24 October 2026 · By Simar Kaur, Emerge Legal
India’s data protection law is no longer coming. The Digital Personal Data Protection Act, 2023 has been brought into force in part, the Data Protection Board of India has been set up, and the Rules are final. Yet almost every duty that will touch a company’s customers, employees and vendors switches on together on 13 May 2027. For most businesses the work needed to meet that date takes longer than the six and a half months that remain.
The short version is this. 13 November 2026 is not your deadline unless you intend to operate as a Consent Manager. 13 May 2027 is. Until then the old regime under Section 43A of the Information Technology Act, 2000 still applies, and a government proposal to bring the deadline forward has been discussed but not yet published in the Gazette.
Three dates, and only one of them is yours
The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025 by G.S.R. 846(E). Rule 1 does not bring the Rules into force at once. It splits them into three tranches, and the Act’s own sections were notified by G.S.R. 843(E) to run on the same clock.
| Date | What comes into force | Who it binds |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21. The Data Protection Board is constituted and its procedure is set. | The Board and the government |
| 13 November 2026 | Rule 4. Registration and obligations of Consent Managers. | Platforms that want to act as Consent Managers |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23. Notice, consent, security, breach reporting, retention, children’s data, rights of individuals and cross-border transfer. | Every business that handles digital personal data |
Expect a wave of headlines next month announcing that the DPDP Act has “come into force”. For an ordinary manufacturer, retailer, NBFC or real estate developer, nothing new becomes enforceable on 13 November 2026. The Consent Manager tranche concerns a narrow class of registered intermediaries. Read it as a reminder that the runway is half spent, not as the finish line.
The old law has not gone anywhere yet
Many companies assume that once the DPDP Act was notified, the 2011 framework fell away. It did not. Section 44(2) of the DPDP Act, which omits Section 43A of the Information Technology Act, sits in the eighteen-month tranche. Sub-sections (1) and (3) of Section 44 commenced in November 2025. Sub-section (2) waits for 13 May 2027.
So today, a body corporate that holds sensitive personal data such as passwords, financial information, health records or biometrics still has to follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. That means a published privacy policy, written consent for sensitive data and documented security practices. A person who suffers wrongful loss because a company was negligent in keeping such data secure can still claim compensation under Section 43A.
There is a shift in exposure that boards should understand. Section 43A compensates the person harmed, so the liability is measured by the loss. The DPDP Act penalises the company, and the penalty is measured by the Schedule to the Act, which runs into hundreds of crores. Moving from one to the other is not a reduction in risk. It changes who comes after you, and how much they can ask for.
What 13 May 2027 actually demands
The Act is short. The Rules are where the work lives, and most of them describe things a business has to build rather than documents it has to sign.
A notice people can actually read
Rule 3 requires a notice that stands on its own, separate from any other information, written in clear and plain language. It must list the personal data being collected, the specific purpose for each item, and the goods, services or uses that processing enables. It must also give a working link to withdraw consent and a route to complain to the Data Protection Board. A twelve-page privacy policy buried in a website footer does not meet this standard. Withdrawal has to be as easy as giving consent in the first place.
Consent is not the only door
Section 7 of the Act allows processing without consent for certain legitimate uses, including employment purposes, compliance with law and medical emergencies. Many businesses overbuild consent flows for data they could lawfully process without them, and then find that every withdrawal breaks a payroll or attendance system. Mapping which processing rests on consent and which rests on a legitimate use is the single decision that shapes everything downstream.
Security you can prove
Rule 6 sets the floor for reasonable security safeguards. It names encryption, obfuscation or masking, access controls, monitoring logs, backups and contractual terms with every Data Processor. Logs and the related data must be kept for at least one year. The word that matters is prove. After a breach the question will not be whether you had a policy, but whether your logs show the safeguard was working on the day.
Breach reporting on two clocks
Rule 7 runs two tracks. Each affected individual must be told without delay, in plain terms, what happened and what they can do. The Board must be told without delay as well, followed by a detailed report within 72 hours, unless the Board allows more time on a written request. CERT-In’s 2022 directions separately require cyber incidents to be reported within six hours. The same incident will therefore go to two authorities, in different formats, on different clocks. Rehearse that once before it happens for real.
Retention and erasure
Section 8(7) requires erasure once the purpose is served or consent is withdrawn, unless another law requires the data to be kept. Rule 8 and the Third Schedule add a fixed clock for large platforms. E-commerce entities and social media intermediaries with two crore or more registered users in India, and online gaming intermediaries with fifty lakh or more, must erase data after three years from the user’s last contact or the commencement of the Rules, whichever is later, with 48 hours’ notice to the user first. At the same time Rule 8(3) requires every Data Fiduciary to retain personal data, traffic data and processing logs for at least one year. Retention schedules written for RBI, SEBI, GST and the Companies Act must now be reconciled with both rules.
Children’s data
Rule 10 requires verifiable consent of a parent or lawful guardian before processing the data of anyone under eighteen. Edtech platforms, gaming apps, coaching businesses and retail loyalty programmes collect such data without thinking of it as children’s data. The Fourth Schedule exempts certain classes, such as clinical establishments and educational institutions, but only for the specified purposes. Everyone else has to ask the age question and check the answer.
