The DPDP implementation clock is running
India’s phased commencement is no longer an abstract horizon. Track the next statutory milestone in real time, see what applies when, and turn the remaining window into a controlled programme with evidence.
Reviewed 9 October 2026 · 10 minute read · General guidance, not legal advice
Time to the next milestone
Calculating from your device date…
Calculating programme elapsed time…
Three phases, two dates still shaping the programme
The commencement notification dated 13 November 2025 ties each phase to publication in the Official Gazette. The Gazette record carries 14 November 2025, so the one-year and eighteen-month milestones fall on 14 November 2026 and 14 May 2027.
Framework and Board provisions
Definitions and provisions establishing the Data Protection Board, its composition, powers, procedure and related machinery commenced on publication.
Consent Manager provisions
Section 6(9) and section 27(1)(d) commence: the consent-giving framework through registered Consent Managers and the connected Board function become operative.
Core duties and rights
Notice, consent, legitimate uses, Data Fiduciary duties, security, breach intimation, erasure, children’s data, rights, Significant Data Fiduciary duties and remaining provisions commence.
Build six connected workstreams, not six isolated documents
A defensible programme connects each obligation to a process owner, system control, operating record and review cycle. Controls should be tested before commencement, not merely approved.
1. Scope, inventory and grounds
- Confirm territorial applicability, roles and entities.
- Reconcile processing, systems, processors and data flows.
- Map each purpose to consent or a section 7 legitimate use.
2. Notice and consent
- Issue standalone, itemised notices in clear language.
- Make withdrawal as easy as giving consent.
- Version interfaces and preserve proof of the journey.
3. Rights and grievances
- Publish an accessible request and grievance route.
- Verify identity proportionately and route requests to systems.
- Measure ageing, outcomes, exceptions and escalation.
4. Safeguards and breach
- Translate reasonable safeguards into owned technical controls.
- Define detection, assessment, Board and individual intimation.
- Run a timed tabletop exercise and close findings.
5. Retention and deletion
- Set purpose-linked retention rules and legal holds.
- Implement deletion across production and vendors.
- Keep execution logs and investigate failed jobs.
6. Processors, children and SDF
- Re-paper processors and monitor safeguards.
- Detect children’s use and design verifiable parental consent.
- Prepare DPO, DPIA and audit capability if SDF designation is plausible.
A practical next 90 days
Prioritise dependencies and long lead times. A late programme should begin with accountable scope and evidence-producing controls, not policy drafting alone.
Mobilise and baseline
Name the sponsor and owners; confirm applicability; reconcile the inventory; identify children’s data, processors and product releases needing design changes.
Design and implement
Approve grounds; redesign notice and consent; launch rights routing; define retention and breach decisions; issue processor amendments; create the evidence index.
Test and remediate
Run request, withdrawal, deletion and breach scenarios; sample consent records; test vendor escalation; train frontline teams; report residual risk to leadership.
Can you prove these controls today?
Tick only what is operating and evidenced, not what is planned. This check is not saved or transmitted.
The evidence pack leadership should be able to open
Policies describe intent. These artefacts show that privacy controls are designed, deployed and operating.
- Applicability decision, governance charter, owners and risk acceptance log.
- Processing register, system map, processor register and purpose-to-ground matrix.
- Notices, consent language, interface captures, versions and withdrawal records.
- Rights procedure, request register, ageing metrics, decisions and correspondence.
- Safeguard catalogue, test results, exceptions and remediation evidence.
- Breach playbook, decision log, notification templates and exercise report.
- Retention schedule, system rules, legal holds, deletion runs and failures.
- Processor clauses, due diligence, monitoring and incident escalation.
- Children’s-data assessment and parental-consent design where applicable.
- SDF readiness: DPO model, DPIA method, audit plan and reporting.
| Decision or control | Accountable lead | Evidence | Review trigger |
|---|---|---|---|
| Purpose and ground | Business owner with privacy/legal | Approved purpose-to-ground register | New or changed processing |
| Consent and notice | Product owner | Versioned copy, captures, logs and test | Release or purpose change |
| Breach decision | Incident commander with privacy/legal | Timed decision log and communications | Every suspected breach |
| Deletion | Data or system owner | Job log, exception queue and closure | Scheduled run and request |
What teams ask when the deadline becomes real
When do the main obligations commence?
The principal Data Fiduciary duties and Data Principal rights listed in the notification commence on 14 May 2027.
What changes on 14 November 2026?
Section 6(9) and the connected Board function in section 27(1)(d), concerning Consent Managers, commence.
Is this a grace period?
It is a build window. System changes, vendor negotiation, training and test evidence need to be ready before duties commence.
Do processors have direct duties?
The Act places primary obligations on the Data Fiduciary, which remains responsible for processing on its behalf; contracts and oversight are central controls.
Should we wait for SDF designation?
No. Build proportionate DPIA, audit, DPO and governance capability, but do not state that designation is certain until notified.
Does this replace legal advice?
No. Confirm the current Act, Rules, notifications and Board guidance for your facts.
Last reviewed 9 October 2026. The clock uses the visitor’s device time and advances automatically between milestones.