India’s DPDP Act: the countdown to May 2027

On 13 November 2026, India’s personal data law will reach its second step: companies that want to become “consent managers” will be able to apply for registration (India · MeitY, Rule 4). Six months later, on 13 May 2027, most of the Digital Personal Data Protection Act 2023 (DPDP) will apply: notices, security, breach reporting, individual rights. The maximum fine is 250 crore rupees, or 2.5 billion rupees, for failing to maintain reasonable security safeguards.

The timetable is set in the Official Gazette. The regulator, however, exists only on paper: as far as we know, as of 29 October 2026, no chairperson and no member of the Data Protection Board had been appointed. For a business, May 2027 has to be prepared now, regulator or not.

What is already settled

• The Act (India · Parliament): the DPDP Act was enacted on 11 August 2023. It covers digital personal data, including processing carried out outside India to offer goods or services to people in India.
• The implementing Rules (India · MeitY): published in the Official Gazette on 13 November 2025 (G.S.R. 846(E)), after 6,915 consultation inputs. They take effect in three stages: immediately for the Board, after one year for consent managers, after eighteen months for everything else.
• The Data Protection Board (India · MeitY): established on 13 November 2025 as a fully digital body, with appeals to the TDSAT appellate tribunal. Nominations were sought in May and June 2026. On 12 August, asked in Parliament about the appointments, the ministry merely referred to the recruitment notice published on 6 June (India · Lok Sabha); no appointment has been published since, as far as we know.
• Fine ceilings (India · Parliament, Schedule to the Act): 250 crore rupees for a security failure, 200 crore for an unreported breach or a breach of children’s data obligations, 150 crore for the additional duties of the largest companies, 50 crore for other violations.
• Breach reporting (India · MeitY, Rule 7): notice to the Board without delay, then a detailed report within 72 hours; each affected person must be informed in plain language.
• A drafting fix (India · MeitY): a “removal of difficulties” order dated 5 October 2026 and published in the Official Gazette on 7 October corrects two phrases in the Act, including the “data audit” required of the largest companies (India · India Briefing).

What is still pending

• 13 November 2026 (India · MeitY, Rule 4): consent manager registration opens, limited to Indian companies with a net worth of at least 2 crore rupees. Who will process the applications remains unclear.
• 13 May 2027 (India · MeitY): Rules 3, 5 to 16, 22 and 23 apply: notices, security, breaches, retention, children, individual rights, large companies, transfers.
• A possibly shorter timetable (India · MeitY): in January 2026 the ministry consulted industry on cutting the runway from 18 to 12 months, at least for the largest companies, which would have brought the deadline forward to 13 November 2026 (India · S.S. Rana & Co.). As of 29 October 2026, no amendment had been published, as far as we know.
• Significant data fiduciaries (India · MeitY): as far as we know, no company has been designated yet.
• Transfers (India · MeitY, Section 16 and Rule 15): as far as we know, no list of restricted countries and no ministerial requirement has been published.
• Litigation (India · Supreme Court): petitioned by the Digital News Publishers Association (DNPA), which challenges several sections of the Act and the Rules, the Court issued notice on 27 October 2026 without staying the law; the hearing is scheduled for 17 November 2026 (India · LiveLaw).

The real issue: proving, not just informing

The DPDP Act is not an Indian GDPR (EU). It rests on consent and on a short list of “legitimate uses”, with no general legitimate interest basis. Above all, the Rules demand evidence. Each notice must itemise the data collected and the purpose, and withdrawing consent must be as easy as giving it.

Every processing operation will have to leave logs kept for at least a year, including when it is carried out by a processor (Rule 8). Large e-commerce, gaming and social media platforms will also have to erase data after three years of inactivity, warning the person 48 hours beforehand.

For the most exposed companies, designated “significant data fiduciaries”, there is an additional impact assessment and audit every twelve months, with a report to the Board, and due diligence on the algorithms used to process data (Rule 13).

Three points to watch

1. A regulator without doctrine. Until the Board has members, it issues neither guidance nor decisions. The first cases will set the bar, probably after May 2027. Until then, preparation can only rely on the text.

2. Localisation by ministerial decision. The Act allows transfers outside India, except to countries the government places on a list (Section 16), and stricter sectoral laws continue to apply. For the largest companies, a committee may designate data that must not leave the country, traffic data included (Rule 13).

3. A date that could move. The 12-month proposal has not been published, but the ministry can still amend the Rules and bring forward some of the largest companies’ obligations. The Supreme Court challenge could also disrupt the timetable. Planning for May 2027 without a shorter scenario would be unwise.

What a business exposed to India must do before May 2027

1. Map processing of data about people in India, including processing carried out in Europe for Indian customers.
2. Rewrite consent notices: itemised data, precise purpose, withdrawal link and route to complain to the Board.
3. Set up the 72-hour breach chain, with a report template that follows the headings of Rule 7.
4. Configure retention: logs kept for at least a year, automatic erasure for the platforms concerned.
5. Publish a contact point and a response process for access, correction and erasure requests, within a maximum of 90 days.
6. Assess the risk of designation as a significant data fiduciary and prepare a data protection officer based in India, an independent auditor and an annual impact assessment.
7. Add a localisation clause to contracts that can be triggered if a transfer restriction is published.

In India, the date is written and the regulator is not yet: prepare for the date.

The question to ask on Monday morning

To your data protection officer and your India lead: “If the Board asked us on 14 May 2027 for proof of a consent, a log or a 72-hour breach report, what could we show?”