India's DPDP Timeline: Critical Compliance Deadlines for 2026-27. Read the key points, why it matters and what businesses should watch next.
India's DPDP Rules Enter Enforcement Phase
The Digital Personal Data Protection (DPDP) framework is moving from preparation to active regulation. The DPDP Rules were notified on November 14, 2025, and the 2026-27 period is expected to see the transition from groundwork to enforcement and operational accountability. Businesses processing personal data in India will need to track several milestones.
Consent Manager Rollout Mid-2026
Between June and August 2026, the central government is expected to make the Consent Manager framework operational. This will let Data Principals use interoperable platforms to manage, review or withdraw consent across multiple digital services. Consumer-facing digital platforms in particular will need consent architectures and internal systems compatible with Consent Manager APIs and interoperability standards. For many organisations, this will mean substantial changes to consent collection, backend data management and user preference workflows.
End of Soft Enforcement
November 2026 will mark one year since the Rules were notified and is widely expected to close the initial "soft enforcement" phase. The Data Protection Board of India (DPBI) is then expected to shift from awareness-building and guidance towards active supervision and enforcement. Legacy data will be a key focus: personal data collected before the DPDP framework may need valid notice and consent consistent with the Act and Rules. Organisations unable to show lawful consent or valid processing grounds for historical datasets could face greater regulatory exposure.
Audits and Full Enforcement
Under Section 10 of the DPDP Act, Significant Data Fiduciaries (SDFs) face enhanced obligations, including mandatory independent data audits and Data Protection Impact Assessments. The first audit cycle is expected to become operational by early 2027. Entities processing large volumes of personal data, or running platforms with significant user reach, should prepare governance and …
Services related to this update
Want this handled for you?
Get a free expert consultation and an exact quote within 24 hours.
Get free quote
