COMPLIANCE · ISSUE 17

Most writing about India's Digital Personal Data Protection framework explains the principles. Fewer pieces answer the question businesses actually ask, which is when does this start costing me money, and what do I need finished by then. This is that piece.

The dates

14 November 2025, the Rules are notified

The DPDP Rules 2025 were notified, giving operational shape to the Act passed in 2023. This is the point from which every other date is counted.

Through 2026, soft enforcement

The expectation across compliance practice is that this period is one of guidance and warnings rather than penalties: the Data Protection Board of India building awareness and organisations building programmes. It is a grace period, not an exemption, and it is finite.

June to August 2026, the Consent Manager framework

The central government is expected to operationalise the Consent Manager framework in this window. Consent Managers are interoperable platforms through which individuals can grant, review and withdraw consent across multiple services from one place.

This is the item most organisations underestimate. If people can withdraw consent centrally, your systems have to be able to receive that signal and act on it, which usually means knowing where the relevant personal data actually is. Most organisations discover at this point that they do not.

November 2026, the end of the soft phase

One year after notification. This is widely expected to mark the transition from awareness building to active regulatory supervision.

13-14 May 2027, hard enforcement

The date most commonly cited as the point at which the framework carries real consequences. If your programme is not finished by then, you are relying on not being looked at.

The arithmetic nobody likes

Compliance practice puts a typical enterprise DPDP programme at nine to twelve months for gap assessment, control implementation and audit readiness. Count backwards from May 2027 and the honest conclusion is that an organisation starting after roughly mid-2026 is already compressed.

The other thing to plan for is legacy data. Personal data collected before the framework existed is expected to need valid notice and consent consistent with the Act. For most organisations this is the largest single item, not because it is technically hard, but because nobody knows how much there is or where it sits until they look.

What to do, in order

1. 01Find the data. A data inventory and flow map. What personal data you hold, where it lives, who it goes to, and why. Everything else depends on this and it always takes longer than planned.
2. 02Fix the notice and consent path. Clear, plain-language notice at collection, and consent that is specific rather than bundled. Then the harder part: a working mechanism for withdrawal that your systems honour.
3. 03Name a Grievance Officer. A named individual with authority to resolve complaints, published in your privacy notice. A generic inbox does not satisfy this.
4. 04Deal with legacy data. Decide, per dataset, whether to re-consent, re-base or delete. Deletion is frequently the cheapest compliant answer and is consistently the last one considered.
5. 05Write down the security controls. Reasonable security safeguards are an obligation, not a recommendation, and you will be asked what yours were.
6. 06Rehearse a breach. Notification to the Board and to affected individuals is required. The middle of an incident is a bad time to discover you have no process.
7. 07Keep evidence. Being compliant and being able to demonstrate compliance are different projects, and only the second one survives an inquiry.

The last point deserves more than a bullet

Almost every obligation above eventually reduces to the same demand: show us. Show us the consent. Show us who accessed that record. Show us that the device the contractor used was not a hole in your controls.

Policies are the cheap half. Records are the half that holds up. And device level accountability is the gap most programmes leave open longest, because it is nobody's obvious job, the security team owns the network, IT owns the endpoints, and what a specific person did on a specific machine during a specific window belongs to neither.

Black Box covers that gap: a tamper evident record of activity on a device, which is one of the technical controls a serious data fiduciary is expected to be able to produce. For organisations that want the whole assessment rather than one control, we run a DPDP compliance service.