Skip to main content
DPDP Enforcement Timeline: Phases 1, 2 and 3 | Aizzentec — page loaded
Phase 3 enforcement: 13 May 2027. The runway is now.Speak to Aizzentec +91 8220 359 506
Regulatory

Phase 1, 2, 3: the realistic timeline of DPDP enforcement

What's already enforceable, what comes mid-2026, and what crystallises on 13 May 2027.

Regulatory7 min read
By Praveen Kumar, Practice Leader — Risk, Cyber and AnalyticsCA, CISA, CEH, CDPSE, CFEPublished Updated

Phase 1 — Now

Phase 1 is the current state. The Act is in force. The Rules are notified (13 November 2025, G.S.R. 846(E)). The DPBI is constituted. The basic framework — duties, lawful basis, security, breach notification, rights — is technically applicable.

What should already be operational:

  • DPDP-compliant Privacy Notice
  • Consent capture aligned to Section 6 + Rule 3
  • Security baseline aligned to Rule 6
  • Breach response capability per Rule 7
  • DSAR fulfilment workflow with the 90-day SLA tracking
  • Grievance officer published
  • Vendor DPAs aligned to Section 8(2)

If your programme isn't here, you're behind.

Phase 2 — ~November 2026

Phase 2 brings the Consent Manager ecosystem live. Consent Managers are intermediaries that aggregate, manage and revoke consents on behalf of Data Principals. The framework is in Rule 4 of the DPDP Rules.

This matters for:

  • Businesses that intend to operate as Consent Managers — registration with DPBI, technical and operational standards
  • Businesses that will integrate with Consent Managers — APIs, consent-record formats, withdrawal handling
  • Account Aggregator-related businesses — the AA framework will need DPDP harmonisation

Phase 3 — 13 May 2027

Phase 3 is the crystallisation date for substantive obligations. Two years from notification of the Rules. By this date:

  • Significant Data Fiduciaries are notified (or notification is imminent)
  • The full Section 10 + Rule 13 obligations apply for SDFs
  • Penalty enforcement reaches steady state
  • The grievance-and-appeal machinery is operational at scale
  • Annual audit cycles for SDFs are running

Substantive programmes that will take 12-18 months to build (RoPA, DPIA cycle, vendor remediation across 50+ processors, automated DSAR portal, encryption uplift) need to be in flight by mid-2026 to be production-ready by Phase 3.

The trap

The most common strategic error: treating 13 May 2027 as the start date and pacing accordingly. It's the deadline. A programme paced for the deadline misses the deadline by 6-12 months.

Pace for completion in Q4 2026. Use Q1-Q2 2027 for testing, audit, board sign-off and continuous improvement. Don't ship to the deadline.

All knowledge articles

Related articles