DPDP Act Compliance Timeline: What's Already Live, What Changes in November 2026, and What You Still Have Time For
Network Intelligence News, Thursday, October 8th, 2026
A phase-by-phase guide to India's DPDP Act, from the 2025 Data Protection Board to core obligations arriving in May 2027.
Network Intelligence lays out the phased rollout of India's Digital Personal Data Protection Act and Rules, notified on 13 November 2025 and commencing in three phases through 13 May 2027.
Phase 1 established the Data Protection Board, Phase 2 in November 2026 brings the Consent Manager registration framework into force, and Phase 3 in May 2027 activates consent mechanics, data principal rights, breach notification and significant data fiduciary obligations.
Organizations are urged to use the runway for data mapping, consent architecture, vendor oversight and breach readiness, since ISO 27001 or SOC 2 alone do not cover DPDP requirements.