DPDP Compliance Checklist & Rules Timeline

Radiatus Engineering Security Published 31 Oct 2026 16 min read

India’s DPDP Rules phase in on two dates, and much of what has been written about them gets the first one wrong. The consent-manager provisions apply from 13 November 2026; nearly everything else applies from 13 May 2027. This DPDP compliance checklist maps each rule to what an engineering team has to build, and flags what is still uncertain as of 31 October 2026.

This is engineering guidance, not legal advice. It quotes the Act and Rules where it can, but how they apply to you is a question for counsel. Involve a lawyer before relying on any reading here, especially on legitimate uses, retention set by other laws and children’s data.

Key dates at a glance

The DPDP Act, 2023 was enacted on 11 August 2023. The DPDP Rules, 2025 (G.S.R. 846(E)) appeared in the Gazette dated 13 November 2025, and the PIB release of 14 November 2025 describes an “18-month phased compliance timeline”. A commencement notification of the same date, G.S.R. 843(E) (summarised by Taxmann), switches on the Act’s sections in stages. The DPDP Rules timeline:

Rule 1 says Rule 4 commences “one year after the date of publication” and Rules 3, 5 to 16, 22 and 23 “eighteen months after the date of publication” (phasing also set out by S.S. Rana & Co.). Most firms count from the Gazette date; a few count from 14 November and quote 14 May. Plan to the earlier date.

What 13 November 2026 changes, and what it doesn’t

From 13 November every consent manager must be registered with the Board (section 6(9), Rule 4), and the Board can inquire into breaches of registration conditions (section 27(1)(d)). That is the whole change. A consent manager is a registered company that lets people manage consent across many fiduciaries from one platform.

The bar for DPDP consent manager registration sits in the First Schedule: a company incorporated in India, net worth of at least ₹2 crore, an independently certified interoperable platform, no ability to read the data it routes, no sub-contracting, and consent records kept for at least seven years (also summarised in the KPMG guidance). Vendor blogs have stretched this into something it isn’t:

If you are building a consent-manager platform, the First Schedule is your specification. Everyone else should use 13 November to start the May work.

Has the deadline moved to 12 months?

On 22 January 2026 Business Standard reported that MeitY was considering cutting the window for key provisions from 18 months to 12. Coverage differs on scope: Business Standard framed it around Significant Data Fiduciaries, other reports around fiduciaries generally. Feedback was sought by 4 February 2026 (S.S. Rana).

Status as of 31 October 2026: we have found no amending notification. Government answers in Lok Sabha on 5 August 2026 and 12 August 2026 still describe “an eighteen-month transition period”. Treat 13 May 2027 as the DPDP Act deadline and watch the Gazette. Any amendment would arrive with little runway, so do logging, the breach runbook and security fixes first.

Is the Data Protection Board running yet?

On paper, yes. A MeitY circular of 6 May 2026 says the Board has been established under section 18 and invites applications for a Chairperson and four Members; the 12 August answer adds that the advertisement ran in Employment News on 6 June 2026. LiveLaw reported on 1 August 2026 that nobody had been appointed.

Status as of 31 October 2026: we have found no notification appointing a Chairperson or Member. Posts claiming June appointments appear to confuse the advertisement with an appointment. We have also not seen the application particulars Rule 4(1) asks the Board to publish, so how registration will work from 13 November is unclear. For fiduciaries, an empty Board may slow early enforcement; it does not pause the obligations.

Who must comply

Section 3 covers digital personal data processed in India, including paper records digitised later, and processing abroad linked to offering goods or services to people in India. There is no size threshold: a three-doctor clinic with a billing system is in scope.

• Data Fiduciary: decides why and how data is processed, and answers for its processors too (section 8(1)).
• Data Processor: processes on a fiduciary’s behalf under a valid contract (section 8(2)), and meets DPDP mostly through those contracts.
• Most SaaS companies are both: processor for customer data in the product, fiduciary for their own accounts, billing and marketing lists.

