India's Digital Personal Data Protection Rules, 2025, move to their next milestone around 13 November 2026, when registration of consent managers under Rule 4 begins, according to a September 2026 compliance analysis by MirvoLegal. The Rules were notified on 13 November 2025 as G.S.R. 846(E), although some sources count the date a day later, and the provisions on the Data Protection Board came into force at once. The main duties on data fiduciaries, covering notice, consent, security, breach reporting, children's data and the exercise of rights, begin around 13 May 2027, 18 months after notification. The Ministry of Electronics and Information Technology administers the Rules, which implement the Digital Personal Data Protection Act, 2023.
The argument that the framework is ready to work starts with its detail. The Rules require a standalone notice in plain language, which must be available in languages of the Eighth Schedule on request, and security measures such as encryption, masking or tokenisation, access controls and logs. Fiduciaries must tell affected people promptly about a breach, inform the Board without delay and give full details within 72 hours or a longer period the Board allows. Children's data requires verifiable parental or guardian consent, subject to exceptions. The Schedule to the Act sets penalty ceilings of up to Rs 250 crore for security failures, up to Rs 200 crore for breach reporting or children's data failures and up to Rs 150 crore for significant data fiduciaries that breach their additional duties. The Rules also require logs and certain data to be kept for at least one year, and the data of inactive users to be erased under the Third Schedule after a warning given 48 hours in advance.
The argument that enforcement is not yet in place starts with the Board. MirvoLegal reports that, as at September 2026, no Chairperson or Members had been reported as appointed, although MeitY invited applications on 6 May 2026. A body that cannot yet sit cannot receive complaints or impose penalties. In January 2026, the ministry also floated a proposal to shorten the 18-month period to 12 months, with feedback closing on 4 February, and the same analysis found no amending notification, so companies are planning against a deadline that may or may not move. The analysis does not mention any court challenge, and its dates should be checked against the official Gazette text before companies rely on them. A 12-month period from notification would end around 13 November 2026, only weeks from now, which is why businesses are watching for any notification.
The Rules matter because personal data now runs through payments, health, education and government services used by hundreds of millions of people. Penalties of up to Rs 250 crore give large companies a reason to invest in security, while smaller firms and startups will need time and guidance, which is the reason for the phased schedule. For individuals, the consent managers that begin registering in November, which must be Indian companies registered with the Board, so their supervision also depends on a working Board. Companies that handle children's data face the strictest test, since verifiable consent from a parent or guardian is required, subject to listed exceptions.
The Rules set a clear timetable and heavy penalties, but until the Board has members, the rights they promise will depend on voluntary compliance.