20 Oct 2026
The DPDP timeline, explained without the noise
Three dates, three stages: what changes now, what changes next, and what you should be doing before May 2027.
The initial timeline treats 13 November 2025, 13 November 2026 and 13 May 2027 as separate stages. The first stands up the regulator; the second concerns Consent Managers; the third brings the substantive duties most businesses care about.
What to do in each window
- Now: inventory data, choose lawful grounds, fix website notices and consent.
- By the second stage: decide whether any Consent Manager integration matters for you.
- Before the third: have notices, consent records, rights handling, retention, vendor contracts and a breach plan tested.
Pending legal review. Not legal advice.