13 November Is Not Your DPDP Deadline: What Starts and What Doesn’t

If you have read about India’s data protection law lately, you may have seen 13 November 2026 described as a compliance deadline. For most website owners and small businesses, it is not. On that date, a single rule starts: the one that lets companies register as Consent Managers. The duties that affect ordinary sites, such as notices, consent, security, breach reporting and user rights, begin on 13 May 2027. This post explains the difference and lays out a plan that works back from the real date.

Key takeaways

13 November 2026 starts Rule 4 only: the registration of Consent Managers with the Data Protection Board.
Nothing new is legally required of an ordinary website or business on that date, unless you plan to become a Consent Manager.
The main duties (Rules 3 and 5 to 16, plus penalties) begin on 13 May 2027, about 28 weeks from now.
A reported plan to shorten the 18-month window to 12 months has not been formally notified, as far as published reviews show. Check the Gazette before relying on any date.

DPDP Rules timeline: Rules published 13 November 2025, Consent Manager rule starts 13 November 2026, core business duties begin 13 May 2027 — For most websites, the date that matters is 13 May 2027.

Table of Contents

What starts on 13 November 2026

The Digital Personal Data Protection Rules, 2025 were published on 13 November 2025 and phase in over 18 months. Rule 4 comes into force one year after publication, which puts it on or about 13 November 2026. It covers how Consent Managers register with the Data Protection Board. A Consent Manager is an entity, which must be an Indian company, that helps people give, review and withdraw their permissions across different services. Commentators report an eligibility requirement of at least ₹2 crore net worth and an independently certified platform for those who apply.

So this milestone matters mainly to two groups: companies that want to become Consent Managers, and larger businesses planning to integrate with them later. It is not a deadline for a blog, a shop or a small company’s website.

What starts on 13 May 2027

Area	Rules (as summarised by legal commentators)
Notice and consent	Rule 3, with sections 5 and 6 of the Act
Security safeguards	Rule 6
Breach reporting	Rule 7
Erasure, retention and a contact person	Rules 8 and 9
Children’s data	Rules 10 to 12
Significant Data Fiduciary duties	Rule 13
Rights of individuals	Rule 14
Penalties	Sections 33 and 34 of the Act

These are the rules that shape what a website must actually do: show a clear notice where it collects personal data, record consent, protect the data, let people access, correct or erase it, and report breaches. Rule 7 is summarised as requiring notice to affected people without delay and a detailed report to the Board within 72 hours.

What is already in force

The Data Protection Board was established when the Rules were published. As of the most recent reviews I found (September and October 2026), no Chairperson or Members had been confirmed as appointed.
Section 43A of the IT Act and the SPDI Rules 2011 continue to apply until the new law replaces them on 13 May 2027.
CERT-In’s 2022 directions already require specified cyber incidents to be reported within six hours. See our post on the CERT-In advisory on AI agents for related security steps.

Could the dates change?

In January 2026, Business Standard reported that the IT ministry was considering shortening the 18-month window to 12 months for certain provisions. According to reviews dated September and October 2026, no amending notification had been published, and a parliamentary answer in August 2026 still described an 18-month transition. This could change, so confirm the current dates in the Gazette of India and on MeitY’s website before you finalise any plan.

A plan that works back from 13 May 2027

You have roughly 28 weeks. One sensible way to spend them:

November to December: Run a free scan with our DPDP website checker to see what your site collects. Map the personal data you hold and where it goes.
January: Write a clear notice for each place you collect data, and record consent against it.
February: Set up a process for access, correction and erasure requests, and a grievance contact. Summaries of the Rules report a 90-day response period.
March: Review security and your vendors. Update contracts with processors, such as email, analytics and payment tools.
April: Rehearse a breach response, including who decides, who is told and how fast.
May: Final review. Re-run the scan and fix what remains.

For a walk-through of what a scanner can and cannot see, read our post on checking your site for DPDP readiness.

This is general information, not legal advice. Dates and rule numbers come from published summaries of the DPDP Rules, 2025, and from the government’s press release. Check the Gazette and take advice from a qualified lawyer for your own situation.

Sources

Frequently asked questions

Is 13 November 2026 a DPDP compliance deadline for my website?

No, not for most sites. On that date only the Consent Manager registration rule (Rule 4) starts. The main business duties begin on 13 May 2027.

When do DPDP penalties apply?

Summaries of the Rules place the penalty provisions (sections 33 and 34 of the Act) with the main duties starting 13 May 2027. Confirm in the Gazette.

What should a small website owner do first?

Find out what personal data your site collects, for example through forms, analytics and advertising tags, then plan clear notices and a process for user requests before May 2027.