# DPDP compliance deadline: 13 May 2027, and what 13 November 2026 changes

> The DPDP Act and Rules commence in three steps: the Board and rule-making powers on 13 November 2025, the Consent Manager regime on 13 November 2026, and every remaining duty on 13 May 2027. For an ordinary Data Fiduciary, 13 May 2027 is the deadline; the SPDI Rules bind body corporates until then, and a reported proposal to bring dates forward had not been notified as of 25 October 2026.

Source: https://dpdp.commons.inc/dpdp-timeline · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

For almost every organisation the DPDP compliance deadline is 13 May 2027. On that day every remaining provision of the Act commences, together with most of the Rules, with no further run-in. The changes on 13 November 2026 concern only Consent Managers: registration opens and the Data Protection Board gains power over registration conditions (s. 6(9), s. 27(1)(d), Rule 4). Until 13 May 2027 body corporates remain bound by the 2011 SPDI Rules. From 1 November 2026 that leaves about 27 weeks, and we recommend an internal go-live of Monday 12 April 2027.

Starting after November? Go to [Starting late](#starting-late-1-january-or-1-march-2027). Like the Act (s. 2(y)), we say "she" and "her" for every person.

**Jump to what you need.**

- **Everyone:** [The three dates, provision by provision](#the-three-dates-provision-by-provision), [What has to work on 13 May 2027](#what-has-to-work-on-13-may-2027).
- **Small NGOs, foundations and startups:** [Plan for a small organisation](#plan-for-a-small-organisation).
- **CFOs, COOs and programme directors:** [Plan for a large organisation](#plan-for-a-large-organisation), [Starting late](#starting-late-1-january-or-1-march-2027).
- **SaaS companies and vendors:** [Route for SaaS companies and vendors](#route-for-saas-companies-and-vendors).
- **Legal and DPOs:** [The rules that bind you until May](#the-rules-that-bind-you-until-may-2027), [Where the dates are unclear](#where-the-dates-are-unclear).

## The three dates, provision by provision

The Act lets the government bring provisions into force on different dates, and a provision's reference to "the commencement of this Act" means the date that provision itself comes into force (s. 1(2)). On 13 November 2025 it issued commencement notification G.S.R. 843(E) for the Act and notified the Rules as G.S.R. 846(E), as corrected by G.S.R. 892(E), whose Rule 1 sets their dates.

| Date | Act provisions | Rules | What it means in practice |
|---|---|---|---|
| 13 November 2025 (in force) | s. 2 (definitions); ss. 18–26 (the Board, its members, officers and proceedings); s. 35 (good faith); ss. 38–43 (other laws, bar on civil courts, rule-making, amending the Schedule, removing difficulties); s. 44(1) (TDSAT as appellate tribunal) and s. 44(3) (RTI amendment) | Rules 1, 2, 17–21, with the Fifth and Sixth Schedules | The Board exists in law and can be staffed. The RTI Act's personal-information exemption has already changed. No fiduciary duties yet. |
| 13 November 2026 | s. 6(9) (registration of Consent Managers); s. 27(1)(d) (Board's power over breaches of registration conditions) | Rule 4, with the First Schedule | Companies can apply to register as Consent Managers. Nothing changes for an ordinary fiduciary. |
| 13 May 2027 | Everything else: ss. 3–17 (scope, grounds, notice, consent, legitimate uses, fiduciary duties, children, SDFs, rights, individuals' duties, transfers, exemptions), the rest of s. 27, ss. 28–34, 36, 37 and the penalty Schedule, and s. 44(2) (omits IT Act s. 43A) | Rules 3, 5–16, 22, 23, with the Second, Third, Fourth and Seventh Schedules | Every duty a fiduciary has. The SPDI Rules fall away with s. 43A. |

Because s. 1(2) ties each "commencement" to the provision concerned:

- section 5(2), which covers consent given "before the date of commencement of this Act", reaches consent collected right up to 12 May 2027 (see [Where the dates are unclear](#where-the-dates-are-unclear));
- the power to exempt any class from any provision for a period (s. 17(5)) runs until five years after s. 17 commences, so until May 2032;
- the power to remove difficulties by order (s. 43) commenced in November 2025 and lasts three years, until November 2028 (s. 43(2)).

