simple question in a review meeting: what is the deadline? The answer is not one date. The data protection law came in stages, and each stage switches on different duties. Teams that treat it as a single deadline in 2027 will find that some parts already apply and the largest parts need months of preparation.

This guide lays out the timeline from the Act in 2023 to the main duties around mid-May 2027, explains what each stage means for a facility, and offers a plan that works backward from the main date. The dates come from the Rules and from official releases. Confirm them with your legal adviser, since commencement depends on gazette dates.

The timeline at a glance

The table is a summary of Rule 1. Dates marked as around are calculated from the publication date and should be confirmed by your legal adviser.

What already applies

Rules 1, 2 and 17 to 21 came into force on publication. They deal with the short title, definitions and the procedures of the Data Protection Board of India, which the Press Information Bureau describes as the body that oversees compliance and inquires into breaches. For a facility, there is little to do under these rules directly, except to know that the regulator exists and that its procedures are in place.

The Consent Manager stage

Rule 4 and the First Schedule deal with the registration and obligations of Consent Managers. A Consent Manager is an entity that gives people a single platform to give, manage, review and withdraw consent. Rule 4 comes into force one year after publication, around November 2026. Most facilities are not Consent Managers, but you may meet one if a customer uses such a platform to manage consent.

The main stage: mid-May 2027

The largest block of duties starts eighteen months after publication. It includes Rule 3 (notice), Rule 6 (security safeguards), Rule 7 (breach intimation), Rule 8 (retention and erasure), Rule 9 (contact details), Rules 10 to 12 (children and persons with disability), Rule 13 (Significant Data Fiduciaries), Rule 14 (rights), Rule 15 (transfers outside India) and others.

• Notice at every collection point, including the gate and HR forms.
• Safeguards such as masking, access control and logs kept for one year.
• A breach routine: people without delay, the Board without delay and in detail within 72 hours.
• A retention and erasure schedule.
• A published contact and a grievance route that responds within 90 days.

A plan that works backward from May 2027

These dates are a suggestion. A larger site with many systems will need longer, and a small office may need less.

What the dates mean for each team

A single timeline looks different to each team, because each owns different data and different tasks. Share the relevant part with each head.

HR

Employee files, attendance and medical forms need a purpose, a retention rule and a notice at the joining stage. Plan to update the joining pack and the attendance consent wording before the main date.

Security and administration

The visitor register, CCTV and the courier log are collected from people who never signed a contract with you. Notices at the gate and on the camera signs, masking of phone numbers, and a retention date are the first fixes.

IT and procurement

Logs, backups, access control and vendor contracts sit here. Rule 6 asks for logs to be kept for one year and for contract terms with processors. Start the vendor review early, since contract changes take weeks.

Management

Management owns the budget and the decision on who answers questions and complaints. Name the contact person early, because Rule 9 expects published contact details and Rule 14 expects a grievance route that responds within ninety days.

Do not forget vendors

Rule 6 expects appropriate contract terms between a fiduciary and a processor to take reasonable security safeguards, and Rule 8 expects a processor to hold logs for the same minimum period. Review contracts with your software vendors, cloud hosts and security agencies. Ask what they do to protect data, how long they keep logs and how they delete data at the end of a contract.

A worked example: a plant starting in October 2026

Seven months sounds long, but each step depends on the one before. A plant that starts the inventory in January leaves no buffer.

Slippage is normal. Vendor replies arrive late, a department head is on leave, a pilot shows a problem. A plan that has no buffer turns every delay into a missed date. Build the buffer into the plan on day one, and spend it only with the agreement of the owner of the whole project.

Keep a one-page tracker with three columns: done, open and blocked. Review it monthly with management, and record the reason for every blocked item. The tracker is also useful evidence later that the organisation took the work seriously and acted in good time.

Mistakes to avoid

Another mistake is treating the plan as a one-off. Review it every quarter, since the Government and the Board may issue further clarifications.

A 90-day starter plan

Use the next three months to get ahead of the main date.

Report progress to management monthly with a short table of done, open and blocked.

Five-minute self-check

Check your readiness against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

The DPDP timeline has several dates, and the largest block of duties starts around mid-May 2027. The practical approach is to work backward from that date with named owners.

Start with the inventory and the gate, then notices, vendors and tests. Review the plan every quarter.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.