210 Days to May 2027: A Week-by-Week DPDPA Compliance Roadmap

The core obligations of the DPDP Act, and the penalty regime of up to ₹250 crore, commence 18 months after the DPDP Rules were notified, which is on or around 13 May 2027. From 15 October 2026 that leaves about 210 days.

That is enough time if you sequence the work correctly. It is not enough if you start with the privacy notice and leave data discovery to the end. Here is the roadmap we use with customers.

Phase 1: Discover (weeks 1–6, mid-October to November 2026)

Goal: know what personal data you have, where it is, why you have it, and who you share it with.

• Appoint an accountable owner and a cross-functional working group: legal, security, product, HR and procurement.
• Run automated data discovery across databases, SaaS tools, data warehouses and file shares.
• Build the processing register: activity, purpose, lawful basis (consent or a legitimate use under Section 7), data categories, systems, processors and retention.
• Do the SDF self-assessment. See Are you a Significant Data Fiduciary?
• Note 13 November 2026: Consent Managers can begin registering (details).

Phase 2: Decide (weeks 7–12, December 2026 to mid-January 2027)

Goal: turn the inventory into decisions.

• Purpose limitation: stop collecting data that has no purpose, and set a retention period for each data category, taking account of the sectoral laws (how overlaps work).
• Consent versus legitimate use: decide the basis for each activity, and redesign anything that bundles consent.
• Children and guardians: decide your age-assurance and guardian-verification approach (guide).
• Vendors: list every processor and start contract renegotiation, because this takes the longest (vendor guide).

Phase 3: Build (weeks 13–22, mid-January to March 2027)

Goal: ship the controls.

• Notices in plain language, in English and the Eighth Schedule languages relevant to your users, with itemised data and purposes (consent notice generator).
• Consent platform: granular consent, withdrawal as easy as giving consent, propagation to processors, and readiness for Consent Manager integration.
• Rights workflow: access, correction, erasure, grievance and nomination, with identity checks and published response times (DSAR workflow guide).
• Security safeguards under Rule 6: encryption or masking, access control, logging, monitoring and backups. Log retention of one year under Rule 8(3) must already be running.
• Breach runbook with parallel CERT-In and DPDPA tracks (72-hour playbook).
• Erasure automation, including the 48-hour pre-erasure notice where the Third Schedule applies.

Phase 4: Prove (weeks 23–28, April to early May 2027)

Goal: show it works before the Board can ask.

• Tabletop breach exercise with legal, communications and leadership.
• Mock rights requests across every channel.
• For SDFs, a dry-run DPIA and data audit (how to prepare).
• Training for staff who handle personal data.
• An evidence pack: the register, notices, consent logs, contracts, runbooks, test results and training records.

Phase 5: Operate (from May 2027)

Compliance is continuous. Products change, vendors change, and the government is still adjusting the framework, as the 2026 Removal of Difficulties Order showed. Build a monthly review cadence and a regulatory watch.

Shortcut the 210 days

Data Adhikaar's ten agents run this programme as a system: Drishti discovers data, Sammati manages consent, Adhikari handles rights, Suraksha runs breach response, Sambandh manages vendors and Saakshi keeps the evidence. Start with the free readiness assessment to see where you stand, or talk to us.

Position as of 15 October 2026. Dates are computed from the commencement notification of 13 November 2025. Not legal advice.