India's DPDP Act and Rules: Compliance Checklist and Timeline to May 2027

India's Digital Personal Data Protection (DPDP) Act, 2023 reaches full operation on 13 May 2027, with the consent manager framework starting earlier, on 13 November 2026, under the DPDP Rules 2025 notified on 13 November 2025 25. A DPDP Act compliance checklist for a customer data platform (CDP) centres on itemised notice, purpose-bound consent, 72-hour breach reporting, erasure and retention timers, and penalties of up to ₹250 crore 14.

Who this is for: DPOs, CISOs and marketing-operations leads who handle personal data of people in India, and architects planning a consent ledger and erasure pipeline before the main obligations start. Part of the regulation hub.

The DPDP timeline: three phases

The Act received assent on 11 August 2023 (Act No. 22 of 2023) and commences in stages 5. Until the third phase, the Information Technology Act and the 2011 privacy rules continue to govern 1. The runway is 18 months from notification of the Rules 4.

G.S.R. 843(E), dated 13 November 2025, schedules section 6(9) and section 27(1)(d) one year after Gazette publication and the listed substantive provisions eighteen months after publication. The PDF carries an upload identifier dated 14 November 2025, so this guide does not calculate a legal deadline from the notification heading alone. Confirm the operative publication date and any amendments before relying on the commonly reported 13 November 2026 / 13 May 2027 dates. Official commencement notification.

Notice and consent standards

Processing needs consent or a listed legitimate use. Consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action; the notice must itemise the data, the purpose, rights and complaint routes, and can be requested in English or any of the 22 Eighth Schedule languages 1. Withdrawing consent must be about as easy as giving it 1. Rule 3 requires clear, plain-language notices that itemise data and purposes and link to withdrawal, rights and the Board complaint route 2.

Section 7 lists specific legitimate uses, including voluntary provision for the specified purpose, legal duties, emergencies and employment purposes. Do not infer a general marketing permission from that list. Assess the requested purpose and communications with counsel. Official Act, section 7.

Consent managers (13 November 2026)

A consent manager is a registered entity through which a data principal gives, reviews, manages and withdraws consent. It must be interoperable, secure and transparent, and registered with the Board 1. Rule 4 and the First Schedule require, as summarised, an Indian company with net worth of at least ₹2 crore, a fiduciary duty to the data principal, "data blindness" over personal data passing through it, and consent records kept for at least seven years 24. Neither the Act nor the Rules require fiduciaries to integrate with consent managers 1, so the 13 November 2026 date mostly creates a channel your platform must be able to accept. Plan an API-based intake of consent artefacts and withdrawals that lands in your consent ledger.

Data principal rights, grievance and breach

Significant data fiduciaries

Section 10 allows the government to designate Significant Data Fiduciaries using factors including volume, sensitivity and risk. Designated entities have additional governance duties, including an India-based DPO, an independent auditor and impact assessment. This guide has not established current designations or the operative Rule 13 details. Official Act.

Children's data

Cross-border transfers: the negative-list approach

Section 16 lets the Central Government restrict transfers to notified countries or territories and preserves stricter sector laws. This review did not establish the current notification list, so absence of a retrieved restriction is not a finding that every destination is permitted. Official Act, section 16.

Penalties under the DPDP Act

What it means for marketing data and a customer data platform

The Act has no marketing-specific section, so marketing falls under the general consent standard. Related regimes still apply: the Central Consumer Protection Authority's misleading-advertisement guidelines (2022) and dark-pattern guidelines (November 2023), the E-Commerce Rules 2020, and TRAI's Do Not Call registry and preference portal 1.

• Consent ledger. Store per-purpose consent with notice version and language, timestamp, mechanism, withdrawal, and any consent manager reference. Never bundle marketing with service consent, because consent must be unconditional and limited to the specified purpose 1.
• Purpose limitation. Tag every attribute and segment with the purpose it was collected for, and block activation where the purpose does not match.
• Erasure pipeline. Build retention timers by purpose, fan-out deletes to processors and warehouses, and keep the required logs separate. See consent withdrawal across channels.
• Processors and residency. Rule 6 expects contractual duties for processors 2. A SaaS platform can meet that, but an SDF or a regulated-sector firm may prefer to keep profiles in India under its own keys, see on-premise, private cloud and self-hosted customer data platforms. Moving consent state between platforms is covered in the 90-day migration plan.

PrivyCDP is a customer-owned platform that can run on-premise or in your own cloud account in a region you select; it supports residency and key control, while notice, consent design and breach filing remain your obligations. See deployment and the compliance guide. Neighbouring regimes: Saudi PDPL.

DPDP Act compliance checklist

Before 13 November 2026

• Decide whether you will accept consent manager artefacts and design the intake API 14.
• Inventory personal data by purpose, source, processor and location.
• Draft the itemised notice in English and the Eighth Schedule languages you serve 12.

Before 13 May 2027

• Rebuild consent per purpose; separate marketing from service consent 1.
• Make withdrawal as easy as giving consent, across web, app and email 1.
• Stand up the consent ledger and purpose tags in the customer data platform.
• Add age and guardian checks; block tracking and targeted ads for minors 1.
• Define retention by purpose; build erasure with 48-hour pre-notice and processor fan-out 2.
• Keep logs and security records for at least one year 12.
• Write the breach runbook: notify the Board and individuals, then the 72-hour report 2.
• Re-paper processors with security and erasure duties 2.
• Appoint a grievance contact and publish rights routes 2.
• Assess SDF exposure; if likely, plan the India-based DPO, auditor and annual DPIA 2.
• Check sector localisation rules and the negative list before choosing regions 1.
• Track the date on the deadline tracker.

If your customer data platform needs an India-resident consent ledger and erasure pipeline under keys you hold, a deployment qualification call scopes on-premise, private-cloud or hybrid options against the phases above. More playbooks are in the regulation hub.