Guide
DPDP Rules phase dates: what is gazetted
Last verified 16 July 2026
Treat only gazetted dates as enacted. Phase 1 (13 Nov 2025), Phase 2 Consent Manager registration (13 Nov 2026), and Phase 3 core obligations (13 May 2027) are the load-bearing calendar.
01
Gazetted phases
13 November 2025: DPDP Rules notified (G.S.R. 846(E)). The Data Protection Board of India is established. Section 2 definitions and Rules 1, 2, and 17–21 take effect.
13 November 2026: Rule 4 Consent Manager registration and oversight, along with penalties and appeals.
13 May 2027: Rules 3, 5–16, 22, and 23: the core operational obligations for notices, retention, rights, and related duties.
02
Proposed, not gazetted
MeitY proposed in January 2026 compressing the compliance window from 18 to 12 months, which would move the core deadline from 13 May 2027 to 13 November 2026. As of this guide that compression appears proposed, not gazetted.
Sources into mid-2026 still cite May 2027. Do not treat a compressed date as enacted until it appears in the gazette. The DPDPA page keeps the same advisory next to the phase table.
03
How to use these dates
Use the gazetted calendar for programme planning. Use the compression note as a watch item, not as a substitute for the gazette. When a date or citation matters to a filing or board paper, verify against the official notification.
Request access
Early access for teams mapping notices, retention, and rights work to a decision record under the DPDP Rules.