DPDP Act Compliance Roadmap 2026: Rules, Deadlines, Penalties

ByJurisAxios

The DPDP Act compliance clock is running. The Digital Personal Data Protection Act, 2023 became operational when the DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025, with phased commencement ending in May 2027. This article sets out the position as of October 2026 and what businesses should do now.

Where the law stands in 2026

The Act received assent on 11 August 2023 but lay dormant until the Rules arrived. Rule 1(2) to (4) set three phases: Rules 1, 2 and 17 to 21 (definitions and the Data Protection Board of India) took effect on publication; Rule 4 on Consent Managers commences on 13 November 2026; and Rules 3, 5 to 16, 22 and 23, carrying the substantive obligations, commence on 13 May 2027.

Two caveats apply. In January 2026 MeitY proposed a twelve-month window for SDFs and immediate enforcement of the cross-border provisions in Rules 13(4) and 15; that proposal had not been notified by October 2026. MeitY invited applications for the Board’s Chairperson and Members only in May 2026, and appointments were still awaited in August 2026.

Section 6 sets the consent standard and Rule 3 governs the notice, which must stand on its own, use plain language, itemise the personal data and purpose, and link to the means of withdrawing consent, exercising rights and complaining to the Board.

The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action.

Section 6(1), DPDP Act, 2023

Consent Managers are a new regulated intermediary. Under Rule 4 and the First Schedule, one must be an Indian company registered with the Board, with a net worth of at least ₹2 crore, offering an interoperable platform to give, review and withdraw consent. Using one is optional, but integration should be planned before registration opens in November 2026.

Rights of Data Principals

Sections 11 to 14 give every Data Principal the right to access a summary of data processed, to correction and erasure, to grievance redressal, and to nominate a person to act on death or incapacity. Rule 14 requires every Data Fiduciary to publish how rights can be exercised and to respond within ninety days. Data Principals owe duties too, with a penalty of up to ₹10,000 for frivolous complaints.

Children’s data and verifiable parental consent

A child is anyone under eighteen. Section 9 requires verifiable consent of a parent or lawful guardian, prohibits processing likely to harm the child, and bars tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 permits verification through reliable identity and age details already held, details voluntarily provided, or a virtual token such as a Digital Locker credential. The Fourth Schedule exempts clinical establishments, schools, crèches and transport providers acting for health, education or safety.

Significant Data Fiduciary obligations

Under Section 10 the Central Government may notify a Data Fiduciary or class as a Significant Data Fiduciary (SDF), weighing the volume and sensitivity of data, risk to Data Principals, sovereignty and security. None had been notified as of October 2026. An SDF must appoint a Data Protection Officer based in India, engage an independent data auditor and, under Rule 13, conduct a Data Protection Impact Assessment and audit every twelve months. It must also verify that algorithmic software poses no risk to Data Principals’ rights and keep personal data specified by the Government within India.

Breach notification, safeguards and penalties

Section 8(6) obliges every Data Fiduciary to intimate a breach to the Board and each affected Data Principal. Under Rule 7, individuals must be told without delay, in plain language, what happened, the consequences, the mitigation taken and whom to contact. The Board receives an initial description without delay and a detailed report within seventy-two hours, extendable only on written request. Rule 6 separately prescribes minimum safeguards: encryption or masking, access control, logging, backups and contractual flow-downs to processors, with logs kept for one year.

The Schedule to the Act, applied by Section 33, caps penalties at ₹250 crore for failing to maintain security safeguards, ₹200 crore for failing to notify a breach, ₹200 crore for children’s data defaults, ₹150 crore for SDF defaults and ₹50 crore for other contraventions. Appeals lie to the TDSAT under Section 29 within sixty days.

A practical DPDP roadmap for SMEs

The Act has no turnover threshold, so a clinic, school or start-up is a Data Fiduciary like any large platform. A proportionate programme looks like this:

  1. Map your data: what you hold, why you process it, who receives it and where it is stored.
  2. Fix a lawful basis for each purpose: consent under Section 6 or a legitimate use under Section 7.
  3. Rewrite privacy notices to meet Rule 3, with a working withdrawal link.
  4. Publish a grievance contact under Rule 9 and build a ninety-day workflow for rights requests.
  5. Implement Rule 6 safeguards, amend vendor contracts and draft a breach plan that can meet the seventy-two-hour deadline.

Compliance is a governance project as much as a technology one. Processing agreements and sectoral overlap fall within the firm’s corporate advisory practice. For advice on your own matter, you may contact the firm.

Frequently asked questions

Does the DPDP Act apply to small businesses?

Yes. The Act applies to anyone processing digital personal data in India, with no turnover or headcount threshold. The Central Government may exempt notified classes, including start-ups, under Section 17(3), but no exemption should be assumed.

When do the main DPDP Rules obligations commence?

Rule 1(2) staggers commencement: Board-related rules took effect on 13 November 2025, Rule 4 on Consent Managers commences on 13 November 2026, and the substantive rules on notice, security, breach reporting, children and rights commence on 13 May 2027 unless amended.

Must every breach be reported to the Board?

Yes. Section 8(6) requires intimation to the Board and each affected Data Principal of any personal data breach, defined broadly to cover unauthorised access, disclosure, loss or alteration, and Rule 7 sets the seventy-two-hour reporting timeline.

Can a company be fined before the Board is functioning?

No. Penalties under Section 33 are imposed only by the Board after an inquiry, so none can be levied until it is constituted and the relevant obligations have commenced. Treat the interim as preparation time, not a reprieve.

Sources

This article is general information on the law as of 1 October 2026 and is not legal advice. Dates may change by notification; verify the current position or seek professional advice before acting.

Similar Posts