Startups. A Lok Sabha answer of 3 December 2025 says the Act and Rules “provide for a simplified compliance framework for start-ups and certain data fiduciaries”. The mechanism is section 17(3), which lets the government switch off sections 5, 8(3), 8(7), 10 and 11 for notified classes. Status as of 31 October 2026: no such notification found. Assume the full Act applies; security and breach reporting are not on that list anyway.

Penalties

The DPDP Act penalty amounts are in its Schedule and restated in the PIB backgrounder of 17 November 2025. Each is a ceiling. The Board fixes the amount after an inquiry, weighing gravity, duration, data type, repetition, mitigation and proportionality (section 33(2)).

Read it as a priority list. A missing field on a notice sits under the ₹50 crore line; a leaked, unencrypted database sits under ₹250 crore, and not reporting it is a separate ₹200 crore line.

The DPDP compliance checklist, rule by rule

Everything below applies from 13 May 2027.

1. Data map and purpose register

Every later item asks which data, for what purpose, kept how long and shared with whom. Answer it once, in a register.

• List every system holding personal data, including backups, spreadsheets, support desks, CCTV recorders and exported WhatsApp chats.
• Per dataset, record purpose, basis (consent or a named legitimate use under section 7), retention with its legal citation, owner and processors.
• Tag personal-data columns in the schema so new tables get caught in code review.

A spreadsheet is fine for a handful of systems. Don’t buy a data-discovery product before one manual pass; you won’t know what to configure.

2. Notice and consent (Rule 3)

Rule 3 requires a standalone notice in plain language with, at minimum, an itemised description of the data, the specified purpose and a specific description of the goods, services or uses enabled, plus links to withdraw consent (as easily as it was given), exercise rights and complain to the Board. Section 5(3) requires it in English or any Eighth Schedule language. Section 6(1) requires consent that is free, specific, informed, unconditional and unambiguous, with a clear affirmative action.

• Version notices like code: ID, version, language and hash, and every consent points at the exact text shown.
• One purpose, one toggle. Bundled consent fails “specific”; pre-ticked boxes fail “affirmative action”.
• Withdrawal is a button, and section 6(6) requires processors to stop too, so it must reach their systems by API or queued job.
• Back-notice existing users. Section 5(2) requires notice to earlier consenters “as soon as it is reasonably practicable”.
• Keep proof. Section 6(10) puts the burden of proving notice and consent on you.

An illustrative consent record for a lab’s patient portal (an example, not from a real system):

{
  "consent_id": "cr_01JC4M7Q9X",
  "principal_ref": "pat_48213",
  "notice": {
    "id": "portal-signup",
    "version": "2027.04.3",
    "language": "ta",
    "sha256": "3b9f…a71c"
  },
  "purposes": [
    { "code": "report_delivery",
      "granted": true },
    { "code": "health_camp_offers",
      "granted": false }
  ],
  "data_items": ["name", "mobile",
    "test_results"],
  "action": "unticked_box_then_submit",
  "captured_at": "2027-04-12T10:41:07+05:30",
  "withdrawn_at": null
}

Store these append-only: a withdrawal is a new event, never an edit. Keep the notice text behind each hash as long as the consent. WhatsApp opt-ins, which Meta’s business messaging policy already expects, are consent events too (see our WhatsApp Business API page).

3. Security safeguards and one-year log retention (Rule 6)

Rule 6’s minimum safeguards, mapped to controls:

• (a) Encryption, masking or tokens: encrypt at rest and in transit, mask data outside production.
• (b) Access control for you and your processors: SSO, MFA, least privilege, access reviews.
• (c) Logs and monitoring that can detect and investigate unauthorised access: record-level “who viewed what”.
• (d) Continued processing after a compromise: backups with tested restores.
• (e) Keep those logs and personal data for one year unless another law says otherwise.
• (f) and (g) Security clauses in processor contracts, and organisational measures that make it all happen.

