The DPDP Act's Compliance Clock: What Is in Force Today, What Arrives in November 2026, and What Is Still to Come

By Bhaskar Subramanian, Advocate, S&S Co. Advocates & Solicitors

Published 24 October 2026 · Law stated as on 19 October 2026 · Informational content, not legal advice: see our disclaimer

The Digital Personal Data Protection Act, 2023 and the Rules notified under it in November 2025 did not switch India's data protection regime on all at once. They set a staggered three-tranche timetable running to May 2027, with the Data Protection Board itself already functioning and the next tranche, covering consent managers, due in a matter of weeks from the date of this article. This piece looks past the compliance checklist to the enforcement architecture and the actual clock businesses are working against.

A law brought into force in three tranches

The Digital Personal Data Protection Act received Presidential assent in August 2023, but very little of it actually took effect at that point. The bulk of the Act's substantive provisions needed implementing rules before they could be switched on, and those rules took more than two years to finalise after a draft was circulated for public comment in January 2025. The final Digital Personal Data Protection Rules, 2025 were notified in mid-November 2025, and the notification brought the Act and the Rules into force together, on a staggered schedule rather than in one step.

Three dates matter. The first tranche, effective on notification in mid-November 2025, brought the foundational architecture into force: the Data Protection Board's constitution and powers, the penalty framework, and the Central Government's rule-making authority. The second tranche, due roughly twelve months later in mid-November 2026, brings in the consent manager registration framework and certain provisions dealing with how consent is given and withdrawn in practice. The third and largest tranche, due eighteen months after the initial notification, in mid-May 2027, brings in the core compliance obligations that most of the commentary on this law actually discusses: notice and consent requirements for data fiduciaries generally, data principal rights, security safeguards, children's data provisions and breach reporting duties in their complete form.

This matters for timing rather than merely for interest. As this article is being written, the second tranche is only weeks away, which means any business that has treated the DPDP Act as a 2027 problem is working to the wrong deadline for at least part of its compliance programme. The Board, meanwhile, has been a live, functioning body since the first tranche took effect, which is the point the next section develops.

The Data Protection Board: what it is, and what it can already do

The Data Protection Board of India is a body corporate created under the Act, headed by a Chairperson and a Central Government-notified number of other Members, all appointed on the recommendation of a search-cum-selection committee reported to be headed by the Cabinet Secretary. Members are expected to bring expertise across data governance, dispute resolution, information and communication technology, the digital economy, law or consumer protection, with at least one member required to have legal expertise. Appointments run for a two-year term, with eligibility for reappointment.

The Board is not a general data protection regulator on the European model, with broad rule-making and policy functions of its own; rule-making sits with the Central Government. What the Board does have, and has had since the first tranche of commencement, is an adjudicatory function: it can inquire into a data breach or a complaint referred to it, accept a voluntary undertaking from a data fiduciary in appropriate cases, pass interim orders during an inquiry, and impose a monetary penalty at the end of that process where it finds a breach of the Act's provisions that are themselves already in force.

The practical consequence is that a business cannot assume it faces no live regulatory exposure simply because the 2027 tranche has not yet arrived. A serious security lapse resulting in a breach, for instance, engages obligations and penalty provisions that commenced with the first tranche. Businesses should treat the Board as a functioning adjudicator today, not as an institution whose authority is still theoretical, even while the fuller set of day-to-day compliance obligations is still being phased in around it.

How a penalty is actually calculated and appealed

The Act's Schedule sets out maximum penalty figures tied to specific categories of default, and the figures are higher than many businesses assume. A failure to take reasonable security safeguards to prevent a personal data breach can draw a penalty of up to 250 crore rupees. A failure to notify the Board or affected individuals of a breach, and a failure to meet the additional obligations owed in relation to a child's personal data, can each draw up to 200 crore rupees. Non-compliance by a significant data fiduciary with its enhanced obligations can draw up to 150 crore rupees, and a residual category covering any other breach of the Act or Rules caps out at 50 crore rupees.

These are ceilings, not fixed tariffs. The Board is required to have regard to a set of factors in fixing the actual amount in a given case, including the nature, gravity and duration of the breach, the type and sensitivity of personal data affected, whether the conduct was repeated, and whether the data fiduciary took any mitigating action. Reporting on the Act consistently describes penalties as assessed per instance of non-compliance rather than as a single annual cap for an organisation, which means a business with multiple, distinct failures across a year could face cumulative exposure well beyond any single Schedule figure.

An order of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal within sixty days of receipt, and a further appeal lies from the Tribunal to the Supreme Court of India. Choosing TDSAT as the appellate forum, rather than creating a dedicated data protection tribunal, means the body hearing these appeals already has institutional experience with regulated-sector adjudication, though it will need to develop a body of data protection jurisprudence essentially from scratch.

One structural point deserves emphasis for anyone weighing litigation strategy once an inquiry begins. The Act allows the Board to accept a voluntary undertaking from a data fiduciary facing an inquiry, including an undertaking to take specific remedial or corrective action, and to close the proceeding on that basis rather than proceeding to a full penalty order. For a business that detects and discloses its own failure promptly, cooperates with the inquiry and proposes credible remedial steps, a voluntary undertaking can be a materially better outcome than contesting the matter to a penalty order and an appeal, both in terms of cost and in terms of the public record the proceeding leaves behind.

