Rule 1(2) of the DPDP Rules 2025 sets a three-phase commencement. The three dates are the most important thing in the entire regime. If you remember nothing else from this course, remember these three.
Reading the calendar as a strategic planning tool
The three phases are not just regulatory dates; they are strategic planning anchors for the entire compliance programme. Phase 1 gave you awareness and framework confirmation. Phase 2 gives you the CM ecosystem readiness. Phase 3 is when penalty exposure begins. Practitioner reading: align your programme cadence to the phases — awareness and framework decisions in Phase 1 window, ecosystem integration in Phase 2 window, live operations in Phase 3.
Phase 1. 13 November 2025. Machinery on.
On the date of publication in the Official Gazette, Rules 1, 2 and 17 to 21 came into force [L2-C1]. These are the "machinery" Rules. Rule 1 titles the instrument and sets the phasing. Rule 2 gives definitions. Rules 17 to 21 constitute the Data Protection Board of India: Search-cum-Selection Committees for appointments, service conditions, the digital office, meeting procedure, officers and employees.
What this means in practice: from 13 November 2025 the Board can, in principle, function. Nobody has to comply with anything substantive yet. The regulator is warming up while the industry gets ready.
Phase 2. 13 November 2026. Consent Managers open.
One year from publication, Rule 4 comes into force [L2-C2]. Rule 4 opens the registration window for Consent Managers. Any Indian company that meets the First Schedule Part A conditions (audited net worth ≥ ₹2 crore, technical/operational/financial capability, no conflict of interest with Data Fiduciaries) can apply to the Board for registration. Once registered, the CM operates the consent architecture set out in Section 6(7)-(9) read with Part B of the First Schedule (data-blind pipe, ≥7-year consent-log retention, interoperability standards).
Why Rule 4 has its own phase: the CM ecosystem is India-original. There is no GDPR equivalent. MeitY needed a year of policy design and a Code-for-Consent prototype challenge before the door could open. Six firms were shortlisted from that challenge in mid-2025: Jio Platforms, Baldor Technologies (IDfy), VertexTech Labs (Redacto), Zoop (Quagga Tech), Concur, and Aurelion Future Forge. From 13 November 2026 they can start applying. Practitioners advising a Consent Manager applicant should have audited financials, ISO 27001-class controls and a board-approved conflict-of-interest policy ready by Q3 2026.
Phase 3. 13 May 2027. Substantive obligations bite.
Eighteen months from publication, Rules 3 and 5 to 16 and 22 and 23 come into force [L2-C3]. This is where the DPO's job actually starts.
Rules commencing on 13 May 2027:
- Rule 3 — Notice by Data Fiduciary to Data Principal (Section 5)
- Rule 5 — Processing for State subsidy/benefit/service/licence (Section 7(b))
- Rule 6 — Reasonable security safeguards (Section 8(5))
- Rule 7 — Personal data breach intimation (Section 8(6))
- Rule 8 — Erasure trigger and Third Schedule retention (Section 8(7))
- Rule 9 — Contact information (Section 5(1)(a) / Section 8(9))
- Rule 10 — Verifiable consent for children (Section 9(1))
- Rule 11 — Verifiable consent for persons with disabilities (Section 9(1) proviso)
- Rule 12 — Fourth Schedule exemptions from Section 9(1)/(3)
- Rule 13 — Additional obligations of Significant Data Fiduciary (Section 10)
- Rule 14 — Rights of Data Principals and 90-day cap (Sections 11-14)
- Rule 15 — Cross-border transfer restrictions (Section 16(1))
- Rule 16 — Research/archiving/statistical exemption (Section 17(2)(b))
- Rule 22 — Central Government information calls under Section 36 (Seventh Schedule)
- Rule 23 — Confidentiality of Section 36 calls
Reading the calendar as a project plan
Every substantive obligation you owe under Chapter II of the Act (notice, consent, security, breach, erasure, children, SDF) crystallises on 13 May 2027. Everything you build before then is preparation, not compliance. Everything you build after that is remediation, not preparation. This is why the countdown matters.