That power has been used once. The DPDP (Removal of Difficulties) Order, 2026, dated 5 October 2026, corrects wording in s. 9(1) ("child or of a person with disability") and s. 10(2)(c)(ii) ("data audit"). It adds no duty and moves no date ([SCC Online](https://www.scconline.com/blog/post/2026/10/15/dpdp-removal-of-difficulties-order-2026/)). No s. 17(3) or s. 17(5) exemption has been made, and no Significant Data Fiduciary has been notified, as of 25 October 2026.

## What changes on 13 November 2026

The changes are about Consent Managers. A company incorporated in India with a net worth of at least ₹2 crore, and a platform independently certified against standards the Board will publish, can apply to register (Rule 4, First Schedule Part A). From the same day the Board can inquire into a breach of a registration condition and "impose penalty as provided in this Act" (s. 27(1)(d)), although the penalty provisions themselves (s. 33 and the Schedule) start on 13 May 2027.

No notice, consent, security, breach-reporting, children's-data, retention or rights duty applies to an ordinary fiduciary on that day. Even a person's right to use a Consent Manager with a fiduciary (s. 6(7)) waits until May 2027. As of 25 October 2026 we have found no Board appointments announced ([LiveLaw](https://www.livelaw.in/articles/india-data-protection-board-established-law-543751)), so registrations may lag the date; see [Consent Managers under DPDP](/dpdp-consent-managers).

For most organisations, 13 November 2026 is useful as a fixed point six months out: a natural date for a board or trustee meeting that approves the plan below.

## The 12-month proposal, and why to plan with slack

In January 2026 MeitY reportedly discussed with industry cutting the eighteen-month window to twelve, at least for Significant Data Fiduciaries, and bringing some provisions forward, including the cross-border rules. One analysis describes the SDF deadline moving to 13 November 2026 and the SDF cross-border restrictions (Rules 13(4) and 15) taking effect immediately ([S.S. Rana, via Mondaq](https://www.mondaq.com/india/data-protection/1773554/meity-plans-to-cut-short-dpdp-compliance-timeline-and-notify-cross-border-restrictions-for-sdfs)). Reports differ on the scope ([Business Standard](https://www.business-standard.com/technology/tech-news/meity-may-cut-compliance-timeline-for-key-dpdp-rules-to-12-months-126012201293_1.html)). As of 25 October 2026 we have found no draft or amending notification.

How much warning would you get? The Rules' dates sit in Rule 1, and rules can only be made "subject to the condition of previous publication" (s. 40(1)), which normally means a draft open for comment. The Act's dates sit in a commencement notification under s. 1(2), which carries no such condition. Our view: you would probably see a draft before any change to the Rules' dates, but you should not count on more than a few weeks.

We recommend building in slack:

- **A date buffer.** Treat Monday 12 April 2027 as go-live. The last month then absorbs slippage, holidays and the financial year-end.
- **A risk order.** Do first what would hurt most if a date moved: security safeguards (s. 8(5), Rule 6; up to ₹250 crore), breach notice (s. 8(6), Rule 7; up to ₹200 crore) and children's data (s. 9, Rule 10; up to ₹200 crore).
- **A change trigger.** Name one person to check the Gazette and MeitY's site each week, with authority to recut the plan within five working days if a draft appears.

## The rules that bind you until May 2027

**The SPDI Rules.** Section 43A of the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 stay in force until s. 44(2) omits section 43A on 13 May 2027. Until then a body corporate that handles sensitive personal data, such as passwords, financial information, health records and biometrics, must:

- publish a privacy policy (SPDI Rule 4);
- take written consent for collecting sensitive data, and appoint a grievance officer who resolves complaints within one month (Rule 5);
- get the person's prior permission before disclosing it, unless the contract permits the disclosure or it is needed for a legal obligation; government agencies may obtain it for lawful purposes (Rule 6);
- keep reasonable security practices, with IS/ISO/IEC 27001 named as one acceptable standard, audited at least once a year by an approved auditor (Rule 8, Rule 8(4)).

A body corporate that is negligent with such data and causes wrongful loss can be ordered to pay compensation (IT Act s. 43A). A "body corporate" there is a company, firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. Our view: section 8 companies are inside it; whether a charitable trust or society is inside depends on its activities, so take advice rather than assume. Disclosing personal information in breach of a lawful contract remains an offence under IT Act s. 72A.

We recommend designing notices and consent to the DPDP standard now and checking that the result also satisfies SPDI Rule 5. Two consent designs for six months make no sense.

