Blog
13 November 2026 to 13 May 2027: what changes under the DPDP Act, and what does not
Two dates shape the DPDP calendar. On 13 November 2026 the Consent Manager provisions start. On 13 May 2027 the remaining provisions start, including most duties of Data Fiduciaries. This page sets out what begins on each date and how to use the months in between.
In brief: The DPDP Rules came with a phased timeline of eighteen months, according to the PIB release. Under G.S.R. 843(E), the Consent Manager provisions (Rule 4, section 6(9) and section 27(1)(d)) start on 13 November 2026. The remaining provisions, including sections 9 and 10, start on 13 May 2027. So 13 November 2026 is the start date for the Consent Manager framework. It is not the date the main duties begin. A challenge to parts of the Act is before the Supreme Court, and the court has reportedly not granted an interim stay.
What starts on 13 November 2026?
Three provisions start on this date, according to the commencement notification:
- Rule 4 of the DPDP Rules. It covers the registration and obligations of Consent Managers.
- Section 6(9) of the Act. It says every Consent Manager must be registered with the Board, on the conditions the Rules set. See section 6.
- Section 27(1)(d) of the Act. It is the third provision named for this date in the notification.
A Consent Manager is a separate, registered entity that answers to the Data Principal. It is not the consent tool a business runs for itself. Our page on the difference between the two explains this. Whether the registration process is open to applicants depends on the Data Protection Board publishing it, and we have not seen that process.
What starts on 13 May 2027?
The remaining provisions of the Act and Rules start on this date. They include section 9 on children’s data and section 10 on Significant Data Fiduciaries. The core consent duties in section 6 (6(1) to 6(8) and 6(10)) and the notice duties under section 5 also start on this date, as set out in our earlier pages on the compliance timeline and time limits.
| Date | What begins | Who it mainly concerns |
|---|---|---|
| 13 November 2025 | Initial provisions, under G.S.R. 843(E) | The Board and the Act’s framework provisions |
| 13 November 2026 | Rule 4, section 6(9) and section 27(1)(d) | Entities that want to register as Consent Managers |
| 13 May 2027 | The remaining provisions, including sections 9 and 10 | Data Fiduciaries and Data Processors |
Does 13 November 2026 change anything for a business that is not a Consent Manager?
The notification ties the date to the Consent Manager provisions. A date is a deadline for you only if a duty applies to you from that day, so a business that is not applying to become a Consent Manager does not get a new duty on 13 November 2026 from this notification. Your own duties as a Data Fiduciary follow the 13 May 2027 date.
What can organisations do between the two dates?
The months in between are preparation time. These steps do not depend on any date moving:
- Map your personal data. List what you collect, why, where it goes and who handles it. Our data mapping guide shows how.
- Review your notices and consent flows. Check them against section 5 and section 6. See valid consent under section 6.
- Check your Data Processors. Know who processes data for you and what your contracts say.
- Prepare a breach process. Read how to report a personal data breach.
- Follow our checklist. The DPDP Act compliance checklist turns these steps into a plan.
Could the dates change?
The dates come from the notification. We have found no notification that changes them. Two related developments are worth watching, and we do not predict how either will end:
- The Supreme Court case. The Digital News Publishers Association has challenged parts of the Act and Rules. Reports say the court issued notice on 27 October 2026, did not grant an interim stay before hearing the Centre, and listed the matter next on 17 November 2026. Read our news update.
- The Removal of Difficulties Order. MeitY issued S.O. 5458(E) on 5 October 2026, in force from 6 October 2026. Read what the order changes.
We will update this page when either development changes the dates.
Frequently asked questions
Is 13 November 2026 a DPDP compliance deadline?
The notification ties 13 November 2026 to the Consent Manager provisions: Rule 4, section 6(9) and section 27(1)(d). The remaining provisions start on 13 May 2027.
What starts on 13 May 2027?
The remaining provisions of the Act and Rules, including sections 9 and 10, under G.S.R. 843(E).
What is a Consent Manager?
A Consent Manager is an entity registered with the Data Protection Board that lets a Data Principal give, manage, review and withdraw consent. Under section 6, it is accountable to the Data Principal.
Is a Consent Manager the same as a consent management tool?
No. A consent management tool is software a business uses for its own consent records. A Consent Manager is a registered entity under the Act. See our comparison page for the detail.
Has the Supreme Court stayed the DPDP Act?
Reports say the court issued notice on 27 October 2026 and did not grant an interim stay before hearing the Centre. The next listing is reported as 17 November 2026. We will update this page after the hearing.
Sources
- Commencement notification G.S.R. 843(E), 13 November 2025 (Gazette of India)
- PIB: Government notifies DPDP Rules, 14 November 2025 (Press Information Bureau)
- Business Standard
This is general information, not legal advice. Speak to your counsel before acting on it.