A workable programme calendar for an average mid-large Fiduciary starting in August 2026 looks like this:
- Aug 2026 to Nov 2026 (T + 3 months). Data discovery. Draft RoPA. Baseline current notice + consent flows. Identify gaps.
- Nov 2026 to Feb 2027 (T + 6 months). Draft Rule 3-compliant notice. Design consent flows. Pick a Consent Manager (Rule 4 window now open). Begin vendor DPA renegotiations.
- Feb 2027 to May 2027 (T + 9 months). Retention regime rebuild under Rule 8 + Third Schedule. Rights request workflows. Grievance mechanism launch. Rule 7 breach runbook rehearsals.
- Post 13 May 2027. Live operations. Rule 13 SDF programme if designated. First DPB inquiries expected to begin.
What can move earlier
Two things are worth watching for acceleration.
First, MeitY consulted in January 2026 on whether to shorten the 18-month timeline to 12 months [L2-C4]. As of August 2026 no acceleration has been notified, but this is on the manual-verification checklist for anyone acting on the calendar. Second, sectoral overlays are already in force ahead of DPDP substantive commencement: RBI DGF Draft (July 2026), IRDAI Cyber Guidelines (April 2026), SEBI CSCRF (August 2024) and Telecom Cyber Security Rules (November 2024). BFSI, insurance and telecom entities are effectively operating to DPDP-style obligations already, via their sectoral regulators.
The three dates to memorise
13 November 2025. Machinery on. DPB constituted. Rules published. Nothing substantive yet.
13 November 2026. Consent Manager registration opens under Rule 4.
13 May 2027. Substantive obligations bite. Rules 3, 5-16, 22, 23 in force.
The 90-day accelerated-readiness track
For a Data Fiduciary starting compliance implementation in Q4 2026 or later, a 90-day accelerated track: Days 1-30 data-discovery and RoPA baseline (which processing activities exist, what personal data flows where, retention exposure per category); Days 30-60 notice-and-consent architecture design plus vendor DPA renegotiation initiation; Days 60-90 breach-runbook build plus rights-request workflow plus grievance-mechanism launch. This compresses the 21-month plan into an intense quarter but the compression risks under-delivered quality. Prefer the 21-month plan; use the 90-day track only where circumstance forces compression.
The dependency chain across phases
Phase 2 (13 November 2026 Consent Manager opens) unlocks the CM ecosystem, but Fiduciaries need not immediately engage a CM. Practical timeline: Phase 2 lets CMs register; Phase 3 (13 May 2027) requires Fiduciaries to comply with substantive obligations that may or may not require CM engagement depending on the processing pattern. Practitioner reading: understand where your processing activities benefit from CM engagement (typically for consent-based B2C processing at scale) and where standalone consent management suffices (typically for B2B processing and legitimate-uses processing).
Sectoral acceleration
Some sectors are effectively operating under DPDP-like obligations already through sectoral rules: SEBI CSCRF (August 2024), RBI cyber framework, IRDAI Cyber Security Guidelines (April 2023), Telecom Cyber Security Rules (November 2024). Practitioner reading: for entities in these sectors, DPDP implementation feels like an extension of existing sectoral compliance rather than a fresh build; leverage existing sectoral controls where they align with DPDP requirements. For entities outside these sectors (retail, e-commerce, IT services), DPDP is the primary compliance driver.
Watching for acceleration or deceleration
MeitY's January 2026 consultation on shortening the 18-month timeline to 12 months has not resulted in acceleration as of September 2026. Similarly no deceleration signals have been issued. Practitioner monitoring: watch MeitY press releases and Gazette Notifications monthly for any timeline changes; a 3-month acceleration would push commencement to February 2027, compressing the implementation window materially.