**CERT-In and sector regulators.** The [CERT-In Directions](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) of 28 April 2022 already require covered entities to report specified incidents within six hours and keep ICT logs for 180 days in India (CERT-In's FAQs of May 2022 suggest a copy may be held abroad if it can be produced in reasonable time, but commentators read this differently, so keep a copy in India); non-compliance can lead to action under s. 70B(7) of the IT Act. RBI, SEBI, IRDAI and others keep their own rules, and stricter transfer rules survive the DPDP Act (s. 16(2)). See [DPDP breach response](/dpdp-breach-response) for running every clock from one playbook.

## What has to work on 13 May 2027

Most duties apply from the first day. A few run on their own clocks.

| Must work from 13 May 2027 | Runs on its own clock |
|---|---|
| A Rule 3 notice before or with every new consent request, available in English or an Eighth Schedule language (s. 5(1), 5(3), 6(3)) | Notices for consent given before 13 May 2027: "as soon as it is reasonably practicable" (s. 5(2)) |
| Consent that is free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the data needed, with withdrawal as easy as giving it (s. 6(1), 6(4)) | Third Schedule erasure for large e-commerce, gaming and social media platforms: three years from the person's last contact, or from commencement of the Rules, whichever is latest. The text does not say which commencement; our reading is 13 May 2027, when Rule 8 starts |
| Rule 6 security safeguards, including logs and backups | Rule 8(3) minimum one-year retention of personal data, traffic data and logs, from each processing |
| Breach notice to each affected person and the Board, and the 72-hour report (Rule 7) | SDF assessment and audit: every twelve months from notification (Rule 13(1)) |
| Verifiable parental consent before processing a child's data (s. 9(1), Rule 10) | Grievance replies: within your published period, at most 90 days (Rule 14(3)) |
| Published contact person and rights-request route (s. 8(9), Rule 9, Rule 14(1)) | |
| Processor contracts in place (s. 8(2)) | |

Our view: have the s. 5(2) notice campaign ready to send in the week of 13 May, since "reasonably practicable" will be judged against eighteen months of notice. [The data you already hold](/dpdp-existing-data) covers that campaign.

## The RTI change is already live

Section 44(3) has applied since 13 November 2025: it replaced RTI Act s. 8(1)(j) with "information which relates to personal information", dropping the clause's own public-interest test, and whether the old proviso survives is unsettled. Petitions challenging it, including Venkatesh Nayak v. Union of India, W.P.(C) 177/2026, were referred to a larger bench of the Supreme Court on 16 February 2026 and a stay was refused, so the amended clause applies meanwhile ([LiveLaw](https://www.livelaw.in/amp/top-stories/supreme-court-refers-pleas-challenging-dpdp-act-amendment-to-rti-act-to-larger-bench-523266)). It matters to public authorities under the RTI Act, which can include NGOs substantially financed by government (RTI s. 2(h)), and to anyone filing RTI requests for personal information.

## Dated plans from 2 November 2026

The plans below are our planning assumptions, not legal requirements. Every plan converges on the same two dates: internal go-live on Monday 12 April 2027 and publication on Thursday 13 May 2027.

### Plan for a small organisation

For an NGO, foundation or startup of up to about 50 staff, with one person who can give it a day or two a week.

| By | Done | Owner |
|---|---|---|
| Fri 6 Nov 2026 | One accountable person named, with time in her week; the director signs off this calendar | Director |
| Fri 27 Nov 2026 | A list of every place personal data lives: forms, spreadsheets, WhatsApp groups, apps, email, vendors, paper that gets photographed | Accountable person, with each team |
| Fri 18 Dec 2026 | For each purpose: the data used, the basis (consent or a named s. 7 use), and a retention period | Accountable person |
| Fri 15 Jan 2027 | Access lockdown: open sharing links closed, shared logins ended, leavers removed, a written WhatsApp rule; parent-verification method chosen if you serve children | IT lead; programme lead |
| Fri 29 Jan 2027 | Itemised notices drafted for each programme or product, in Hindi or the Scheduled language your people use, with audio where needed | Accountable person, field or product lead |
| Fri 12 Feb 2027 | Processing contracts sent to the three or four vendors that hold most data | Director |
| Fri 26 Feb 2027 | One-page breach plan, rehearsed once on a made-up incident | Director and accountable person |
| Fri 12 Mar 2027 | New notices and consent tested at every collection point; records keep notice version, date and decision | Field or product lead |
| Fri 26 Mar 2027 | A request and grievance inbox with a simple tracker; response period decided (90 days at most) | Operations |
| Mon 12 Apr 2027 | Go-live: contracts signed, staff briefed, s. 5(2) notices ready | Director |
| 12 Apr – 12 May 2027 | Buffer: fix what broke; run one test access request end to end | Accountable person |
| Thu 13 May 2027 | Contact details, request route and grievance period published (Rule 9, Rule 14); s. 5(2) notices start | Accountable person |

For the social-sector version of this work, see [DPDP for NGOs](/dpdp-for-nonprofits).

