Implementation timeline
Phased commencement, on the record
The DPDP Act does not switch on all at once. Its machinery is already running, the Consent Manager framework arrives in November 2026, and the main duties — with the penalty regime — are scheduled for 13 May 2027.
Keeping this current: the milestones and the “as of” date live in one place — assets/js/content.js (timeline array, lastVerified) — so a new notification is a one-file update.
What this means for you
In force ≠ obligations on you (yet)
Build while the Board builds
The Board, appeals machinery and the Rules' own framework are live. Business duties are not — which makes this the preparation window, not the panic window.
Consent, safeguards, penalties
From this date, notices, consent standards, security safeguards, breach reporting, rights workflows, children's-data duties and the penalty Schedule are enforceable.
Notifications still to come
SDF designations, cross-border restriction lists and Consent Manager registrations will be notified over time — each one can change your obligations.
Twenty-plus months became months. Use them.
A readiness plan built now spreads the work. Our five-step journey starts with something you can do this week: discovering your data.