DPDPA Compliance Deadline Tracker — every phase, tracked.
India's DPDPA rolls out in phases, not all at once. This tracker lists each milestone with what it actually requires, so you know which deadline applies to your organization right now.
DPDPA phased rollout
Dates reflect the rules as notified; always confirm the current position with counsel before treating a deadline as final.
| Milestone | What it requires | Applies to |
|---|---|---|
| Aug 2023 | Digital Personal Data Protection Act passed. | All data fiduciaries, in principle. |
| Nov 2025 | DPDP Rules notified, setting out implementation detail and a phased timeline for specific obligations. | All data fiduciaries. |
| 13 Nov 2026 | Rule 4 takes effect — notice-and-consent requirements and the core Significant Data Fiduciary obligations become enforceable. | All data fiduciaries; extra duties for Significant Data Fiduciaries. |
| Ongoing after Nov 2026 | Remaining rules — including cross-border transfer whitelisting, data retention limits for specific categories, and grievance redressal mechanics — phase in; track official notifications for exact dates. | Varies by data category and fiduciary type. |
Frequently asked questions
Is 13 November 2026 the only deadline that matters?
It's the most significant milestone announced so far, covering notice-and-consent and Significant Data Fiduciary duties, but DPDPA's rules continue to roll out in phases — treat this as the next major checkpoint, not the finish line.
How do we know if we're a Significant Data Fiduciary?
The designation is based on factors like the volume and sensitivity of personal data processed and the risk to individuals' rights; it isn't self-declared on size alone. Use the DPDPA Readiness Checklist's governance section to work through the assessment.