13 November 2026 Under the DPDP Act: What Actually Starts, and What Doesn't

On 13 November 2026 it will be one year since the DPDP Rules 2025 were notified. Expect headlines saying the DPDP Act "comes into force" or that a "compliance deadline" has arrived. For almost every business, neither is true.

What the Gazette actually says

The DPDP Rules 2025 (G.S.R. 846(E), published 13 November 2025) set their own start dates in Rule 1. The words are short enough to quote in full:

A separate notification of the same date (G.S.R. 843(E)) brought the Act into force in the same three steps. At the one-year mark it commences only section 6(9), which lets Consent Managers register with the Board, and section 27(1)(d), the Board's power to act on complaints about them. Sections 3 to 17, which hold every duty a business owes, commence at eighteen months.

What a Consent Manager is, and who can be one

A Consent Manager is a platform registered with the Board through which a person can give, manage, review and withdraw consent across many businesses from one place. It is a new kind of regulated company, not a feature every business must buy.

Part A of the First Schedule sets the bar for registration. Among other conditions, the applicant must be:

• •a company incorporated in India;
• •worth at least ₹2 crore in net worth;
• •independently certified that its consent platform meets the data protection standards the Board publishes;
• •run by directors and management with a record of fairness and integrity, with articles of association that lock in key obligations.

Most startups and SMEs will never apply, and do not need to. You will work with Consent Managers as a Data Fiduciary if your users choose one, but that interoperability matters once the core duties start in May 2027.

The catch: who registers them?

Rule 4(1) says an applicant "may apply to the Board for registration". The Data Protection Board was established in law on 13 November 2025, but it needs a Chairperson and Members to act. MeitY invited applications for those posts on 6 May 2026 (MeitY circular). As of 1 August 2026, the Board had no appointed Chairperson and no appointed Members.

Some websites report that appointments were made in June 2026. We have not found a Gazette notification or MeitY press release that confirms it, and the August reporting contradicts it. Until appointments are notified, Rule 4 is in force on paper, but there is no one to decide an application.

What does not start on 13 November 2026

• •Notice and consent [Rule 3, ss.5 and 6]. Build it with the free consent notice generator.
• •Reasonable security safeguards [Rule 6, s.8(5)].
• •Breach reporting to the Board and affected people [Rule 7, s.8(6)]. See the breach reporting timeline.
• •Erasure once the purpose is served [Rule 8, s.8(7)].
• •A published contact person [Rule 9, s.8(9)].
• •Children's data and verifiable parental consent [Rules 10 to 12, s.9].
• •Significant Data Fiduciary duties [Rule 13, s.10]. None have been notified.
• •Rights to access, correction, erasure, nomination and grievance redressal [Rule 14, ss.11 to 14].
• •Penalties. The penalty provisions, sections 33 and 34 with the Schedule, commence on 13 May 2027. Some general sections, 35, 38 to 43, 44(1) and 44(3), such as the power to make rules, are already in force.

Could the dates move earlier?

At a stakeholder meeting on 22 January 2026, MeitY proposed shortening the 18-month runway to 12 months, which would bring the date forward to 13 November 2026. Reports differ on whether the proposal covered all Data Fiduciaries or only Significant Data Fiduciaries (Chambers summary). A proposal is not law. Changing the date needs an amendment to Rule 1 published in the Gazette, and as of the date of this article no such amendment has been published.

Plan to 13 May 2027, and keep a version of your plan that works on a shorter runway. If an amendment is notified, we will update this page the same day.

What already applies today

• •The CERT-In Directions of 2022 require cyber incidents, including data breaches and leaks, to be reported to CERT-In within 6 hours. This is where the often-quoted 6-hour figure comes from; it is not a DPDP rule.
• •Section 43A of the IT Act and the SPDI Rules 2011 still govern sensitive personal data until section 44(2) of the DPDP Act repeals section 43A on 13 May 2027.
• •Your customers' contracts. Enterprise buyers, investors and cyber insurers are already asking about DPDP readiness in questionnaires and due diligence, whatever the commencement date.

What to do with the next seven months

Seven months is about the time it takes to do this properly. In order:

1. 1.Confirm the Act applies to you and in what role, with the free applicability checker.
2. 2.Find the personal data you hold and where it sits: databases, drives, spreadsheets and SaaS tools. Every other duty depends on this. See how many Data Principals do you have.
3. 3.Write a Rule 3 notice for each place you collect data, and record each consent against it.
4. 4.Set up a route for access, correction and erasure requests, and a grievance process with a published response period of no more than 90 days.
5. 5.Rehearse a breach: who decides, who tells CERT-In within 6 hours, who drafts the 72-hour report to the Board.
6. 6.Update vendor contracts so every processor is bound to the same standard. See vendor management under DPDP.

Not sure where your website stands? The free DPDP compliance scanner checks it against the notice and consent rules in under a minute.

Three claims to be careful with

• •"The DPDP Act is in force from November 2026." Only the Consent Manager provisions are. The duties on businesses start on 13 May 2027.
• •"Penalties of up to ₹250 crore start in November 2026." The penalty provisions commence on 13 May 2027, and the Board that imposes them has not been staffed.
• •"DPDP requires breach reporting within 6 hours." The 6-hour clock is CERT-In's. DPDP Rule 7 asks for notice without delay and a detailed report to the Board within 72 hours.