The 12-month tranche is about more than consent managers

It is tempting to treat the second tranche as a single-issue event confined to the registration of consent managers, but the commencement schedule bundles in other mechanics around how consent is given, recorded and withdrawn. Businesses redesigning their consent flows for the third tranche's broader obligations should build that work around the assumption that withdrawal of consent needs to be at least as easy as giving it was in the first place, a principle the Act states directly and which regulators in other jurisdictions have treated as a frequent point of enforcement focus once their own laws matured past the early compliance phase.

A second, less obvious consequence of the staggered schedule is that a business's internal privacy documentation, its privacy notice, its consent capture language, its records of consent, needs to be versioned carefully across the transition. Consent captured before the third tranche's full notice and consent obligations take effect may need to be refreshed, or at least re-validated against the fuller standard, once that tranche arrives in May 2027, rather than assumed to carry over automatically simply because it was valid under whatever lighter standard applied when it was collected.

Consent managers: a new regulated intermediary arrives in November 2026

One of the more structurally significant ideas in the Act is the consent manager, a registered intermediary through which an individual can give, manage, review and withdraw consent across multiple data fiduciaries through a single interoperable interface, rather than negotiating separate consent flows with every business that holds their data. The concept borrows from India's existing account aggregator framework in financial services and extends it across the data economy generally.

The Rules set specific conditions for registration once this tranche takes effect: incorporation in India, a minimum net worth reported at two crore rupees, demonstrated technical, operational and financial capacity, and independent certification that the consent manager's platform is interoperable with the standards the Board publishes. Governance conditions are equally specific. A consent manager must operate without a conflict of interest between its directors and the data fiduciaries it serves, and it is barred from subcontracting or delegating its core responsibilities to a third party. Non-compliance with these conditions can lead to suspension or cancellation of registration.

For businesses, the near-term question is less about becoming a consent manager and more about how consent flows will change once registered consent managers exist in the market. A business that currently collects consent directly, through its own app or website, will likely need to accommodate consent routed through a consent manager a customer has chosen, which has implications for how consent records are stored, reconciled and proved in the event of a dispute or an inquiry. This is worth building into any consent architecture being redesigned now, rather than retrofitting it once consent managers are operating.

Children's data: the verifiable consent problem

The Act sets the threshold for who counts as a child at eighteen years, markedly higher than the thresholds used in several other jurisdictions, and it requires verifiable parental or guardian consent before a data fiduciary processes a child's personal data. For a person with a disability who has a lawful guardian, the consent must come from a guardian appointed by a court or other competent authority under the applicable Indian guardianship law, not merely from a family member acting informally. The Rules also impose a flat bar on tracking, behavioural monitoring and targeted advertising directed at children, regardless of whether consent has otherwise been obtained, which goes further than a pure consent-based model would require.

The Rules point to specific verification routes, including reliance on Digital Locker-based identity and age verification, as one way a fiduciary can discharge the obligation to verify that a consenting adult is indeed the child's parent or guardian. The Central Government also retains power to exempt specified classes of data fiduciaries, or specified purposes of processing, from some of these requirements by notification, which leaves room for sector-specific relaxation, for instance for educational institutions carrying out limited, clearly necessary processing of student data.

The practical difficulty, which the Rules do not fully resolve on their face, is verifying parenthood or guardianship reliably at the scale most consumer platforms operate, without itself collecting more sensitive identity data than the underlying service justifies. Businesses that serve a mixed adult and minor user base, education technology, gaming, and social platforms being the clearest examples, should treat age assurance and verifiable consent as a standalone project requiring its own risk assessment, rather than as a checkbox to be added to an existing consent flow.

Cross-border transfer: a blacklist, not a whitelist

India's approach to cross-border data transfer departs from the model many multinational businesses are used to under the General Data Protection Regulation, which permits transfer only to countries the European Union has found to offer an adequate level of protection, a whitelist. The Act instead permits transfer of personal data outside India by default, subject only to the Central Government's power to restrict transfer to specific countries or territories by notification, a blacklist model that places the burden on government to name where transfer is restricted rather than on business to prove a destination is approved.

As of the date of this article, no such restricted-country notification appears to have been issued, which means cross-border transfer of personal data is, as a general matter, not restricted by this provision for a business operating today. This is a materially lighter-touch starting position than the adequacy-based regimes many compliance teams default to when designing cross-border data flows, and businesses should be careful not to import GDPR-style transfer impact assessments wholesale into their Indian compliance programme without checking what the Act and Rules actually require.

One area that remains genuinely unsettled on the sources available is whether a separate, narrower approval requirement applies specifically to the cross-border transfer of what earlier draft commentary referred to as critical personal data, a category the government has power to define. This point was raised in commentary on the January 2025 draft rules, but this research could not confirm from the finalised Rules whether, or in what form, such a requirement survived into the version notified in November 2025. Businesses transferring data that might plausibly be classified as critical should seek specific, current advice rather than relying on draft-era commentary.