### Plan for a large organisation

For a company, group or large foundation with many systems, hundreds or thousands of staff and many vendors. The person-weeks are our estimates of internal and adviser effort for an organisation with roughly 20 to 60 systems holding personal data; scale them to your own count.

| Phase and dates | Milestones | Owner | Effort (person-weeks) |
|---|---|---|---|
| Mobilise: Mon 2 Nov – Fri 27 Nov 2026 | Executive owner and steering group by Fri 13 Nov; board or trustees approve plan and budget by Fri 27 Nov; gap assessment started | CEO, board | 3–5 |
| Map: 16 Nov 2026 – Fri 22 Jan 2027 | Data map across systems, vendors, partners, HR and digitised paper; record of processing by purpose | Data owners | 10–20 |
| Decide: 4 Jan – Fri 12 Feb 2027 | Basis for each purpose, including employee data and monitoring; retention schedule; roles agreed with partners and group companies | Legal, HR, business heads | 5–8 |
| Design: 18 Jan – Fri 26 Feb 2027 | Rule 3 notices in the languages needed; consent and withdrawal flows; rights and grievance process; parent verification | Legal, product, programmes | 6–10 |
| Secure: 2 Nov 2026 – Fri 12 Mar 2027 | Rule 6 controls mapped and evidenced: encryption, access control, logging, backups, one-year log retention, processor security terms | CISO | 10–25 |
| Contract: 7 Dec 2026 – Fri 2 Apr 2027 | Processor and partner contracts signed, largest data holders first | Procurement, legal | 6–12 |
| Build: 1 Feb – Fri 2 Apr 2027 | Consent capture live in test; withdrawal reaches every downstream system; rights queue; erasure jobs | IT, product | 12–30 |
| Year-end: Wed 31 Mar 2027 | FY 2027–28 budget carries the run costs: DPO time, grievance desk, audits | CFO | 1 |
| Drill: week of Mon 12 Apr 2027 | Go-live on main collection points; breach drill against Rule 7 and CERT-In timings; one end-to-end access request | CISO, legal, comms, operations | 2–3 |
| Confirm: 19 Apr – Wed 12 May 2027 | Gap assessment re-run; residual risks closed or accepted in writing; s. 5(2) campaign loaded | Executive owner | 2–4 |
| Thu 13 May 2027 | Contact and grievance details published; s. 5(2) campaign starts; first monthly report to the board | Executive owner | — |

Our estimate of the total is 57 to 118 person-weeks, roughly 2 to 4.5 full-time people over the six months. The phases overlap on purpose. The critical path runs from the data map to the basis decisions, to the notices, to the build. If the map slips past 22 January, protect the April drill and cut scope elsewhere. The [DPDP compliance checklist](/dpdp-compliance-checklist) lists the controls this plan should produce.

### Route for SaaS companies and vendors

Your customers' deadline becomes yours earlier, because they need signed terms from you before 13 May 2027 (s. 8(1), 8(2)). Expect their DPAs and security questionnaires from January.

| By | Done |
|---|---|
| Fri 4 Dec 2026 | Role decided for each product and data set: processor for customer data, fiduciary for your own employees, leads, cookies and any purpose you decide yourself |
| Fri 15 Jan 2027 | A standard DPDP processing addendum; Rule 6 controls mapped with evidence; sub-processor list with flow-down terms |
| Fri 29 Jan 2027 | An answer bank for security questionnaires; a stated breach-notice commitment to customers in hours, with the facts they need for Rule 7 |
| Fri 26 Feb 2027 | Erasure on instruction and at contract end, with confirmation (s. 8(7)(b)); support for customers' rights requests |
| Feb – Apr 2027 | Customer negotiations, largest accounts first; your own fiduciary data on the small-organisation plan above |

See [DPDP for SaaS startups](/dpdp-for-startups) and [processor contracts](/dpdp-processor-contracts).

