Seven Months to Go: A DPDP Milestone Tracker to 13 May 2027

What changed

On 13 May 2027, seven months from now, most of the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 take effect. The date comes from the commencement notification of 13 November 2025 (G.S.R. 843(E)) and Rule 1 of the Rules (G.S.R. 846(E)). Four things have happened since then, or failed to happen, that change how the remaining months should be used.

The first milestone is four weeks away. On 13 November 2026, Rule 4 commences, together with section 6(9), which requires every consent manager to register with the Data Protection Board of India (the Board), and section 27(1)(d), which lets the Board act against a consent manager in breach. A consent manager is a registered intermediary through which an individual gives, reviews and withdraws consent. Trayambic's Insight on consent managers covers the regime itself.

The Board has no members, as of the latest official statement (12 August 2026). It was established on paper on 13 November 2025, and MeitY invited applications for a Chairperson and four Members on 6 May 2026. The 12 August statement, a Lok Sabha answer, reported no appointments; our searches on 15 October 2026 found no notification since. Until members are appointed, no consent manager can be registered and no complaint can be decided.

The deadline has not moved. In January 2026 MeitY consulted industry on cutting the 18-month runway to 12 months, which would have brought the main obligations forward to 13 November 2026. No amending notification has been published. Plan for 13 May 2027 unless the Gazette says otherwise.

Two drafting slips have been fixed. The DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E)), issued on 5 October 2026 under section 43, makes section 9(1) read "of a child or of a person with disability" and replaces "audit" with "data audit" in section 10(2)(c)(ii). No date changed.

Who is affected

Every data fiduciary. A data fiduciary is any business or body that decides why and how digital personal data is processed. On 13 May 2027 its duties start together: notices, consent, security safeguards, breach intimation, erasure, children's data, rights and grievances. So do the Board's penalty powers and the extra duties of Significant Data Fiduciaries (SDFs), the fiduciaries the government may designate for closer oversight. The same day, section 44(2) omits section 43A of the Information Technology Act, 2000. Trayambic's Insight on the SPDI Rules explains what that ends.

Businesses with earlier or parallel dates. Several groups have deadlines that arrive before or alongside 13 May:

• consent-manager applicants, and platforms that plan to accept their signals;
• senders of commercial SMS and calls under TRAI's 2026 amendment;
• crypto platforms under the Crypto-Asset Reporting Framework (CARF) in the Income-tax Rules, 2026;
• NBFCs and their recovery agents under new RBI conduct rules;
• Indian businesses within California's privacy law that use automated decision-making technology (ADMT) for significant decisions;
• power-sector entities under new cyber security regulations.

Nobody gets a pause. The vacant Board does not suspend any obligation. Duties commence on the Gazette date whether or not a regulator is ready to enforce them. In our view, a breach after 13 May 2027 stays open to complaint once the Board is constituted.

What to do now

The table lists dated milestones we have checked against primary sources, except the CEA row, which is marked unconfirmed. The TRAI date is the earliest possible one, because the Gazette publication date is unconfirmed.

A month-by-month plan. Trayambic's whitepaper on DPDP compliance on a startup budget sets out the full programme. This plan pins it to the calendar.

• November 2026. Take the consent-manager decisions described in our consent managers Insight. Fix the programme owner and budget. Commercial-message senders get legacy consents into the Consent Register that TRAI's amendment recognises.
• December 2026. Sign off the data map: every system, purpose, ground (consent or a section 7 legitimate use), processor and country. NBFCs re-paper recovery-agent contracts and scripts. Crypto platforms close CARF due diligence.
• January 2027. Draft itemised notices under Rule 3 and split consent by purpose. NBFCs check the first month's contact logs against the new window. Businesses within the CCPA switch on ADMT notices.
• February 2027. Amend processor contracts for security, breach notice, deletion and audit rights, and strip "43A" and "SPDI" references from templates.
• March 2027. Build one breach runbook that meets CERT-In's six hours and the 72-hour report to the Board under Rule 7, then rehearse it. Set retention periods and deletion jobs. Power-sector entities test CSIRT-Power reporting before 1 April.
• April 2027. Open the rights and grievance channel, with replies within Rule 14's 90-day maximum. Ship age checks and verifiable parental consent where children use the service. Test a withdrawal, an erasure request and a breach end to end.
• May 2027. Publish notices on 13 May. Send notices to people whose consent predates commencement as soon as reasonably practicable, as section 5(2) requires. Retire the SPDI privacy policy. Crypto platforms file Form 167 by 31 May.

Watch list. Throughout, monitor four things: Board appointments, any change to the commencement notification, a startup exemption under section 17(3), and the first SDF designations. Trayambic's whitepaper on SDFs covers how designation is likely to work.

The table will change; the method will not. Put each date in the board calendar with a named owner, and review the list monthly until May.

Key takeaways

• Consent manager provisions (Rule 4, ss.6(9) and 27(1)(d)) commence on 13 November 2026; the main DPDP obligations and the omission of IT Act s.43A follow on 13 May 2027.
• As of the latest official statement (12 August 2026) the Data Protection Board has no members, and as of 15 October 2026 no notification has compressed the 18-month timeline.
• The Removal of Difficulties Order of 5 October 2026 fixed wording in ss.9(1) and 10(2)(c)(ii) but changed no dates.
• Sector dates fall before May: TRAI's amendment (from 18 October 2026 at the earliest), CARF due diligence (31 December 2026), RBI recovery rules and California ADMT duties (1 January 2027), and CEA power-sector cyber rules (reported for 1 April 2027).
• Give each milestone a named owner and month, and treat the Board vacancy as no reason to pause.