DPDP regulatory tracker:
every update, dated and sourced.
A dated changelog of India's Digital Personal Data Protection Act and Rules, newest first, with a primary source for each entry and the dates still to come. Last checked 28 September 2026.
Last updated Published by TryTrustableNot legal advice
Last checked 28 September 2026. Every entry below was re-checked against its source on that date. Where an item is a proposal, reporting or status rather than a notification, the Status column says so.
What is coming next under the DPDP Act?
Two dates are fixed by the Rules. Consent Manager registration under Rule 4 opens on 13 November 2026. The substantive duties on Data Fiduciaries, including notice, security, breach reporting, retention, children's data, Significant Data Fiduciary duties and rights, commence on 13 May 2027, together with the Board's powers to inquire and penalise.
| Date | What happens | Status | Source |
|---|---|---|---|
| 13 November 2026 | Consent Manager registration opens (Rule 4) Rule 4 and the First Schedule commence, with section 6(9) and the Board's power in section 27(1)(d) over breaches of registration conditions. See the Consent Manager guide. | In force | Rule 1(3), DPDP Rules 2025 |
| 1 January 2027 | E-commerce consent amendment takes effect The Consumer Protection (E-Commerce) (Amendment) Rules, 2026 come into force. | Related | DD India (Prasar Bharati) |
| 13 May 2027 | Substantive DPDP duties commence Rules 3, 5 to 16, 22 and 23: notice, security, breach intimation, retention, children, SDFs, rights, cross-border transfer, appeals. The Act's remaining sections, including the Board's powers to inquire and penalise, commence with them. | In force | Rule 1(4), DPDP Rules 2025 |
Dates from Rule 1 of the DPDP Rules 2025, counted from publication on 13 November 2025.
Pending, with no date yet
| Item | Where it stands | Guide |
|---|---|---|
| Appointment of the Board's Chairperson and Members | Applications invited May 2026. Needed before the Board can decide anything. | Read |
| Decision on the 12-month SDF proposal | Would move SDF duties to 13 November 2026 if notified. | Read |
| First Significant Data Fiduciary notifications (s.10) | None found. The Central Government notifies, not the Board. | Read |
| Countries restricted under section 16 | None notified. Any notification must be laid before Parliament. | Read |
| Data specified for SDF localisation (Rule 13(4)) | Awaits a committee's recommendation. | Read |
| Age above which verifiably safe processing is exempt (s.9(5)) | None notified. | Read |
| Board's published particulars for Consent Manager applications (Rule 4(1)) | Expected before or on 13 November 2026. | Read |
DPDP changelog, newest first
Each entry is dated to the day it happened, not the day we noticed it, and links to a primary source where one exists. Where the only public record is reporting, as with the January 2026 consultation, the entry is marked as a proposal and the report is linked.
| Date | Development | Status | Source |
|---|---|---|---|
| 9 September 2026 | Consumer Protection (E-Commerce) (Amendment) Rules, 2026 notified The Department of Consumer Affairs bars marketplace e-commerce entities from using consumer information for specified purposes without express and affirmative consent. In force 1 January 2027. This sits alongside DPDP consent; it does not replace it. | Related | DD India (Prasar Bharati), 10 September 2026 |
| 1 August 2026 | Board still without Chairperson or Members LiveLaw reports that no Chairperson or Members have been appointed, and notes a further MeitY communication on the appointment process dated 6 June 2026. We found no appointment notification as of 28 September 2026. | Status | LiveLaw, 1 August 2026 |
| 6 May 2026 | MeitY invites applications for the Board's Chairperson and four Members Circular F. No. 2(1)/2026-Pers.I seeks candidates for one Chairperson and four Members: minimum age 55, tenure of two years or until 65, salaries as in the Fifth Schedule. A public advertisement allows thirty days from publication in the Employment News. | Status | MeitY circular, 6 May 2026 MeitY advertisement |
| 22 January 2026 | MeitY consults on a 12-month window for Significant Data Fiduciaries Reported proposal to cut the eighteen-month window to twelve for SDFs, moving their deadline to 13 November 2026, and to bring forward section 10(1), Rule 13(4), Rule 15 and Rule 8(3). Comments sought by 4 February 2026. Not notified as of 28 September 2026. | Proposal | Business Standard, 22 January 2026 S.S. Rana & Co. analysis |