Breach reporting: what the clock actually requires

The Act requires a data fiduciary to notify the Board of a personal data breach, and the Rules build a two-step timeline around that duty as reported in current compliance commentary: an initial notification to the Board without delay once the fiduciary becomes aware of the breach, followed by a fuller report giving further particulars within a window reported at seventy-two hours, extendable by the Board where the fiduciary shows good cause. Affected data principals must separately be informed in clear and plain language, in a manner that describes the likely consequences of the breach, the steps the individual can take to protect themselves, and a contact point at the fiduciary for further information.

This two-stage design, an immediate alert followed by a more complete report, mirrors the structure seen in several other breach notification regimes internationally, though the precise hours attached to the second stage should be checked against the Rules directly before a business finalises its internal incident response runbook, since compliance commentary on exact timings has not been entirely uniform. What is consistent across sources is that the duty to notify the Board is not conditional on the fiduciary first assessing whether the breach is likely to cause harm; the trigger is the occurrence of a breach as the Act defines it, not a separate materiality threshold the fiduciary applies on its own judgment.

For most businesses the realistic priority is less about the exact hour count and more about having a workable internal process at all: a defined incident response team, a clear internal escalation path from the point a breach is first detected to the point someone has authority to notify the Board, and a template for individual notification that can be adapted quickly rather than drafted from scratch under time pressure. Given that breach-related penalties sit among the highest in the Schedule, this is one area where building the process now, well ahead of the 2027 deadline for the wider compliance regime, is justified on its own terms.

What a business should actually be doing right now

Given where the clock currently stands, a sensible compliance programme treats the remaining runway as roughly two distinct phases rather than one distant deadline. The first phase, running to the second tranche a few weeks from the date of this article, should focus on anything connected to consent architecture: mapping where and how consent is currently collected, assessing what will need to change once registered consent managers enter the market, and resolving open questions about children's data verification before that obligation becomes fully binding in the third tranche.

The second phase, running through to the May 2027 deadline for the bulk of substantive obligations, is the point at which most of the familiar compliance checklist, data mapping, a data protection policy, defined data principal rights procedures, security safeguards appropriate to the sensitivity of the data held, and significant data fiduciary assessments where applicable, needs to be substantively complete rather than merely planned. Waiting until early 2027 to start this work is likely to leave too little time for testing, especially for any business with legacy systems that were not designed with data principal rights, such as erasure or portability, in mind from the outset.

Running alongside both phases, independently of either tranche's timing, is the point this article has tried to make throughout: the Board is already a functioning adjudicator, and the highest-value penalty categories, security safeguard failures and breach notification failures chief among them, attach to duties that are, in substance, already capable of triggering regulatory exposure. A breach response plan and a basic security safeguards review are not 2027 projects. They are overdue now, whatever stage the rest of a business's compliance programme has reached.

The staggered commencement of the DPDP Act and Rules was designed to give business a genuine runway, and on its own terms that is a reasonable piece of regulatory design: a law of this scope could not sensibly be switched on everywhere at once. The risk is that the phasing is read as permission to delay everything, when in fact the institution that will decide whether a business has complied, the Data Protection Board, has been open for business since the first tranche, and the penalty figures attached to the most serious failures are not waiting for 2027 to bite.

The practical answer is to treat the next few weeks and the following eighteen months as two different projects rather than one deadline. Consent architecture, children's data verification and breach response readiness deserve attention now. The fuller compliance programme, built around notice, consent, data principal rights and security safeguards in their complete form, has a longer runway, but not one so long that it should be left for 2027 to begin.

Advocates advising on this law will also need to track the gaps this article has flagged rather than treat the Rules as a closed text. The cross-border treatment of critical personal data, the precise wording of the breach notification timeline, and the exact scope of the second tranche's consent mechanics are all points where the secondary commentary available at the time of writing is incomplete or inconsistent. Clients deserve a direct answer grounded in the current Gazette text on each of these points before a compliance programme is finalised, not a general assurance that the law is well understood everywhere it touches a business's operations.

Frequently Asked Questions

References & Further Reading

The provisions, rulings and official documents below were relied on for this article, which states the law as on 19 October 2026. The position can change with amendments, rules and later decisions, so check the current text before acting on any of it.

1. Digital Personal Data Protection Act, 2023, including the Schedule of penalties
2. Digital Personal Data Protection Rules, 2025 (notified mid-November 2025)
3. Ministry of Electronics and Information Technology, Gazette notifications constituting the Data Protection Board and bringing the Act and Rules into force in stages (mid-November 2025, mid-November 2026, mid-May 2027)
4. DPDP Act, 2023, Section 9 (children's data) and the age threshold of eighteen years
5. DPDP Act, 2023, Section 29 (appeal to the Telecom Disputes Settlement and Appellate Tribunal) and further appeal to the Supreme Court
6. DPDP Act, 2023, Section 33 and the Schedule (penalty ceilings and factors relevant to quantum)

Related reading on this site

• Dpdp act business compliance guide
• Employer background check employee data privacy guide