Quick Answer: The Digital Personal Data Protection Act 2023 was enacted in August 2023. The DPDP Rules 2025 were notified in November 2025. Enforcement is expected to begin in May 2027 when the Data Protection Board of India becomes operational. Companies have until May 2027 to achieve full compliance — approximately 18 months from the Rules notification. This page gives you the full deadline timeline and a prioritised action checklist.
DPDP Compliance Deadline 2027 — Every Date You Need to Know
Enforcement begins May 2027. See the full timeline, calculate your time remaining, and get a prioritised action plan.
How much time do you have left?
DPDP enforcement timeline — key dates
August 2023 — DPDP Act 2023 enacted and notified
November 2025 — DPDP Rules 2025 notified (detailed obligations now clear)
2026 — Data Protection Board of India constitution expected
2026–27 — SDF (Significant Data Fiduciary) designations expected
From May 2027, the Data Protection Board of India will be empowered to investigate complaints, summon records, and impose penalties. There is no grace period after enforcement begins. Companies found non-compliant face penalties of ₹50–250 crore depending on the nature and severity of the violation. Individuals who file complaints with the DPB can trigger formal investigations.
The risk is not just financial. Enterprise clients — especially those in regulated sectors or with international customers — are already including DPDP compliance status in vendor questionnaires. Non-compliant vendors risk contract terminations ahead of the 2027 deadline.
What should you complete before the end of 2026?
The most common approach for mid-market Indian companies is a phased programme: Q3 2026 for assessment and critical fixes (consent, notice, grievance officer); Q4 2026 for documentation, training and vendor review; Q1 2027 for a final audit and board sign-off. This leaves a buffer before the May 2027 enforcement date and allows time to respond to any DPB guidance issued after SDF designations.
Get the DPDP 2027 deadline tracker (free)
A month-by-month timeline PDF with every action item, owner, and evidence requirement — ready to present to your board.
Frequently Asked Questions
Is May 2027 a hard deadline or an estimate?+
The DPDP Rules 2025 set out obligations that are legally in force. The May 2027 date is when the Data Protection Board is expected to become fully operational and begin enforcement. However, obligations under the Act are already live — a breach occurring today would still be subject to the Act.
Can the government extend the DPDP 2027 deadline?+
The enforcement date is not a statutory deadline in the Act itself — it is tied to the DPB constitution timeline. Extensions are possible but should not be relied upon for planning. Most companies that wait for an extension announcement will not have enough time to implement.
What is the minimum required for DPDP compliance by 2027?+
At minimum: a DPDP-compliant privacy notice, a valid consent mechanism, an appointed and published Grievance Officer, documented security safeguards, and a breach response procedure. This is the compliance floor — not the ceiling.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
