DPDP enforcement clock starts ticking as the Consent Manager deadline nears

India's Digital Personal Data Protection Act now has a confirmed, phased enforcement timeline — and the first date-bound obligation that applies to every enterprise, not just large ones, lands on November 14, 2026.

The confirmed timeline

The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules, 2025 on November 13–14, 2025, activating a three-phase enforcement schedule, according to India Briefing's compliance timeline breakdown:

• Phase 1 (November 2025): The Data Protection Board and statutory definitions came into force. This phase imposed no direct compliance burden on most enterprises.
• Phase 2 (November 14, 2026): The Consent Manager Framework under Rule 4 becomes operational — the first hard, date-bound obligation every enterprise needs to plan around.
• Phase 3 (May 13, 2027): Full substantive compliance is due, covering notice, consent, security safeguards, breach reporting, and data principal rights.

What "soft enforcement" means right now

Through most of 2026, enforcement is expected to lean on guidance and warnings rather than penalties. May 13–14, 2027 is widely regarded as the "hard enforcement" date, after which non-compliance penalties can reach ₹250 crore per violation — with no indication of an extended grace period.

Why the Consent Manager date matters most right now

Unlike the broader May 2027 deadline, the November 2026 Consent Manager requirement is close, specific, and operational — it requires enterprises to have a working consent management mechanism in place, not just a compliance plan on paper. Waiting until early 2027 to start building this leaves very little runway.

What this means for Indian data fiduciaries

Companies that haven't yet appointed a DPO, mapped their data flows, or built consent infrastructure should treat November 2026 as the real working deadline, not May 2027. See our guides on what the DPDP Act 2023 requires and the ₹250 crore penalty structure, or explore Cor Advance Solutions' DPDP compliance services to assess where your current setup stands against the Phase 2 requirements.