Will the DPDPA Deadline Move Earlier? MeitY’s 12-Month Proposal Explained

When the DPDP Rules 2025 were notified on 13 November 2025, businesses got an 18-month runway to May 2027. Within ten weeks the government signalled that the runway might be shorter.

What was proposed

Following a meeting with large platforms on 22 January 2026, MeitY reportedly sought industry feedback, due by early February, on three changes:

1. Compressing the main compliance window from 18 months to 12 months. Reports differ on whether this would apply to all Data Fiduciaries or only to large players and Significant Data Fiduciaries.
2. Bringing Rules 15 and 23 into force immediately. These are the cross-border transfer rule and the rule on government calls for information.
3. Operationalising Rule 8(3) within three months. This is the requirement to retain personal data, traffic data and logs for at least one year for specified purposes.

The context was a statement by IT Minister Ashwini Vaishnaw in November 2025 that large companies already compliant with stricter global regimes, such as the GDPR, did not need the full transition period.

Where it stands

As of 15 October 2026, no Gazette notification amending the commencement dates has been published. The 12-month mark (13 November 2026) is now only weeks away, so a blanket compression to 12 months looks increasingly unlikely. The commencement notification is still the legal source, and under it the core obligations begin in May 2027.

The government has shown it is willing to adjust the framework by executive instrument. The October 2026 Removal of Difficulties Order is an example. A targeted change for SDFs, or an early commencement of Rule 15 or Rule 23, therefore cannot be ruled out.

Who should worry most

• Large consumer platforms and likely SDFs. If any change comes, it will come for you first.
• Businesses with offshore processing. Early commencement of Rule 15 would bring forward the cross-border transfer conditions. See cross-border transfers under DPDPA.
• Teams with weak log retention. One year of logs cannot be built overnight. If Rule 8(3) is brought forward, retention must already be running.

How to plan for an uncertain deadline

Treat May 2027 as the latest date, not the target. Sequence your programme so that the things with the longest lead time are done first: data discovery, log retention, breach runbooks and vendor contract updates. The quick wins, such as notices and website consent copy, can come later. Our 210-day roadmap is built that way.

Vidhi watches the Gazette and MeitY releases and will alert you the day any commencement notification changes. Check where you stand with the readiness assessment.

Position as of 15 October 2026, based on press reports of the consultation; MeitY has not published the proposal formally. Not legal advice.