Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP Gap AssessmentGaps mapped to sections and rulesDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this article

Guide

DPDP Act time limits and deadlines 2027: every clock in one table

Every DPDP Act and Rules time limit for 2027 in one table: 72-hour breach report, logs, erasure, grievances, SDFs, Consent Managers, with rule numbers.

By the DPDPAct India team (editorial policy) · Last checked: 17 October 2026 · 7 min read

Quick answer: Core DPDP duties start on 13 May 2027. The only fixed hour count in the Act and Rules is 72 hours, and it applies to the detailed breach report to the Data Protection Board. Everything else is a period in months or years, or "without delay". Telling affected people and the first notice to the Board have no hour count, and access, correction and erasure requests have no fixed response deadline.

People often ask for "the DPDP deadline" as if there were one. There are many clocks, in different rules, with different triggers. This page puts every fixed period from the DPDP Act, 2023 and the 2025 Rules in one table, with the rule number so your legal team can check each line against the Gazette text.

The three dates that start the clocks

The Act and Rules come into force in three steps. Which date applies to you depends on the duty.

13 Nov 2025Publication date. Board and administrative provisions start (Act ss.1(2), 2, 18 to 26, 35, 38 to 43; Rules 1, 2, 17 to 21).
13 Nov 2026One year on. Consent Manager provisions start (Act s.6(9) and s.27(1)(d); Rule 4 and First Schedule).
13 May 2027Eighteen months on. Notice, consent, rights, breach, retention and most other duties start.

The dates 13 November 2026 and 13 May 2027 are computed from the Gazette date of 13 November 2025 printed on the notifications. Some official file records show 14 November 2025, so check the Gazette text before relying on a single day.

Every DPDP time limit, by topic

Fixed periods in the DPDP Act and Rules, with where each one comes from
Time limitWhat it applies toWhereNote
Breach
Without delayTell each affected Data PrincipalRule 7(1)No hour count is set for individuals.
Without delayFirst notice to the Board: what happened, when, where, likely impactRule 7(2)(a)No hour count is set for this notice either.
Within 72 hoursDetailed report to the BoardRule 7(2)(b)Or a longer period the Board allows on a written request. This is the only 72-hour clock.
Data kept and erased
One yearKeep logs and personal data for security (detect, investigate, remedy)Rule 6(1)(e)Unless another law requires a longer period.
At least one year from processingKeep personal data, traffic data and logs for the Seventh Schedule purposes, including processing by a Data ProcessorRule 8(3)A separate duty from Rule 6(1)(e). It still applies after the account is deleted. Erase afterwards unless another law requires longer retention.
Three years of inactivityErase data of e-commerce entities (2 crore or more registered users), online gaming intermediaries (50 lakh or more) and social media intermediaries (2 crore or more)Third ScheduleCounted from the last approach, or the Rules' commencement if later. Exceptions apply for access to the user account and to virtual tokens.
At least 48 hours before erasureWarn the Data Principal that data will be erasedRule 8(2)Applies to the Third Schedule entities above.
Rights and grievances
Not more than 90 daysPublished period for responding to a grievanceRule 14(3); s.13The ceiling is clear. The Rule's drafting is imperfect, so read the Gazette text. Use the grievance route before going to the Board (s.13(3)).
No fixed periodRequests for access, correction or erasuress.11, 12Neither the Act nor the Rules set a response deadline.
At any timeWithdrawal of consents.6(4)Processing must stop within a reasonable time after withdrawal (s.6(6)).
Large companies (Significant Data Fiduciaries only)
Once in every 12 monthsImpact assessment and audit, with a report to the BoardRule 13(1), (2)Applies only after notification as a Significant Data Fiduciary.
Consent Managers
At least seven yearsKeep consent and sharing recordsFirst Schedule, Part B, item 4(c)Minimum period.
Enforcement
Six months, extendable by up to three months at a timeBoard inquiry to be completedRule 19(9)The Board can extend in blocks of up to three months.
60 daysAppeal to the Appellate Tribunal (TDSAT)s.29(2), (3)Read the Act for the full appeal procedure.

RBI, SEBI, CERT-In and other sector regulators set their own time limits. They are not covered here. Check your own regulator's rules.

Download this table as a one-page PDF Free, no sign-up.

Three common mix-ups

1. 72 hours is not for individuals

Telling affected people (Rule 7(1)) and the first notice to the Board (Rule 7(2)(a)) are both "without delay". Only the detailed report to the Board (Rule 7(2)(b)) has the 72-hour limit, and the Board can allow a longer period on a written request. For the full breach workflow, see our guide to reporting a DPDP data breach.

2. There are two one-year rules

Rule 6(1)(e) is a security rule: keep logs and personal data for one year so you can detect, investigate and remedy unauthorised access. Rule 8(3) is a separate minimum: keep personal data, traffic data and logs for at least one year from the date of processing, for the Seventh Schedule purposes. It also covers a Data Processor acting for you. See our retention and erasure mapping guide.

3. No deadline for rights requests

Neither the Act nor the Rules set a response deadline for access, correction or erasure requests (ss.11, 12). The only cap is on the grievance process: the published response period must not exceed 90 days (Rule 14(3)).

Status check, 17 October 2026

As of 17 October 2026, we found no official notification of any Significant Data Fiduciary, any appointed Data Protection Board Chairperson or Member, an open Consent Manager registration process, or any change to the commencement dates. This is a search finding, not an official statement. We will re-check on and after 13 November 2026. Compare dates in your own plan with our DPDP compliance timeline.

Frequently asked questions

What is the time limit to report a data breach under the DPDP Act?
The DPDP Rules set two steps. You must tell affected people and the Data Protection Board without delay. The detailed report to the Board is due within 72 hours, or a longer period the Board allows on a written request (Rule 7).
Is the 72-hour limit for telling affected individuals?
No. The 72 hours applies only to the detailed report to the Board. For affected Data Principals the Rules say "without delay" and give no hour count.
When do the DPDP Act duties start?
Most duties start on 13 May 2027, eighteen months after the Gazette date of 13 November 2025. Consent Manager provisions start one year after, on 13 November 2026. Both dates are computed from the Gazette date.
Is there a deadline to respond to access, correction or erasure requests?
The Act and Rules set no fixed deadline for these requests. They do require a grievance process, and the published response period for grievances must not exceed 90 days (Rule 14(3)).
How long must logs be kept under the DPDP Rules?
At least one year. Rule 6(1)(e) requires logs and personal data to be kept for one year for security. Rule 8(3) separately requires a minimum of one year from the date of processing for the Seventh Schedule purposes. Another law may require longer.

Sources

This guide is for education and is not legal advice (see our disclaimer). Rule and section references follow the English Gazette text, as corrected by G.S.R. 892(E). Laws and notifications change, so check the current text and speak to a qualified lawyer before you act. Last checked: 17 October 2026. Version 1.0.

Guidance, not legal advice. dpdpactindia.in is an independent resource, not affiliated with the Government of India. Confirm specifics against the enacted Act and Rules.

Related sections

Keep reading

How to report a DPDP data breachDPDP compliance timelineRetention and erasure mappingReadiness assessment