What are the India DPDP Act compliance deadlines?

Nov 13, 2025: DPDP Rules published; Board and procedural rules in force. Nov 13, 2026: Consent Manager registration rule in force (12 months). May 13, 2027: Main data fiduciary obligations apply (18 months).

When does India DPDP Act take effect?

India DPDP Act took effect on Nov 13, 2025. The next milestone is Nov 13, 2026: Consent Manager registration rule in force (12 months).

Who does India DPDP Act apply to?

Processing of digital personal data in India, and processing outside India connected with offering goods or services to data principals in India. No revenue or volume threshold; Significant Data Fiduciaries (designated by the government on volume and risk) have extra duties (DPO in India, annual DPIA and audit).

What are the penalties under India DPDP Act?

Schedule to the Act: up to INR 250 crore for failing to take reasonable security safeguards to prevent a breach; up to INR 200 crore for failing to notify a breach or breaching children's-data obligations; up to INR 150 crore for Significant Data Fiduciary obligations; up to INR 50 crore for other breaches. Imposed by the Data Protection Board.

India DPDP Act

Enacted India · In force Nov 13, 2025 · next deadline Nov 13, 2026 (in 17 days)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

Transition endsNov 13 · in 17 days · Source

Consent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.

ComplianceMay 13, 2027 · in 7 months · Source

Main data fiduciary obligations apply (18 months)Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.

Already passed

Takes effectNov 13, 2025 · 11 months ago · Source

DPDP Rules published; Board and procedural rules in forceRules 1, 2 and 17-21 (Data Protection Board constitution and functioning) take effect on publication in the Official Gazette.

Summaries for reference, not legal advice. Check the official text.

What it does

India's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.

Who it applies to: Processing of digital personal data in India, and processing outside India connected with offering goods or services to data principals in India. No revenue or volume threshold; Significant Data Fiduciaries (designated by the government on volume and risk) have extra duties (DPO in India, annual DPIA and audit).
Penalties: Schedule to the Act: up to INR 250 crore for failing to take reasonable security safeguards to prevent a breach; up to INR 200 crore for failing to notify a breach or breaching children's-data obligations; up to INR 150 crore for Significant Data Fiduciary obligations; up to INR 50 crore for other breaches. Imposed by the Data Protection Board.
Enforced by: Data Protection Board of India (MeitY)
Official name: Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025
Citation: Act No. 22 of 2023; DPDP Rules 2025 G.S.R. 846(E) (13 Nov 2025); Act commencement notification G.S.R. 843(E)
Topics: Privacy, Children, Breach notification

Verified 2026-09-22 meity.gov.in dpdprules.org

Research notes

Fact-check 2026-09-22 against the eGazette PDF: Gazette of India Extraordinary No. 760, Part II Section 3(i), dated Thursday 13 November 2025, G.S.R. 846(E). The eGazette ID CG-DL-E-14112025-267650 reflects upload on 14 Nov 2025, which is why some sources cite 14 Nov; the publication date is 13 Nov 2025. Rule 1(3) and 1(4) run 'one year' and 'eighteen months after the date of publication of this Gazette', giving 13 Nov 2026 and 13 May 2027. Corrigendum G.S.R. 892(E) of 11 Dec 2025 fixed wording only. MeitY consulted in early 2026 on shortening the 18-month runway to 12 months; not notified as of verification. The MeitY page is JavaScript-rendered and could not be read directly; dates come from the Rule 1 text in the gazette.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceAustralia

Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

Questions about India DPDP Act

What are the India DPDP Act compliance deadlines?: Nov 13, 2025: DPDP Rules published; Board and procedural rules in force. Nov 13, 2026: Consent Manager registration rule in force (12 months). May 13, 2027: Main data fiduciary obligations apply (18 months).
When does India DPDP Act take effect?: India DPDP Act took effect on Nov 13, 2025. The next milestone is Nov 13, 2026: Consent Manager registration rule in force (12 months).
Who does India DPDP Act apply to?: Processing of digital personal data in India, and processing outside India connected with offering goods or services to data principals in India. No revenue or volume threshold; Significant Data Fiduciaries (designated by the government on volume and risk) have extra duties (DPO in India, annual DPIA and audit).
What are the penalties under India DPDP Act?: Schedule to the Act: up to INR 250 crore for failing to take reasonable security safeguards to prevent a breach; up to INR 200 crore for failing to notify a breach or breaching children's-data obligations; up to INR 150 crore for Significant Data Fiduciary obligations; up to INR 50 crore for other breaches. Imposed by the Data Protection Board.

Deadlines

What it does

Related