DPDP Compliance Deadline: What Starts on 13 November 2026, and a Six-Month Plan to May 2027

On 13 November 2026, the Digital Personal Data Protection Rules, 2025 complete their first year. That anniversary is also a DPDP compliance deadline, though a narrow one: only one rule switches on this week. The bigger date, 13 May 2027, is now six months away. For Indian SMEs and startups, the useful question is simple. What actually changes on Friday, what doesn't, and what should your team be doing between now and May?

What starts on 13 November 2026

The Rules were notified on 13 November 2025 with a phased start. Some provisions, including those setting up the Data Protection Board of India, took effect immediately. One more piece arrives now: Rule 4, which governs the registration of Consent Managers.

A Consent Manager is a registered platform that lets individuals give, manage, review and withdraw consent across many businesses from a single place. Under the First Schedule to the Rules, an applicant must be a company incorporated in India, have a net worth of at least ₹2 crore, and run a consent platform that has been independently certified. There are further conditions on its directors, its management, and on the obligations it must lock into its own constitutional documents.

For most SMEs, this changes nothing you must do on Friday. You are not required to sign up with a Consent Manager. What it does mean is that, over time, some of your customers may arrive with consent managed through one of these platforms, and your systems will need to recognise and honour a withdrawal that comes in that way. Treat it as a design input for the consent flows you are building anyway.

What does not start yet

Almost everything else. The core obligations of the DPDP Act, 2023 come into force on 13 May 2027. That includes:

• Notice and consent requirements (Sections 5 and 6, with Rule 3 on notice content)
• Security safeguards under Rule 6
• Breach notification under Rule 7, including the detailed report to the Board within 72 hours
• Data principal rights: access, correction, erasure, grievance redressal and nomination
• Additional duties for Significant Data Fiduciaries
• The penalty schedule, which runs up to ₹250 crore per instance for security failures and up to ₹200 crore for failing to notify a breach

Since the Rules took effect, there has been talk of shortening this window. In January 2026, Business Standard reported that MeitY was considering cutting the 18-month period to 12 months for certain provisions, mainly those affecting Significant Data Fiduciaries. As of mid-October, trackers such as dpdprules.org had found no notified instrument changing the dates. So, for now, May 2027 stands. Do watch for a gazette notification, though. If one appears, it would most likely hit larger platforms first.

The Data Protection Board of India: still waiting

Here is the awkward part. The Board was established in law on 13 November 2025, and the Rules name it as the body that registers Consent Managers. But public reporting through the start of November, including LiveLaw and indiadatalaw.org, indicates that no Chairperson or Member has yet been appointed. MeitY advertised the posts (one Chairperson and four Members) in June 2026.

Courts have started to press the point. In a public interest petition about passenger data on Digi Yatra, a Kerala High Court Division Bench led by Chief Justice Soumen Sen said in early October that it expected the Board to be made functional within eight weeks. That window closes around the start of December. Separately, on 27 October 2026, the Supreme Court issued notice on a petition by the Digital News Publishers Association challenging several provisions of the Act and Rules, including the absence of a journalism exemption and the way the Board is constituted. No stay was granted, and the matter is listed for 17 November.

What does this mean for an SME? Two things. First, a Board without members cannot hear complaints or pass orders today, so enforcement is not imminent. Second, neither the court cases nor the vacancies have paused the May 2027 date. Appointments could come quickly once the government moves, and the Board will inherit an Act whose obligations are already fixed. We covered the Board's status in more detail last month.

A six-month DPDP compliance deadline plan for SMEs

Six months is enough time if you start now and keep the scope honest. Here is a sequence we use with smaller clients.

November: map your data. List every place personal data enters the business: website forms, apps, WhatsApp, payroll, CRM, support desk, vendors. Note what you collect, why, where it sits and who can see it. A spreadsheet is fine.

December: fix notices and consent. Rewrite your privacy notice in plain language, item by item, as Rule 3 requires. Check that consent is separate from your terms of service and that withdrawing it is as easy as giving it. If you plan to accept consent through registered Consent Managers later, design for that now.

January: vendors and contracts. Every processor that touches personal data on your behalf needs a written contract covering security, breach reporting and deletion. Start with payment, cloud, marketing and HR tools.

February: security and breach drills. Document your reasonable security safeguards: encryption, access controls, logs kept for at least a year. Then run a tabletop exercise. Can your team tell affected users without delay and send a detailed report to the Board within 72 hours?

March: rights and retention. Build a simple process to handle access, correction, erasure and nomination requests, with a named grievance contact. Set retention periods and a deletion routine for data you no longer need.

April: test and document. Walk through the whole thing with fresh eyes. If you might be notified as a Significant Data Fiduciary, plan for a Data Protection Officer, a privacy impact assessment and periodic audits.

The short version

This week's anniversary is quiet for most businesses. Rule 4 opens the door for Consent Managers, the Board is still waiting for its members, and two court cases are moving. None of that shifts the date that matters: 13 May 2027. Teams that use the next six months to map data, fix consent and rehearse a breach will be ready whenever the Board starts work. Teams that wait for enforcement news will be doing it all in a hurry.

For a fuller picture of the obligations, see our DPDP Act compliance guide.

This article is general guidance based on public information as of 10 November 2026, not legal advice. For decisions about your business, speak to a qualified professional. Want a head start? Work through our free DPDP readiness checklist, or get in touch to plan your six months with us.