DPDPA Implementation Timeline

DPDPA implementation follows phased commencement with critical milestones at 12 and 18 months. Organisations must treat this period as a compliance sprint, not a vacation. This article examines the implementation timeline, milestone obligations, and preparation strategies for each phase.

The implementation follows three phases: immediate effect for Data Protection Board provisions, 12-month window for Consent Manager obligations, and 18-month deadline for primary business compliance. Each phase introduces distinct requirements demanding different organisational responses.

November 2026 is not a soft launch. Consent Manager provisions require registered intermediaries facilitating consent management for data principals. Organisations relying on Consent Managers must ensure registered providers are engaged and integrated. Internal consent management systems must achieve compliance standards.

May 2027 represents full compliance deadline. Legacy data presents the largest challenge—historical data collected without DPDPA-compliant consent must be sanitized. Purpose limitation requires reviewing existing data against original collection purposes. Data minimisation demands deletion of unnecessary historical records.

Organisations should: complete gap analysis by Month 3, finalise policy frameworks by Month 6, implement technical controls by Month 9, conduct training by Month 12, and execute legacy data remediation by Month 15. Buffer time addresses unforeseen complications. Late starters face compressed timelines and elevated risk.