## Starting late: 1 January or 1 March 2027

Three items are never cut, whatever the start date: security safeguards (Rule 6), breach readiness (a playbook and one rehearsal against Rule 7) and verifiable parental consent if you process children's data (s. 9(1), Rule 10). They carry the largest penalties and cannot be fixed after the event.

**Starting Monday 4 January 2027 (about 18 weeks).** Cut the data map to the systems that hold most people's data and every system that holds children's, health or financial data. Write full notices in English and your main Scheduled language first, and finish the other languages your people need after May. Negotiate full terms with the five largest processors before May and the rest by August.

| By | Done |
|---|---|
| Fri 15 Jan 2027 | Owner named; board approval; security gaps listed and fixes started |
| Fri 12 Feb 2027 | Priority data map; basis for each purpose; breach playbook written |
| Fri 12 Mar 2027 | Notices and consent designed; parent verification chosen; contracts sent |
| Fri 9 Apr 2027 | Breach rehearsal held; consent live at main collection points |
| Thu 13 May 2027 | Contact, request and grievance details published; s. 5(2) campaign ready |

**Starting Monday 1 March 2027 (about 10 weeks).** Our view: run the minimum a regulator would expect to see. Defer retention automation, secondary languages, lower-risk vendor contracts and the full map, and record each deferral with a date in a board-approved plan.

**Deferral is an accepted risk, not compliance.** Using any processor after 13 May 2027 without a valid contract breaches s. 8(2) from the first day, so put at least a short DPDP addendum or side letter in place with every processor before 13 May, under either late start, and negotiate full terms afterwards. Likewise, every notice and consent request must offer English or an Eighth Schedule language from day one (s. 5(3), 6(3)); a deferred language is a gap you have chosen to carry for the people who need it.

| By | Done |
|---|---|
| Fri 12 Mar 2027 | Owner named; access lockdown; breach playbook in draft |
| Fri 26 Mar 2027 | Notices for the main collection points; children's data identified and parent verification chosen |
| Fri 16 Apr 2027 | Breach rehearsal; contracts with the largest processors sent |
| Fri 7 May 2027 | Request and grievance inbox; consent live where data enters |
| Thu 13 May 2027 | Contact and grievance details published; dated plan for the deferred items approved |

## Where the dates are unclear

These are our positions until the government, the Board or a court says otherwise.

**Can the Board register Consent Managers before its Members are appointed?** In practice, no. *Why:* registration is a decision of the Board after inquiry (Rule 4(2)), and the saving for vacancies (s. 23(2)(a)) protects acts of a constituted Board, which presupposes members. *Would change if:* appointments are made and the Board publishes its forms and framework. *Confidence:* medium.

**Is consent collected before 13 May 2027 covered by s. 5(2)?** Yes, on our reading. *Why:* s. 1(2) ties "commencement" in s. 5(2) to section 5's own commencement, so consent collected in, say, March 2027 is pre-commencement consent, and you may continue on it until withdrawn (s. 5(2)(b)). That reading also suggests such consent might not have to meet s. 6(1) in substance, since s. 6 was not in force when it was given. The Board may disagree, and we recommend meeting s. 6(1) anyway for anything collected from now on. *Would change if:* the Board or a court reads s. 5(2) more narrowly. *Confidence:* medium.

**Can a s. 5(2) notice sent before 13 May 2027 discharge the duty?** Possibly, if it contains every item s. 5(2)(a) and Rule 3 require and you can prove delivery. *Why:* the Act asks for the notice "as soon as it is reasonably practicable" and does not say it must post-date commencement, but a notice sent in March points to rights and a Board route not yet live. We would still send a short confirming notice after 13 May. *Would change if:* the Board publishes guidance. *Confidence:* low.

**Can you keep processing a child's data after 13 May 2027 on an old consent with no parent verification?** Plan as if you cannot. *Why:* s. 9(1) requires verifiable parental consent "before processing", and processing after 13 May is processing, whenever the data was collected. Section 5(2)(b) permits continued processing on old consent but does not say it displaces s. 9. *Would change if:* the Board reads s. 5(2) as covering children's data. *Confidence:* low.

**Will the deadline move?** Probably not wholesale; bringing individual provisions forward, or a shorter window for SDFs, remains possible. *Why:* no draft or notification has appeared as of 25 October 2026, and any change to Rule 1 needs previous publication (s. 40(1)). *Would change if:* MeitY publishes a draft. *Confidence:* medium.

