For the past two years, India's Digital Personal Data Protection Act (DPDPA) has felt like something businesses could deal with later. That window is closing fast. With the DPDP Rules notified in November 2025, the countdown has officially begun — full substantive obligations, including penalties of up to ₹250 crore per violation, come into force on 14 May 2027.
For the past two years, India's Digital Personal Data Protection Act (DPDPA) has felt like something businesses could deal with later. That window is closing fast. With the DPDP Rules notified in November 2025, the countdown has officially begun. MeitY has set three enforcement dates: 14 November 2025, 14 November 2026, and 14 May 2027, with full substantive obligations, including penalties of up to ₹250 crore per violation, coming into force on the final date. There is no indication of an extended grace period, and the Data Protection Board of India is already operational.
If your business collects, stores, or processes the personal data of customers, employees, or website visitors in India, this isn't a future compliance item. It's a live project with a hard deadline.
Why This Catches Businesses Off Guard
Most organisations assume data protection compliance is a legal checkbox: update a privacy policy, add a cookie banner, done. DPDPA is structurally different. Data Fiduciaries must provide itemised notices, define purpose-based retention timelines, implement reasonable security safeguards, and notify breaches within 72 hours.
It requires itemised, standalone consent instead of bundling permissions into one broad “I agree” checkbox; auditable proof of consent with durable, time-stamped records; breach notification within 72 hours to the Data Protection Board and affected individuals; Data Principal rights infrastructure that lets users access, correct, or request erasure of their data; and Consent Manager compatibility, whose provisions become effective from 13 November 2026.
None of this is a policy update. It's a systems and infrastructure project — legal requirements translated into technical architecture.
The Businesses Most at Risk
Two groups should be paying closest attention right now. Significant Data Fiduciaries (SDFs) face enhanced obligations, including annual Data Protection Impact Assessments, independent audits, algorithmic fairness assessments, appointing a Data Protection Officer, and stricter technical due diligence. And any business with legacy consent systems — sign-up forms, cookie banners, IVR scripts, and paper-based onboarding flows built years ago — was never designed to integrate with an external Consent Manager registry. Retrofitting these systems takes far longer than most teams expect.
What Compliance-Ready Actually Looks Like
At CoreGenix, we look at DPDPA readiness as a build project with four pillars: data discovery and mapping, knowing exactly what personal data you hold and where it lives; consent architecture rebuild with itemised notices and audit-ready logging; security safeguards such as access controls, encryption, and monitoring aligned to DPDPA's reasonable security standard; and breach response readiness built on a tested protocol, not a document sitting in a drawer.
The Real Cost of Waiting
The 18-month runway from notification gives organisations a defined window to reassess their privacy posture and operational practices before the regime becomes fully binding. Businesses that start now have time to test, fix, and refine. Businesses that wait until early 2027 will be racing a deadline with penalties attached, and building consent infrastructure under pressure rarely produces something durable.
DPDPA isn't just a legal risk anymore; it's an infrastructure decision. And infrastructure decisions take time to get right.
CoreGenix helps organisations build the IT infrastructure, security controls, and audit-ready systems that DPDPA compliance actually requires. If you haven't started mapping your readiness, now is the time.