Countdown to 13 May 2027: The DPDP Compliance Roadmap

Full substantive obligations under the DPDP Act become enforceable on 13 May 2027, and there is no stated grace period after that date. For a business that has not yet started preparing, the runway between now and then is exactly the time to build a realistic compliance roadmap rather than leave it to the final quarter.

Key facts at a glance

• The Digital Personal Data Protection (DPDP) Act, 2023 is India's data-protection law.
• Under the DPDP Rules 2025, full substantive obligations, notice, consent, security safeguards, breach reporting, and data-principal rights, become enforceable on 13 May 2027.
• There is no stated grace period after this date.
• The Consent Manager registration framework (Rule 4) becomes operational earlier, on 13 November 2026.
• Penalties can reach up to Rs 250 crore per instance for failing to implement reasonable security safeguards.
• The Data Protection Board provisions took effect immediately upon notification of the Rules, meaning the enforcement body already exists ahead of the substantive deadline.

Why "no grace period" changes how you should plan

Many regulatory transitions in India have historically included informal or formal grace periods, extensions, or phased enforcement. The DPDP Rules 2025 do not build one in after 13 May 2027. That means businesses should not plan around the assumption of extra runway past the deadline. The safer approach is to work backward from May 2027 with meaningful buffer, treating the date as fixed rather than as a target that will likely slip.

A rough roadmap, working backward from 13 May 2027

Step 1: Know your data

Every other obligation, notice, consent, security safeguards, rights fulfilment, depends on first knowing what personal data your business actually collects, why you collect it, where it is stored, how long you retain it, and who inside and outside the organisation can access it. A data inventory is unglamorous but foundational. Businesses that skip this step tend to discover gaps late, when there is far less time to fix them.

Step 2: Fix your notice and consent language

The DPDP Act requires clear, specific, informed consent, not a buried clause in a lengthy terms-of-service document. Review every point where you collect personal data, sign-up forms, checkout flows, app permissions, and check whether the notice given at that point actually explains what data is collected and why, in plain language.

Step 3: Build (or upgrade) security safeguards

Given that penalties for security-safeguard failures can reach up to Rs 250 crore per instance, this is the single highest-stakes area to get right. Reasonable security safeguards generally include encryption or equivalent protection for personal data, access controls, monitoring for unauthorised access, and a documented breach-response plan, though exact technical requirements should be confirmed against the Rules and any sector-specific guidance as they mature.

Step 4: Prepare for breach reporting

The Act requires reporting of personal data breaches. Businesses should have a defined internal process, who is notified first, how the breach is assessed, and how and when it gets reported, well before an actual incident forces the process to be improvised.

Step 5: Build a process for data-principal rights

Individuals will have rights to access information about their data, request correction or erasure, and route grievances through a defined mechanism. Businesses should have an operational process, not just a policy statement, for receiving and responding to these requests within a reasonable timeframe.

Step 6: Watch the Consent Manager ecosystem from November 2026

Once the Consent Manager registration framework becomes operational on 13 November 2026, businesses, especially in data-intensive sectors, should evaluate whether integrating with a registered Consent Manager fits their consent architecture ahead of the May 2027 deadline, rather than building everything in-house from scratch.

Why starting early matters more than usual here

Because there is no stated grace period, the cost of discovering a compliance gap in April 2027 is much higher than discovering it in mid-2026. Data inventories, consent-flow redesigns, and security upgrades all take real implementation time, plus testing. A roadmap that treats 13 May 2027 as the actual hard deadline, with internal review checkpoints well before it, is the more defensible approach for any business handling personal data at scale.

If you are not sure where your business stands on DPDP readiness, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.

Sources

• Ministry of Electronics and Information Technology - meity.gov.in
• Data Protection Board of India notifications, via meity.gov.in
• DPDP Rules 2025, as published on meity.gov.in

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.