Layer 4 · CROs · Board — planning horizon
DPDP Timeline & Enforcement
Every milestone from enactment to full enforcement, plus the penalty schedule up to ₹250 Cr.
| Milestone | Date | What Changes |
|---|---|---|
| DPDP Act enacted | 11 August 2023 | Act receives presidential assent; obligations dormant pending Rules |
| DPDP Rules 2025 notified | 13 November 2025 | Operational detail fixed: notice formats, breach reporting, SDF duties, consent manager regime |
| Consent manager registration opens | ~November 2026 | Consent managers register with the Data Protection Board |
| Data Protection Board fully operational | ~May 2027 | Digital-first adjudication body live; complaints and penalties begin |
| Core fiduciary obligations enforceable | ~May 2027 | Notice, consent, security safeguards, breach notification (72 hrs to DPB + principals) all enforceable |
Penalty schedule (Act, Schedule)
Civil penalties only — imposed by the Data Protection Board, appealable to TDSAT.
- Failure of security safeguards causing breach — up to ₹250 Cr
- Failure to notify DPB / data principals of a breach — up to ₹200 Cr
- Children's data obligations breach — up to ₹200 Cr
- SDF additional obligations breach — up to ₹150 Cr
- Any other violation — up to ₹50 Cr
- Data principal duty violations — up to ₹10,000