DPDP in October 2026: what is in force and what comes next

A founder looking at a DPDP compliance proposal needs one answer before approving the budget: which requirements apply today, and which are being prepared for a later commencement date? The distinction changes priorities. It also prevents a supplier from presenting every future obligation as an immediate legal emergency.

As of 22 October 2026, the final Digital Personal Data Protection Rules, 2025 exist. The framework has a phased commencement. Institutional provisions have started, Consent Manager registration provisions are scheduled for November 2026, and most substantive business obligations and individual rights are scheduled for May 2027. The authoritative starting point is the commencement notification, read alongside rule 1 of the final Rules.

Three dates, three different questions

The initial phase began with the November 2025 notification. It includes definitions, the Board’s institutional provisions and rulemaking machinery. The Government separately established the Data Protection Board of India. This does not mean every customer right, business duty and penalty procedure became enforceable together.

The next scheduled date is 13 November 2026. Section 6(9), section 27(1)(d) and rule 4 concern the Consent Manager registration framework and related Board functions. An ordinary shop using consent software should not assume that this is the commencement date for all its customer-processing obligations. Nor does software become a statutory Consent Manager merely by using that description.

The main scheduled date is 13 May 2027. The later phase includes scope, processing grounds, notices, most consent provisions, security and breach duties, rights, transfers and the main enforcement provisions. MeitY’s May 2026 public statement explicitly identifies 13 May 2027. The Gazette expresses these phases as one year and eighteen months from publication; its issue date and some electronic publication references differ by a day. For detailed deadline advice, use the instruments rather than a countdown copied from a marketing page.

What changed in October 2026?

The Removal of Difficulties Order corrected two passages in the Act. One makes the reference to personal data of a person with disability explicit in the guardian-consent provision. The other specifies periodic data audits in the SDF provision. It did not bring the main obligations forward or create a new compliance deadline.

This illustrates why a preparation plan needs version control. A policy written against the January 2025 draft may miss provisions in the final Rules. A document based only on the original Act may miss later corrections. Record the instrument, provision and date supporting each important decision.

A useful budget conversation

Consider a hypothetical furniture retailer with an online store and two showrooms. Its proposed programme contains a privacy notice, marketing permissions, a processor contract review and an incident exercise. These are sensible preparation projects. The retailer should ask the consultant to identify the applicable provision, scheduled commencement and expected evidence for each project.

The same proposal includes a mandatory annual independent DPDP audit and an India-based statutory DPO. Those requirements need closer examination. Section 10 imposes additional requirements on Significant Data Fiduciaries. The retailer should not be labelled an SDF simply because it has a growing customer list. The distinction is explained in the Act’s SDF provisions.

The budget can then distinguish improvements that take months, ordinary controls already needed under other obligations, and requirements conditional on a future designation. That produces a more defensible sequence than purchasing everything under one compliance label.

Work that can start before commencement

Start with a short inventory of customer and employee workflows. Identify why each dataset exists, where it travels, who can access it and what eventually ends its use. This often exposes missing owners and forgotten exports before expensive tooling enters the discussion.

Next, select one customer journey and prepare its notice, permission choices, withdrawal route and evidence trail. Test it with someone who did not design it. Then review the vendors supporting that journey and rehearse an incident involving its data.

Do not postpone existing obligations while preparing for DPDP. CERT-In directions and applicable sector requirements have their own coverage and timelines. A future DPDP commencement date is not a general holiday from privacy or security responsibilities.

Before publishing a policy or signing off a readiness claim, ask the owner to check for later Gazette instruments. Keep the dated legal assumption with the implementation decision. A calendar entry is useful; a named owner who checks what changed is more useful when the framework moves from preparation into operation.