Two more retention rules sit alongside. Rule 8(3) makes every fiduciary keep personal data, traffic data and processing logs for at least a year from processing, for the State purposes in the Seventh Schedule, and make processors do the same. The CERT-In directions of 28 April 2022, already in force, require ICT logs for a rolling 180 days within Indian jurisdiction and clocks synced to NIC or NPL time. One pipeline can satisfy all three: append-only storage in an Indian region, about 13 months’ retention, and a purge job after that unless a legal hold applies.

Then test it: an external VAPT of the systems in your data map shows whether your safeguards would look “reasonable” to an investigator. Our security & compliance team can turn Rule 6 into a control set.

4. Breach runbook (Rule 7): T0 to T+72h

Under section 2(u) a breach includes unauthorised processing, accidental disclosure and loss of access, so ransomware that encrypts a patient database counts even if nothing was copied. There is no GDPR-style risk threshold: every breach goes to the Board and every affected person is told. The DPDP breach notification timeline:

Prepare in advance: message templates in your users’ languages (pre-approved on WhatsApp, not mid-incident), a query that turns access logs into a list of affected people, a contact sheet for counsel, CERT-In and your cloud provider, and a tabletop exercise twice a year.

5. Retention and erasure (Rule 8): who the three-year rule covers

The general duty is section 8(7): erase data when consent is withdrawn or the purpose is no longer served, unless a law requires keeping it, and make processors erase it too. There is no universal inactivity period, so for most businesses the DPDP data retention period is the one you set per purpose and can defend.

The fixed three-year clock in the Third Schedule applies only to e-commerce entities with at least 2 crore registered users in India, online gaming intermediaries with at least 50 lakh, and social media intermediaries with at least 2 crore. For them, data is erased three years after the person last engaged, except what is needed for account access and stored-value tokens, with at least 48 hours’ warning (Rule 8(2)). Clinics, B2B SaaS and factories are not on that list.

A pattern that handles erasure and the Rule 8(3) one-year minimum together:

1. Each record carries a purpose tag and a retain_until date from the register.
2. On withdrawal or end of purpose, it moves to a restricted, read-logged store.
3. A nightly job hard-deletes from that store, indexes and processors once retain_until passes, unless a legal hold applies. Restores from backup re-apply deletions.

Tax, medical and employment laws often require longer periods. Cite them in the register; “we might need it” is not a citation.

6. Rights requests and grievances within 90 days (Rules 9 and 14)

People can ask for a summary of their data and who it was shared with (section 11), correction and erasure (section 12), grievance redressal (section 13) and a nominee (section 14). Rule 14 requires you to publish how to ask, which identifier you need, and a grievance response period of no more than 90 days. Rule 9 requires a published contact, repeated in every response. People must use your route before the Board (section 13(3)), so a working process keeps complaints in-house.

• A form that captures request type and identifier and verifies identity, usually by OTP to the registered mobile.
• A ticket per request with an SLA timer. Publish a period well under 90 days; 30 leaves room for hard cases.
• An export job that builds the access summary, including processors, from the data map.

7. Children’s data (Rule 10)

A child is anyone under 18 (section 2(f)). You need verifiable parental consent, checking the parent is an identifiable adult from details you already hold or a token from an authorised entity such as a DigiLocker provider. Section 9(3) bans tracking, behavioural monitoring and targeted advertising directed at children.

The Fourth Schedule exempts clinical establishments and healthcare professionals for health services, schools for education and safety, and crèches and school transport for safety. The exemption covers that purpose only: a hospital’s marketing message to a 15-year-old is not a health service. Build an age question, a parent-verification flow and an is_child flag that switches off analytics pixels and ad audiences.

8. Vendor and processor contracts

You answer for your processors, so every data-processing agreement needs:

• Rule 6 safeguards, with a right to evidence such as audit or pentest reports.
• Breach notice to you within hours, so you can meet “without delay”.
• Erasure on instruction and at exit (section 8(7)(b)), plus the Rule 8(3) one-year retention, whose own illustration uses a cloud host.
• Help with rights requests, and a sub-processor list you can disclose.