| 14 November 2025 | MeitY announces the Rules through PIB PIB release confirms the eighteen-month phased timeline and that Consent Managers must be Indian companies. A longer PIB explainer on 17 November describes a four-member, digital-first Board. | Status | PIB, 14 November 2025 PIB explainer, 17 November 2025 |
| 13 November 2025 | DPDP Rules 2025 notified (G.S.R. 846(E)) Rules 1, 2 and 17 to 21 (definitions and the Board) in force on publication. Rule 4 (Consent Managers) from 13 November 2026. Rules 3, 5 to 16, 22 and 23 from 13 May 2027. | Notified | DPDP Rules 2025 (MeitY) |
| 13 November 2025 | Data Protection Board established; Act commences in stages The Board is established under section 18, with its head office in the National Capital Region. Sections 18 to 26 commence at once; section 6(9) and section 27(1)(d) after one year; the rest after eighteen months. | In force | MeitY circular confirming establishment IFF summary of the commencement notification |
| 3 January 2025 | Draft DPDP Rules published for consultation MeitY publishes the draft Rules as G.S.R. 02(E), inviting objections and suggestions for 45 days. | Proposal | DPDP Rules 2025, preamble (MeitY) |
| 11 August 2023 | DPDP Act receives assent and is published The Digital Personal Data Protection Act, 2023 (22 of 2023) receives the President's assent and is published in the Gazette. Most of it waits for a commencement notification and Rules. | Notified | Act, Gazette text (MeitY) India Code |
Status: Notified means published in the Gazette; In force means commenced; Proposal means not law; Status is a factual update about implementation; Related is a non-DPDP rule that touches the same data.
What does this mean for a company preparing now?
Plan to the Rules as notified, 13 May 2027 for most duties, while being ready earlier if you are likely to be a Significant Data Fiduciary, because the proposal to move SDF duties to November 2026 is on record even though it is not law.
Three things on this page change what you should build. The Board existing without members means the first decisions are some way off, but evidence you create now will be what you show it. The SDF proposal means large platforms, banks and insurers should treat November 2026 as the working date for a DPO, an auditor and a first DPIA. And the e-commerce amendment shows sector rules layering their own consent requirements on top of DPDP, so a single consent record that can carry more than one legal basis will matter.
The DPDP Act and Rules 2025 guide sets out every obligation. The DPDP compliance checklist turns it into a work plan, and the free scan shows the first thing to fix on your own site.
Related guides: children's data and verifiable parental consent, cross-border data transfer, Significant Data Fiduciary duties, data retention and erasure and how the Data Protection Board works. The DPDP Act and Rules 2025 guide sets out the whole timetable, and the DPDP penalty schedule what each failure can cost.
The things people ask us
What is the latest DPDP update?
As of 28 September 2026, the most recent item in this tracker is dated 9 September 2026: Consumer Protection (E-Commerce) (Amendment) Rules, 2026 notified. The next fixed date is 13 November 2026, when Consent Manager registration under Rule 4 opens, followed by the substantive duties on 13 May 2027.
Has the DPDP compliance deadline been moved to November 2026?
Not as of 28 September 2026. In January 2026 MeitY consulted on cutting the eighteen-month window to twelve months for Significant Data Fiduciaries, which would move their deadline to 13 November 2026. No amending notification has been published, so the substantive duties still commence on 13 May 2027.
Has the Data Protection Board started hearing complaints?
The Board was established on 13 November 2025, but its powers to inquire and penalise commence on 13 May 2027, and as of 28 September 2026 we had found no notification appointing its Chairperson or Members. MeitY invited applications for those posts on 6 May 2026.
Have any Significant Data Fiduciaries been notified yet?
We had found none as of 28 September 2026. The Central Government notifies SDFs under section 10, and Rule 13's duties commence on 13 May 2027. A notification can name a single company or a class, and will be recorded here when it appears.
How often is this DPDP tracker updated?
We check the Gazette, MeitY, PIB and the Board's publications and update the page when something changes. The date at the top is the last time every entry was checked, currently 28 September 2026. Each entry links to its source so you can confirm it yourself.
Fix what a regulator would see first.
The free scan shows every tracker that fires before consent. Consent by TryTrustable holds them back and records each choice against the notice version and language that produced it.