Rights and grievances
Individuals gain rights to access information, to correction and erasure, and to nominate someone to act for them. Under Rule 14 a business must publish how these rights can be exercised and must resolve grievances within 90 days. An individual must use your grievance channel before approaching the Board, which makes that channel your first line of defence. A mailbox nobody reads will not do.
Will the deadline move? Plan as if it might
On 22 January 2026 MeitY met industry and floated a shorter runway. The proposal, as reported, would cut the 18-month window to 12 months, bring some provisions into force at once, and give Significant Data Fiduciaries until November 2026 for their additional duties. Industry pushed back, and the Business Software Alliance wrote to the Ministry on 4 February 2026 warning that compressed timelines would increase security exposure rather than reduce it.
As of the date of this note, no amendment to Rule 1 has appeared in the Gazette. A deadline set by a notified rule can only move by another notified rule. Until that happens, 13 May 2027 is the operative date for ordinary Data Fiduciaries.
That is the legal position. The commercial one is different. If your business processes personal data at a volume or sensitivity that could attract designation as a Significant Data Fiduciary under Section 10, the sensible assumption is that your date may come earlier. Section 10(2) requires such an entity to appoint a Data Protection Officer based in India and an independent data auditor. Rule 13 then adds an annual Data Protection Impact Assessment and audit, and diligence on algorithmic software. None of that can be done in a quarter.
The penalties, and the mistakes that attract them
The Schedule to the Act caps penalties by the kind of failure, not by turnover. Up to Rs 250 crore for failing to take reasonable security safeguards. Up to Rs 200 crore each for failing to report a breach and for breaching the duties around children’s data. Up to Rs 150 crore for a Significant Data Fiduciary that misses its additional duties. Up to Rs 50 crore for any other breach of the Act or Rules. Section 33 tells the Board to weigh the nature, gravity and duration of the breach and what the company did to mitigate it. An appeal lies to the Telecom Disputes Settlement and Appellate Tribunal.
The businesses most at risk are rarely the ones ignoring the law. They are the ones solving the wrong problem. Four patterns come up again and again.
The first is treating DPDP as an IT project. Software can capture consent, but it cannot decide the lawful basis for each purpose, rewrite vendor contracts or train a branch manager not to share a customer list on WhatsApp.
The second is forgetting employee data. HR records, attendance biometrics, CCTV footage and medical reimbursements are personal data. Most of it can rest on the employment legitimate use under Section 7, but only if someone has mapped it and limited it to that purpose.
The third is the vendor chain. The Data Fiduciary stays responsible for what its processors do. Payroll agencies, call centres, cloud providers, courier partners and marketing agencies all need contracts that pass down the Rule 6 safeguards and the breach reporting clock. Most existing contracts say nothing of the kind.
The fourth is the retention conflict. Teams told to delete data and teams told to keep it for eight years are often reading different laws. Without a single retention schedule that reconciles them, the business will breach one law while complying with another.
A sensible order of work for the next six months
Start with a data map. Know what personal data the business collects, from whom, for what purpose, where it sits and who outside the company touches it. Every later step depends on it, and in a mid-sized company it usually takes six to ten weeks, because the answers sit with people who have never been asked.
Then fix the lawful basis for each purpose, and only then draft notices and consent flows. Rewrite processor contracts in parallel, because counterparties take time to sign. Build the breach playbook next and run one mock incident against it. Settle the retention schedule after that, once legal, finance and IT agree on what the other laws require. Rights handling and the grievance channel come last in sequence, though they should be live and tested well before May.
A company that begins this in November 2026 can finish comfortably. One that begins in March 2027 will be signing contracts and fixing systems in the same week the Board gains its powers. The law gave eighteen months for a reason. More than half of them are already gone.
Frequently asked questions
When does the DPDP Act apply to my business?
The operational duties under the DPDP Act and Rules apply from 13 May 2027. That is when notice, consent, security, breach reporting, retention, children’s data and rights handling all come into force together.
Is 13 November 2026 a DPDP compliance deadline?
Only for entities that want to operate as registered Consent Managers under Rule 4. For other businesses nothing new becomes enforceable on that date.
Has the DPDP deadline been shortened to 12 months?
MeitY proposed a shorter timeline in January 2026, but as of 24 October 2026 no amendment to Rule 1 of the DPDP Rules has been published in the Gazette. The notified date of 13 May 2027 stands until it is changed by notification.
Do the SPDI Rules 2011 still apply?
Yes. Section 43A of the IT Act and the SPDI Rules continue until Section 44(2) of the DPDP Act commences on 13 May 2027.
How quickly must a data breach be reported under the DPDP Rules?
Affected individuals and the Data Protection Board must be told without delay. A detailed report must reach the Board within 72 hours, unless the Board allows more time. CERT-In’s six-hour reporting requirement for cyber incidents applies separately.
What is the maximum penalty under the DPDP Act?
Up to Rs 250 crore for failing to take reasonable security safeguards to prevent a personal data breach.
Does the DPDP Act cover employee data?
Yes. Employee data is personal data. Much of it can be processed for employment purposes without consent under Section 7, but the security, retention and breach duties still apply.
This note is general information on the law as it stood on 24 October 2026 and is not legal advice on any specific facts. For questions on this note, write to the author at simar@emergelegal.in.
