The DPDP Act 2023 was enacted in August 2023, and the DPDP Rules 2025 were notified in November 2025, starting an 18-month implementation window. Full enforcement — including the Data Protection Board becoming operational and beginning to hear complaints and impose penalties — is expected around May 2027. Between now and then, companies should expect further milestones such as Significant Data Fiduciary designations and Board procedural guidance. This tracker shows every milestone and where your organisation stands against them.
From the 2023 Act to the May 2027 enforcement deadline — track every milestone on the DPDP timeline and see where your organisation stands.
The DPDP Rules 2025 were notified in November 2025 and set out a phased implementation window before the Data Protection Board is expected to be fully operational and begin enforcement — commonly estimated at around 18 months, placing full enforcement around May 2027. This is not an arbitrary date; it reflects the time needed to constitute the Board, finalise procedural rules, and allow data fiduciaries a runway to come into compliance with obligations that are already legally in force.
Importantly, the underlying obligations of the DPDP Act are live today — a data breach or serious violation occurring now is not exempt just because the Board's enforcement capacity is still ramping up. Waiting for May 2027 to begin compliance work is a significant risk, not a safe strategy.
A practical way to use this timeline is to work backward from May 2027: complete a DPDP Readiness Assessment and fix critical gaps (consent, notice, Grievance Officer) well before Board operations ramp up; complete documentation, vendor DPAs and staff training in the following phase; and reserve the final months before enforcement for an audit-style review and board sign-off, rather than new implementation work.
Companies likely to be designated Significant Data Fiduciaries — typically those processing data at scale or handling sensitive categories — should plan for additional milestones: DPO appointment, DPIA processes, and independent audit engagement. Niti Bharat's fixed-price DPDP Compliance Roadmap service is built to map your organisation against this exact milestone sequence.
A downloadable timeline PDF mapping every DPDP milestone to a recommended internal deadline, with owner and evidence columns ready for your compliance tracker.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
