DPDP Rules: Your Countdown to May 2027 Starts Now

The DPDP Rules, 2025 were notified on 13 November 2025. A few enabling provisions took effect immediately. The core obligations on data fiduciaries, covering notices, security safeguards, breach reporting, retention, children's data and duties of significant data fiduciaries, come into force 18 months after notification, which analysts place at around 13 May 2027.

Consent-manager registration is staged separately; most sources put it at one year after notification, though commentary differs, so check the gazette text for your exact dates.

Compliance here is mostly an engineering task. You will need clear, itemised notices at the point of collection; a record of every consent and its purpose; the ability to withdraw consent as easily as it was given; deletion when the purpose is served; and verifiable parental consent for children's data.

Breach readiness matters too: you should be able to tell which users were affected and when, which requires access logs you can actually query.

Start with a data map: what personal data you collect, where it lives, who can access it and why. Then add a consent ledger and retention jobs to your main systems, and test a mock breach end to end.

Teams that start in 2026 can spread the work across normal release cycles. Teams that start in April 2027 will be rewriting signup flows under pressure.