Two dates, two very different meanings
Every DPDPA conversation I have eventually arrives at the same question: "What is the actual deadline?" The honest answer is that there are two, and they mean different things.
November 2026 is when the soft-enforcement window ends. The Data Protection Board shifts from forbearance to active supervision, and legacy-data consent — the consent position for personal data you collected before the new regime — comes under scrutiny.
13 May 2027 is hard enforcement. From that date, the full obligation set is enforceable: consent, notices, security safeguards, breach protocol, Data Principal rights infrastructure, Significant Data Fiduciary obligations, DPIAs and the DPO requirement.
Treating 13 May 2027 as "the" deadline is the most common planning mistake I see. By November 2026 the Board is already supervising actively, and it has already shown its hand: the first DPB enforcement actions hit app developers in Q1 2026 over invalid consent — well inside the supposed grace period.
The timeline, end to end
- 14 November 2025 — the DPDP Rules are notified, converting the DPDP Act, 2023 from statute into an operational regime with concrete requirements.
- Q1 2026 — first Data Protection Board enforcement actions against app developers over invalid consent. The signal: consent quality is the first thing the regulator looks at.
- June–August 2026 — the Consent Manager framework is operationalised, with interoperable APIs. Data Fiduciaries need to be able to receive and honour consent signals from registered Consent Managers.
- November 2026 — soft-enforcement window ends. The DPB moves to active supervision; legacy-data consent scrutiny begins.
- 13 May 2027 — hard enforcement of the full obligation set, with penalties of up to ₹250 crore per breach category, stacking across categories.
What "soft enforcement ends" actually requires
The November 2026 transition is not symbolic. Three things change in practice.
Legacy data gets examined
Personal data collected before the DPDPA regime does not get grandfathered into compliance. From November 2026, the Board scrutinises whether your historical datasets have a defensible consent position. For every legacy dataset you hold, you need a documented decision: obtain fresh consent, anonymise, or delete. An inventory built in Privacy Management — which supports ROPA and PIA workflows today — is the prerequisite for making those calls systematically rather than dataset by dataset under pressure.
Consent flows must already be valid
The Q1 2026 actions established that invalid consent is enforceable now, not in 2027. Consent must be specific, informed and given by clear affirmative action, withdrawal must be as easy as giving consent, and your records must prove all of it. If your consent UX would not survive a screenshot in a Board proceeding, fix it before November.
Supervision means questions, and questions need evidence
Active supervision means the Board can ask what you are doing and expect organised answers. Privacy notices versioned in Document Management, DSR logs, training records and breach runbooks are the difference between a one-week response and a one-quarter scramble.
What must be running by 13 May 2027
Hard enforcement covers the full set. In rough order of build effort:
- Consent architecture — valid collection, granular records, easy withdrawal, Consent Manager interoperability.
- Notices — DPDPA-compliant content, available in all 22 scheduled languages, version-controlled.
- Security safeguards — the highest penalty tier, up to ₹250 crore, attaches to failure of reasonable security safeguards. If you run ISO 27001 or SOC 2, map onto it; if not, this is your longest pole.
- Breach protocol — notification to the Data Protection Board regardless of risk threshold, alongside the separate CERT-In duty to report cyber incidents within 6 hours. One breach starts both clocks. Incident Management tracks the dual timelines in one workflow.
- DSR infrastructure — intake, identity verification, routing, SLA tracking and grievance redressal for access, correction and erasure requests.
- Children's data controls — verifiable parental consent and no behavioural advertising to minors.
- SDF obligations — if designated: an India-based DPO, periodic DPIAs, independent audits and algorithmic due diligence.
The June–August 2026 window: Consent Managers
Sitting between the two headline dates is a milestone that deserves its own planning line: the Consent Manager framework is operationalised between June and August 2026, with interoperable APIs.
A Consent Manager is a registered platform through which individuals can give, manage and withdraw consent across the organisations they deal with. For a Data Fiduciary, the practical consequence is architectural: consent and withdrawal signals can now arrive from outside your own apps and websites, and you are obliged to honour them. That requires a consolidated internal consent registry, an API integration to receive signals, identity matching, and propagation of withdrawals into the systems that actually do the processing.
If your consent records currently live scattered across a marketing tool, a mobile backend and a warehouse, the consolidation work needs to start before the framework goes live — an integration built on inconsistent records just moves the inconsistency around faster. Remember also that withdrawal must be as easy as giving consent; an API-delivered withdrawal makes that requirement mechanical rather than aspirational.
A quarter-by-quarter plan from here
Assuming you are starting in mid-2026 with partial coverage, here is the sequencing I would run.
Now to September 2026
Data mapping and ROPA first — every downstream decision depends on knowing what personal data you hold and why. In parallel: remediate consent flows immediately (they are already enforceable) and integrate against Consent Manager APIs as the framework comes online between June and August. Begin the 22-language notice translation effort now; it takes longer than anyone budgets for, because each language needs both translation and legal review, and every subsequent notice change multiplies across all 22 versions.
October to November 2026
Close the legacy-data question before scrutiny begins: re-consent, anonymise or delete, with the decision documented per dataset. Stand up breach runbooks covering both the DPB and CERT-In tracks, and run one tabletop exercise that starts both clocks from the same simulated incident. Roll out staff training through Security Awareness Training so the people operating these processes understand them — most consent and notice failures are execution failures, not policy failures.
December 2026 to May 2027
Build out DSR operations to production quality: intake, identity verification, routing to data owners and SLA tracking, with grievance redressal as the escalation buffer before complaints reach the Board. Complete SDF deliverables if designated — DPO appointment (India-based), the first DPIA cycle, independent audit preparation and documented algorithmic due diligence. Then run an internal mock audit through Audit Management against the full obligation set and use the findings as your final remediation backlog before 13 May 2027.
The mistakes that burn the timeline
Three sequencing errors show up repeatedly in DPDPA programmes.
Starting with documents instead of data. Rewriting the privacy policy feels like progress, but without a data inventory you cannot know whether the policy describes reality. Mapping first, drafting second.
Deferring consent because "hard enforcement is 2027". Consent is the one obligation with a live enforcement record — the Q1 2026 actions predate every deadline in this article. It goes first, not last.
Underestimating the 22-language notice effort. Teams budget for one translation pass and discover they need a maintained translation pipeline, because notices change whenever processing purposes change. Treat it as an ongoing operation with version control, not a project with an end date.
Why the penalties make sequencing matter
Penalties under the DPDPA run up to ₹250 crore per breach category — and they stack. A single incident can simultaneously be a security-safeguards failure, a breach-notification failure and a consent failure, each attracting its own penalty. That is why the plan above front-loads consent and security: they are respectively the most-enforced and the most-penalised categories.
Where Compliance Enablers fits
The modules that carry most of this programme — Privacy Management for DSRs, ROPA and PIAs, Incident Management for the dual breach clocks, Document Management for notices and policies, plus training and audit — are operational today. The DPDPA Operations Suite, which adds a consent registry, DSR SLA clocks and an SDF obligation tracker, is rolling out ahead of the November 2026 deadline. For context, standalone DPDPA point solutions focused on consent alone are pricing at ₹15–40 lakh per year.
Next step
Read the DPDPA framework guide for the full obligation detail, or book a demo to map your current state against this timeline. The teams that aim at November 2026 will be calm in May 2027. The teams that aim at May 2027 will discover the Board got to them first.
This is general information, not legal advice.