How the DPDP Rules Phase In: Consent Managers in November 2026, Core Duties in May 2027

The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025. They set out how the Digital Personal Data Protection Act will operate in practice. Draft rules had been released on 3 January 2025, and the final text followed roughly ten months later.

The rules do not apply in a single step. Some provisions took effect on the day of notification, a consent-manager framework follows after one year, and the main duties on companies that process personal data follow after 18 months. For organisations, these dates determine when new obligations begin. Each stage is tied to specific rule numbers.

Who the Rules Cover, and the Board's Early Start

The rules use several defined terms. Data fiduciaries are the entities that decide why and how personal data is processed. Significant data fiduciaries are a designated group with additional duties, and consent managers are intermediaries that register with the Board under Rule 4.

Rules 1 and 2, which cover the short title and definitions, took effect on 13 November 2025, together with Rules 17 to 21. Rules 17 to 21 cover the Data Protection Board's governance structure and appellate procedures, which set out how decisions of the Board can be challenged, according to a DComply rules summary.

A compliance guide on the same timeline says the Act now overrides conflicting laws, and that civil courts are barred from hearing cases under it. The Board's rules take effect before most of the duties on companies.

Consent Managers Register From November 2026

Rule 4 sets up registration for consent managers. These are intermediaries that let an individual give, manage, review and withdraw consent for the use of their personal data. Section 2(g) of the Act describes the role as a single point of contact for the individual, according to a legal commentary on Mondaq. Network Intelligence calls the framework a licensed intermediary system for managing consent across organisations.

An applicant must be a company incorporated in India, with a minimum net worth of ₹2 crore and sound financial condition. It must also have adequate capital structure, earning prospects and anticipated business volume. Directors and key management personnel must have a general reputation and record of fairness and integrity. The applicant must also obtain independent certification that its interoperable platform meets the data protection standards and assurance framework the Board publishes.

DComply's rules summary says the Rule 4 phase allows organisations to file registrations, and gives 14 November 2026 as the start date. Bar & Bench and Mondaq give 13 November 2026, one year after notification, and Network Intelligence gives November 2026.

Core Duties Apply From May 2027

Rules 3, 5 to 16, 22 and 23 contain the substantive obligations. They cover notice and consent, the duties of data fiduciaries, security safeguards, breach notification, data retention, cross-border transfers and the rights of data principals. Under Rule 8(3), personal data must be retained for at least one year from processing, according to Bar & Bench, and cross-border transfers refer to sending it outside India. Network Intelligence describes this phase as the point at which the additional duties on significant data fiduciaries begin.

Under Rule 12, the obligations of significant data fiduciaries include appointing a data protection officer resident in India and undergoing annual audits, according to the DComply summary.

Breach notification procedures are set out in Rule 7, and the rights of data principals are in Rule 14, according to the DComply summary. Both fall within the group that applies from May 2027. Rules 22 and 23 sit in the same group, so the whole group applies from that date.

Bar & Bench, Mondaq and Network Intelligence give 13 May 2027 as the date these duties apply, 18 months after notification. DComply's summary gives 14 May 2027.

The Board's rules take effect before most of the duties on companies.

A Proposal to Bring the Main Deadline Forward

MeitY has discussed shortening the 18-month period. A February 2026 legal report from Chambers says the ministry held stakeholder discussions on 23 January 2026 and asked industry for feedback by 4 February 2026.

That report says the 18-month compliance period would fall to 12 months, ending on 13 November 2026, and gives the same 6-month cut for significant data fiduciaries. It lists the notification of significant data fiduciaries under Section 10(1) among the provisions affected. Cross-border transfer restrictions under Rules 13(4) and 15 would apply immediately, data retention under Rule 8(3) within 90 days, and the Central Government's exemption powers under Section 17(2) immediately. Taken together, the listed items form a set of changes the ministry is seeking feedback on, according to the report.

According to Chambers, Ashwini Vaishnaw indicated on 17 November 2025 that the government intended to shorten enforcement timelines for large businesses. A DComply rules summary describes the proposal differently, as moving all substantive rules to 13 November 2026 if it is notified. The two accounts differ on scope.

According to DComply, the proposal has not been notified, so the dates set out above remain those in the notified rules.

The Timeline in Sequence

From 13 November 2025, Rules 17 to 21 on the Data Protection Board apply, with Rules 1 and 2 in force. From 13 November 2026, consent managers can register under Rule 4. From 13 May 2027, the core duties apply, along with the additional duties on significant data fiduciaries.

The two later dates appear as 13 in most sources and 14 in one rules summary.

Taken together, the schedule gives about a year from the Board's rules taking effect until the consent-manager phase opens, and about six months more until the core duties apply.

For individuals, the May 2027 phase includes the rights of data principals, according to the DComply summary.