The long wait is over: the DPDP Rules, 2025 were notified on 13 November 2025, turning the DPDP Act from principle into operational obligation. The rollout is phased — which is both relief and risk, because 'later' is not 'never'. Here is the timeline and what to do now.
The key dates
- 13 November 2025 — Rules notified. The Data Protection Board is constituted and the definitional and administrative provisions take effect.
- 14 November 2026 — the Consent Manager framework comes into force (registration and obligations).
- 14 May 2027 — the end of the 18-month grace period, when the core obligations become enforceable: itemised notices and consent, reasonable security safeguards (Rule 6), breach notification, verifiable parental consent for children, and the SDF duties.
Why you should not wait for 2027
The heavy obligations — notices tied to a real data map, working consent capture, security safeguards, breach readiness — are the ones that take months to build, not weeks. Organisations that start in 2027 will be retrofitting under pressure; those that start now will be ready and calm.
A prioritised action plan
- Months 1–2: See the ground. Build your data map and run a gap assessment. Find out whether you are likely an SDF.
- Months 2–4: Fix the front door. Rewrite notices (English + Indian languages), implement consent and a cookie banner, and publish your grievance contact.
- Months 3–6: Lock the back door. Implement Rule 6 security safeguards, a breach-response plan, retention schedules and processor contracts.
- Months 4–8: Stand up governance. Appoint a DPO or contact, and (for SDFs) a DPIA and independent audit cycle.
- Ongoing: Keep it alive. Review the map, re-run DPIAs, test breach response, and keep records you can show the Board.
Start with the facts
Every plan above depends on knowing where you stand today. A short assessment gives you that baseline — your likely SDF status, your biggest gaps, and the order to fix them.
How DPDP Bridge helps
DPDP Bridge gives you lawyer-led, software-driven DPDP compliance — notices and consent, data-principal rights, breach response, vendor contracts and audit-ready records in one place. Take the free assessment to see exactly where your organisation stands and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.