9. Significant Data Fiduciaries (Rule 13)

Under section 10 the government can designate fiduciaries as significant, weighing factors such as data volume and sensitivity and risk to people’s rights. An SDF needs a DPO based in India and an independent data auditor, and under Rule 13 a DPIA and audit every 12 months reported to the Board, due diligence on algorithmic software, and localisation of government-specified data.

Status as of 31 October 2026: we have not seen a notification designating any SDF. Most SMEs never will be one, but if you sell to large banks, insurers or platforms, expect their duties to reach you as audit questions.

Sector notes

Clinics, hospitals and labs

The DPDP Act for hospitals has fewer special rules than people expect. There is no separate sensitive-data class, but breach impact is high, so plan around the ₹250 crore security ceiling. Section 7 covers medical emergencies (7(f)) and epidemics (7(g)); routine care usually rests on consent or data the patient voluntarily gave for that purpose (7(a)). Ask counsel which basis you use, and record it. A report sent to the registered mobile is one purpose; a health-camp offer to the same number is another, with its own consent. Referring doctors who log in to see results need Rule 6 access control and logging.

Our own PathLab Software (barcode accession, analyser interfacing, ABDM integration, WhatsApp report delivery) is the kind of system this section describes, and our Appointment Reminder App keeps consent records for WhatsApp and SMS reminders. More on our healthcare work.

SaaS companies

Expect enterprise DPDP questionnaires on data location, Rule 6 controls, breach notice times, deletion at exit and sub-processors. Per-tenant export and deletion must be real features, not a script. If you process data about people outside India under a contract with a foreign customer, section 17(1)(d) disapplies Chapter III and most of Chapter II, but not sections 8(1) and 8(5): security safeguards and the ₹250 crore ceiling still apply. More on our SaaS page.

Manufacturers: employee and CCTV data

Section 7(i) allows processing for employment purposes without consent, generally read to cover payroll, attendance and site access, but not everything HR does. Digital CCTV footage of identifiable people is personal data: set retention per camera zone, restrict exports and log them. Biometric attendance templates belong in the register. Labour contractors and security agencies handling worker or visitor data need contracts. If you are adding AI to HR or shop-floor workflows, write the purpose register into the requirements first; see AI automation in Tamil Nadu and our manufacturing page.

A six-month plan, November 2026 to May 2027

For a small team starting from scratch, this order front-loads the highest penalties and the work everything else depends on.

Much of this overlaps ISO 27001 Annex A, so run one programme, not two; see our ISO 27001 readiness checklist and ISO compliance service. Our GRC Platform keeps policies, controls and evidence together, so the May evidence pack is an export, and GRC & risk management helps set up the method. Radiatus helps teams prepare; we certify nobody, and the Act creates no compliance certificate for ordinary fiduciaries, so be wary of anyone selling one.

DPDP vs GDPR

A GDPR programme is a good start, but it does not carry over whole:

GDPR references are to the regulation text. Aligning to several frameworks at once? See HIPAA, GDPR & SOC 2.

DPDP compliance FAQ

Do we have to integrate with a consent manager by 13 November 2026?

No. That is when consent managers themselves must register with the Data Protection Board. Section 6(7) says a person may use a consent manager; nothing requires an ordinary data fiduciary to integrate with one.

What is the DPDP Act deadline for most businesses?

13 May 2027, eighteen months after the Rules were published. A reported proposal to shorten this to 12 months had not been notified as of 31 October 2026.

What is the maximum DPDP Act penalty amount?

Up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore each for breach-notification and children’s-data failures, and ₹50 crore for most other breaches.

How long must logs be kept under the DPDP Rules?

At least one year under Rules 6 and 8(3). CERT-In directions separately require ICT logs for a rolling 180 days within India.

Does the three-year erasure rule apply to us?

Only if you are an e-commerce or social media platform with at least 2 crore registered users in India, or an online gaming intermediary with at least 50 lakh. Others erase when consent is withdrawn or the purpose ends, unless a law requires keeping the data.

What is the DPDP breach notification timeline?

Tell the Board and each affected person without delay, then send the Board a detailed report within 72 hours. Reportable cyber incidents also go to CERT-In within six hours.