# DPDP status tracker: what is in force today Source: https://dpdp.miravlabs.com/dpdp-status/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs **Short answer:** As of 13 November 2026: the DPDP Rules are notified and the Data Protection Board is established, but no Chairperson or Members have been appointed. The consent manager framework (Rule 4) applies from today, with no consent manager registered yet. The core obligations still apply from 13 May 2027; a proposal to shorten the timeline has not been adopted. No Significant Data Fiduciaries or restricted countries have been notified. ## In plain words India's data protection law is switching on in stages. As of 13 November 2026, the rules are published and the regulator exists on paper, but it has no members yet. The main duties for businesses start on 13 May 2027, and that date has not moved. - **13 May 2027** main duties for businesses start - **0** regulator members appointed so far - **0** consent managers registered so far ### What it means for you - The Data Protection Board, the new regulator, was set up in November 2025. Applications for its chairperson and four members were invited in May 2026, but no one has been appointed. - From today, the law on consent managers applies. These are registered companies that let people give and withdraw consent in one place. None is registered yet, and you do not need one. - A proposal to cut the deadline to 12 months was discussed with industry in early 2026. It has not been adopted. - Some government steps have not happened yet: naming very large companies for extra duties, restricting countries for data transfers, and exempting startups. - Cases challenging parts of the law are pending in the Supreme Court. There is no stay, so the dates stand. **Example:** A payroll software company in Pune wants to wait until the regulator is staffed before starting its privacy work. Waiting does not help. Its duties start on 13 May 2027 either way, and once the regulator has members it can act on any failure after that date. ### What to do - Plan your work for 13 May 2027, and watch for any notified change. - Start now, without waiting for the regulator. - Collect consent directly for now. Look at consent managers once some are registered. - Keep a list of where your vendors store data, in case a country is restricted later. - Check this page for updates. We review it regularly. The law: the DPDP Act, 2023 and the DPDP Rules, 2025, notified 13 November 2025 and phased in to 13 May 2027. Consent manager rules (section 6(9), Rule 4) apply from 13 November 2026. Status as of 13 November 2026. ## The detailed guide ## Key takeaways - Data Protection Board: established in November 2025, members not yet appointed. - Consent managers: Rule 4 in force from 13 November 2026; none registered, no application portal reported. - Deadline: core obligations from 13 May 2027, unchanged. - Not yet notified: Significant Data Fiduciaries, restricted countries for transfers, startup exemptions. - Supreme Court challenges are pending, with no stay on the Act or the Rules. DPDP news moves faster than most guides are updated, and sources disagree on basics like whether the Board exists or whether the deadline has moved. This page tracks the current position of each item that affects your compliance plan, with the source and the date we last checked it. We review it regularly and log changes at the bottom. ## What this means for your plan - **Plan for 13 May 2027.** Nothing notified so far moves the date. Do not plan around a change that has not been notified. - **Don't wait for the Board.** The obligations are yours whether or not the Board is staffed. Once Members are appointed, it can act on breaches of obligations that apply from May 2027. - **Consent managers are optional.** You can collect consent directly. Integrate with a consent manager once registrations exist, if your users want one. - **Prepare for designation if you are large.** SDF notifications could come with little notice; see [what an SDF must do](https://dpdp.miravlabs.com/guides/significant-data-fiduciary/). - **Keep transfers documented.** No country is restricted, but a vendor-location register lets you react if one is. ## Timeline For the full list of which sections and Rules commence in each phase, see the [enforcement date guide](https://dpdp.miravlabs.com/guides/dpdp-act-enforcement-date/). ## How we keep this page current We check the Gazette, MeitY and PIB releases, the Board's announcements once it is functional, and reporting on court proceedings, at regular intervals. Changes are added to the changelog below with its date and source. If you spot something we have missed, email [support@d2c.in](mailto:support@d2c.in). ## Changelog | Date | Change | |---|---| | 13 Nov 2026 | Tracker published. Rule 4 (consent managers) in force from today; no registrations reported. Board Members still not appointed. Core obligations unchanged at 13 May 2027. | ## Frequently asked questions ### Has the Data Protection Board of India been constituted? It has been established: G.S.R. 844(E) of 13 November 2025 set it up with its head office in the National Capital Region. As of 13 November 2026 no Chairperson or Members have been appointed. MeitY invited applications on 6 May 2026, and in October 2026 the Centre told the Kerala High Court the Board was constituted but not yet functional. ### Is the DPDP Act in force now? Partly. Definitions, the Board provisions and the RTI amendment have applied since 13 November 2025, and the consent manager provisions from 13 November 2026. The core obligations on notice, consent, security, breach intimation, retention, rights and grievances apply from 13 May 2027. ### Has the DPDP deadline been extended or shortened? No. A proposal to shorten the 18-month window to 12 months was discussed with industry in January and February 2026, but no amendment has been notified. The core obligations still apply from 13 May 2027. ### Have any consent managers been registered? Not as of 13 November 2026. Rule 4 took effect that day, but no application portal or registration has been reported, and the Board has no Members yet to decide applications. ### Have any Significant Data Fiduciaries been notified? No. The government has not notified any Significant Data Fiduciary under section 10 as of 13 November 2026. ### Is the DPDP Act being challenged in court? Yes. Writ petitions in the Supreme Court challenge parts of the Act, notably the amendment to the RTI Act, and parts of the Rules. On 16 February 2026 the Court issued notice, declined a stay and referred the matter to a larger bench. The cases are pending.