India's data protection law is switching on in stages. As of 13 November 2026, the rules are published and the regulator exists on paper, but it has no members yet. The main duties for businesses start on 13 May 2027, and that date has not moved.
What it means for you
- The Data Protection Board, the new regulator, was set up in November 2025. Applications for its chairperson and four members were invited in May 2026, but no one has been appointed.
- From today, the law on consent managers applies. These are registered companies that let people give and withdraw consent in one place. None is registered yet, and you do not need one.
- A proposal to cut the deadline to 12 months was discussed with industry in early 2026. It has not been adopted.
- Some government steps have not happened yet: naming very large companies for extra duties, restricting countries for data transfers, and exempting startups.
- Cases challenging parts of the law are pending in the Supreme Court. There is no stay, so the dates stand.
What to do
- Plan your work for 13 May 2027, and watch for any notified change.
- Start now, without waiting for the regulator.
- Collect consent directly for now. Look at consent managers once some are registered.
- Keep a list of where your vendors store data, in case a country is restricted later.
- Check this page for updates. We review it regularly.
The law: the DPDP Act, 2023 and the DPDP Rules, 2025, notified 13 November 2025 and phased in to 13 May 2027. Consent manager rules (section 6(9), Rule 4) apply from 13 November 2026. Status as of 13 November 2026.
As of 13 November 2026: the DPDP Rules are notified and the Data Protection Board is established, but no Chairperson or Members have been appointed. The consent manager framework (Rule 4) applies from today, with no consent manager registered yet. The core obligations still apply from 13 May 2027; a proposal to shorten the timeline has not been adopted. No Significant Data Fiduciaries or restricted countries have been notified.
Key takeaways
- Data Protection Board: established in November 2025, members not yet appointed.
- Consent managers: Rule 4 in force from 13 November 2026; none registered, no application portal reported.
- Deadline: core obligations from 13 May 2027, unchanged.
- Not yet notified: Significant Data Fiduciaries, restricted countries for transfers, startup exemptions.
- Supreme Court challenges are pending, with no stay on the Act or the Rules.
DPDP news moves faster than most guides are updated, and sources disagree on basics like whether the Board exists or whether the deadline has moved. This page tracks the current position of each item that affects your compliance plan, with the source and the date we last checked it. We review it regularly and log changes at the bottom.
| Item | Status | Detail |
|---|---|---|
| DPDP Act, 2023 | Partly in force | Act No. 22 of 2023. Phased commencement under G.S.R. 843(E) of 13 Nov 2025. |
| DPDP Rules, 2025 | Notified | G.S.R. 846(E), Gazette dated 13 Nov 2025. 23 Rules, seven Schedules. |
| Phase 1: definitions, Board, RTI amendment | In force | Since 13 Nov 2025, with Rules 1, 2 and 17 to 21. |
| Data Protection Board established | Done | G.S.R. 844(E): head office in the NCR. G.S.R. 845(E): four members. |
| Board Chairperson and Members appointed | Pending | Applications invited 6 May 2026. In Oct 2026 the Centre told the Kerala High Court the Board was constituted but not functional. |
| Phase 2: consent managers (Rule 4) | In force | From 13 Nov 2026, with s.6(9) and s.27(1)(d). |
| Consent managers registered | None yet | No registration or application portal reported. |
| Phase 3: core obligations | 13 May 2027 | Rules 3, 5 to 16, 22 and 23: notice, consent, safeguards, breach, retention, rights, grievances. |
| Proposal to shorten the timeline to 12 months | Not adopted | Discussed with industry Jan to Feb 2026. No amendment notified. |
| Removal of Difficulties Order, 2026 | Issued | S.O. 5458(E), 5 Oct 2026: wording changes to s.9(1) and s.10(2)(c), including “periodic data audit”. |
| Significant Data Fiduciaries | None notified | Section 10 designation not yet used. |
| Restricted countries for transfers (s.16) | None notified | Transfers abroad allowed unless restricted. No Rule 15 order yet. |
| SDF data localisation list (Rule 13(4)) | None notified | Depends on a government committee's recommendation. |
| Startup and other exemptions (s.17(3), 17(5)) | None notified | Power exists; not used. |
| Notified age above which children's rules may relax (s.9(5)) | None notified | Children's obligations apply to all under-18s for now. |
| Supreme Court challenges | Pending | Notice issued 16 Feb 2026; no stay; referred to a larger bench. |
| IT Act section 43A (compensation) | Still in force | Omitted from 13 May 2027 under s.44(2). |
| Official MeitY FAQs on the final Rules | None issued | FAQs were issued only with the January 2025 draft. |
What this means for your plan
- Plan for 13 May 2027. Nothing notified so far moves the date. Do not plan around a change that has not been notified.
- Don't wait for the Board. The obligations are yours whether or not the Board is staffed. Once Members are appointed, it can act on breaches of obligations that apply from May 2027.
- Consent managers are optional. You can collect consent directly. Integrate with a consent manager once registrations exist, if your users want one.
- Prepare for designation if you are large. SDF notifications could come with little notice; see what an SDF must do.
- Keep transfers documented. No country is restricted, but a vendor-location register lets you react if one is.
Timeline
The Data Protection Board is established and Rules 1, 2 and 17 to 21 apply. Its members are yet to be appointed.
Rule 4 applies: consent managers can register with the Board and start carrying people's consents to businesses.
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
For the full list of which sections and Rules commence in each phase, see the enforcement date guide.
How we keep this page current
We check the Gazette, MeitY and PIB releases, the Board's announcements once it is functional, and reporting on court proceedings, at regular intervals. Changes are added to the changelog below with its date and source. If you spot something we have missed, email support@d2c.in.
Changelog
| Date | Change |
|---|---|
| 13 Nov 2026 | Tracker published. Rule 4 (consent managers) in force from today; no registrations reported. Board Members still not appointed. Core obligations unchanged at 13 May 2027. |
Frequently asked questions
Has the Data Protection Board of India been constituted?
It has been established: G.S.R. 844(E) of 13 November 2025 set it up with its head office in the National Capital Region. As of 13 November 2026 no Chairperson or Members have been appointed. MeitY invited applications on 6 May 2026, and in October 2026 the Centre told the Kerala High Court the Board was constituted but not yet functional.
Is the DPDP Act in force now?
Partly. Definitions, the Board provisions and the RTI amendment have applied since 13 November 2025, and the consent manager provisions from 13 November 2026. The core obligations on notice, consent, security, breach intimation, retention, rights and grievances apply from 13 May 2027.
Has the DPDP deadline been extended or shortened?
No. A proposal to shorten the 18-month window to 12 months was discussed with industry in January and February 2026, but no amendment has been notified. The core obligations still apply from 13 May 2027.
Have any consent managers been registered?
Not as of 13 November 2026. Rule 4 took effect that day, but no application portal or registration has been reported, and the Board has no Members yet to decide applications.
Have any Significant Data Fiduciaries been notified?
No. The government has not notified any Significant Data Fiduciary under section 10 as of 13 November 2026.
Is the DPDP Act being challenged in court?
Yes. Writ petitions in the Supreme Court challenge parts of the Act, notably the amendment to the RTI Act, and parts of the Rules. On 16 February 2026 the Court issued notice, declined a stay and referred the matter to a larger bench. The cases are pending.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. We aim to send a proposal, usually at a fixed fee, within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.