Ready to read some uncomfortable stats? A recent EY survey found that close to 70% of professionals across sectors in India aren’t very familiar with the DPDP Act, and more than 80% haven’t even updated their privacy policies yet.
If that sounds like your business, be warned. The clock is ticking. This article will help you familiarize yourself with the DPDP Act and its implications for your organization.
Table of Contents
What is the DPDP Act, and why does the deadline matter now?
India’s Digital Personal Data Protection Act finally became operational when the DPDP Rules 2025 were notified by MeitY on November 13, 2025. That notification started an 18-month countdown to full enforcement, and the rules aren’t rolling out all at once; they’re arriving in three distinct phases, each with its own set of obligations attached.
The three phases at a glance
- November 13, 2025 (already in force): The Data Protection Board of India was formally established. Complaints can already be filed.
- November 13, 2026: Consent Manager registration becomes mandatory, and the Act’s penalty and enforcement machinery goes live, six months before the final deadline.
- May 13, 2027: The hard deadline. Full compliance, notice requirements, consent standards, data principal rights, security safeguards, breach reporting, retention rules, and children’s data protections all become enforceable, with no grace period expected.
A January 2026 MeitY consultation also proposed compressing some of these deadlines further for larger data processors. That change hasn’t been formally gazetted yet, but it’s worth planning around the earlier date rather than assuming you have the full runway. You can read the original DPDP Rules notification directly if you want the source document.
Who actually needs to comply?
Almost anyone processing personal data of Indian residents, regardless of where the business itself is based. The Act sorts organizations into three roles.
- A Data Fiduciary decides why and how personal data is processed; that’s most businesses that collect customer data, whether that’s a login form, a purchase, or a support ticket.
- A Data Processor handles data on someone else’s behalf- think cloud hosting, payroll software, or CRM tools, and the obligations don’t disappear just because you’ve outsourced the work.
- A Significant Data Fiduciary (SDF) is a Data Fiduciary that the government designates for extra scrutiny, based on the volume or sensitivity of data it handles, and SDFs carry heavier obligations, such as appointing an India-based Data Protection Officer, conducting regular independent audits, and completing Data Protection Impact Assessments.
If you’re not sure which category applies, a useful rule of thumb: if you’d be the one a regulator calls first when something goes wrong with a customer’s data, you’re the Data Fiduciary, regardless of who’s technically hosting or processing it on your behalf.
What should be on your DPDP compliance checklist?
Skip the generic advice and focus on what the Rules specifically require.
Here’s the core list:
- Rewrite your consent notices: They need to be clear, specific about purpose, and easy to understand, not buried in legal language nobody reads.
- Set up a grievance mechanism: Data principals need a real, accessible way to raise complaints or request their data be corrected or erased.
- Build a breach notification process: You need to be able to notify both the Data Protection Board and affected individuals quickly if something goes wrong.
- Map your data and set retention rules: The Rules require a minimum one-year retention of certain logs, with sector-specific defaults for others, so know exactly what you’re storing and for how long.
- Handle children’s data with verifiable consent: Processing data for anyone under 18 requires verifiable parental consent, with specific approved verification methods.
- Review your vendor contracts: If a third party processes data on your behalf, that relationship must also meet DPDP standards; the obligation doesn’t stop at your own systems.
- Check your cross-border transfer setup: Especially if you’re an SDF, since restrictions here are being enforced early.
Failure to maintain reasonable security safeguards alone can draw fines of up to ₹250 crore, and violations compound per category rather than capping at a single annual figure.
How much time do you realistically need?
More than most businesses assume. Typical enterprise DPDP programs take 9 to 12 months to complete a proper gap assessment, implement controls, and reach audit readiness, and that’s before accounting for vendor contract renegotiations, which often become the slowest part since they depend on external parties responding on your timeline, not theirs.
Where does your infrastructure fit into this?
This is the part that’s easy to overlook: DPDP compliance isn’t purely a policy-and-paperwork exercise; your actual infrastructure plays a role, too. Where your data is physically stored, and which country’s laws govern the company operating that infrastructure, both factor into how clean your compliance story is during an audit.
Hosting on infrastructure that’s built around Indian regulatory requirements from the start removes one variable you’d otherwise have to explain and document separately. If you’re mapping out what needs to change before the deadline, it’s worth working with an enterprise that follows the DPDP Compliance Checklist as part of that broader infrastructure review, not as an afterthought once everything else is decided.
The bottom line
The DPDP deadline isn’t a single date you can prepare for at the last minute. Phase 2 lands in November 2026, and full compliance is due by May 2027, with real, stacking penalties attached, not a single annual cap you can budget around and forget. Given that most Indian businesses are still behind on even the basics, starting the gap assessment now, rather than waiting for the enforcement date to get closer, is the difference between a manageable rollout and a scramble against a deadline that isn’t moving, no matter how compressed some of the earlier milestones end up being.