**What happens to SPDI claims for incidents before 13 May 2027?** They are likely preserved. *Why:* section 6 of the General Clauses Act, 1897 saves rights and liabilities accrued under a repealed Central Act unless a different intention appears, and the Supreme Court has held that an omission is a repeal for this purpose (Fibre Boards (P) Ltd v. CIT, (2015) 10 SCC 333). A five-judge bench took a narrower view in Kolhapur Canesugar Works Ltd v. Union of India (2000), and the conflict is not finally settled. Section 44(2) shows no contrary intention. *Would change if:* a court follows the narrower view, or finds a contrary intention in the DPDP Act. *Confidence:* medium.

## This week

- **Put two dates in the leadership calendar:** a board or trustee meeting in the week of 9 November 2026 that approves your plan, and a go/no-go review on Monday 12 April 2027.
- **Name the accountable owner** and say in writing how much of her time this takes.
- **Start the data map.** Every later step depends on it; see [find every record in four weeks](/dpdp-data-mapping).
- **Ask your three largest vendors** what DPDP terms and breach-notice commitments they will offer, or, if you are the vendor, draft your answers.
- **Assign someone to watch the Gazette** for a draft amendment to Rule 1, SDF notifications, exemptions and the Board's Consent Manager framework.

For what the duties themselves require, read [the DPDP Act and Rules explained](/dpdp-act-guide).

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), commencement notification G.S.R. 843(E) and the DPDP (Removal of Difficulties) Order, 2026, and from the IT Act, the SPDI Rules, 2011, the RTI Act, 2005 and the General Clauses Act, 1897 for the transition. Events after November 2025 come from the linked public reports, last checked 25 October 2026. Dates and effort figures in the plans are our planning assumptions, and statements marked "our view" are our judgement. This guide explains the law; it is not legal advice.
{: .note }

## Questions people ask

### Is there a lighter regime or a later date for startups, small NGOs or MSMEs?

Not today. The Act lets the Central Government exempt notified fiduciaries, including startups, from the notice, accuracy, erasure, SDF and access provisions (s. 17(3)), and lets it switch off any provision for a class for a set period (s. 17(5)). Neither power had been used as of 25 October 2026. Your size affects how much work there is; the date stays the same. Plan for 13 May 2027 unless an exemption is notified that names your class.

### Does a s. 17(5) exemption have to be published in draft first?

No. Section 17(5) works by notification in the Official Gazette (s. 2(r)), which takes effect on publication or on any later date it names. The previous-publication condition in s. 40(1) applies to rules, and s. 41 requires laying before Parliament only for rules and notifications under s. 16 and s. 42. Since s. 17 starts on 13 May 2027, an exemption could arguably be issued earlier but would take effect no earlier than that date (General Clauses Act, s. 22). Do not plan on one; check the Gazette.

### Must we re-collect consent from everyone before May 2027?

No, not as a rule. Where a person consented before 13 May 2027, s. 5(2) asks you to send her a notice as soon as reasonably practicable, and you may continue processing until she withdraws (s. 5(2)(b)). It does not require fresh consent. Data held with no consent at all needs another basis, such as a legitimate use under s. 7, or fresh consent, or erasure. Our view: re-collect where the old consent was bundled or vague and the processing is high-risk, such as children's data or fundraising photographs.

### Who should sign off the DPDP plan: the board or management?

The Act does not say. Its duties fall on the Data Fiduciary as an organisation (s. 2(i), s. 8(1)), and the only officer it names is a Significant Data Fiduciary's DPO, who must be responsible to the board of directors or similar governing body (s. 10(2)(a)(iii)). Our view: management owns and runs the plan, while the board or trustees approve it, its budget and any risks knowingly accepted, and receive a report each quarter. A penalty ceiling of ₹250 crore (Schedule, item 1) is a board-level exposure.

### Do foreign companies serving Indian users have the same deadline?

Yes. The Act reaches processing outside India connected with offering goods or services to people in India (s. 3(b)), and that provision commences on 13 May 2027 with the rest. A software company in Singapore or Dublin selling to Indian schools or consumers should plan to the same calendar as an Indian one. It will also meet Indian customers asking for processor terms well before then.

### Should a government department or public body follow the same calendar?

Yes, with some differences in substance. The State and its instrumentalities have the same commencement dates, but the erasure duties in s. 8(7) and s. 12(3) do not apply to State processing, nor does s. 12(2) where no decision about the person is made (s. 17(4)). Legitimate use s. 7(b) and the Second Schedule standards also start on 13 May 2027. The RTI change in s. 44(3) has applied since November 2025.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start