Most Indian companies think they have until 2027 to worry about DPDP. They're wrong. The clock started in November 2025 — and the ₹250 crore penalty is already live.

May 13, 2027, sounds far away. It isn't.

That's the day India's Digital Personal Data Protection Act stops being a compliance project and starts being a legal weapon. Every company that touches an Indian phone number, email address, or Aadhaar-linked login will have to prove — not promise — that it handles that data correctly.

Here's the part most founders and IT heads have missed: the Data Protection Board of India is already operational. The penalty framework under Section 33 is already active. The ₹250 crore fine isn't waiting for 2027 to become real — the legal machinery to impose it exists today.

What Actually Happens On May 13, 2027

The DPDP Rules, 2025 were notified on November 13, 2025. That date started an 18-month countdown. When it ends, every core obligation under the Act — consent, breach notification, data retention, grievance redressal — becomes fully enforceable, all at once. No soft launch. No warning period.

Unlike GDPR's staggered European rollout, DPDP compliance in India lands as a single hard deadline. You're either ready or you're exposed.

And the penalties aren't theoretical. A single breach can trigger stacked violations — failure to notify, failure to secure, failure to document — pushing cumulative exposure into the hundreds of crores for one incident.

The Deadline Nobody's Talking About: November 2026

Six months before the big deadline, something quieter but equally important happens. The Consent Manager registration window opens on November 13, 2026 — and it's restrictive. Only India-incorporated entities with a minimum net worth of ₹2 crore can register, effectively locking out foreign consent-management platforms many Indian companies already rely on.

If your business uses a consent tool built outside India, November 2026 is when you find out whether it's still legal to use.

Why "We'll Start Next Year" Is The Riskiest Sentence In Indian Boardrooms Right Now

Compliance programs that companies assume will take three months typically take twelve to eighteen. Vendor contracts alone can take months to renegotiate, because your company is legally accountable for what your data processors do — even a call center, even a cloud vendor, even the analytics SDK inside your app.

Most Indian businesses are still treating DPDP the way they treated GDPR when it first arrived — as someone else's problem, or a future problem. The Data Protection Board isn't waiting for that mindset to change.

Who Actually Has To Comply

The DPDP Act doesn't care about company size. There's no small-business exemption for core obligations. If you collect a phone number for OTP login, a delivery address for an order, or an employee's PAN card for payroll — you are a Data Fiduciary, and you are covered.

Companies designated as Significant Data Fiduciaries — based on the volume or sensitivity of data they process — face a steeper climb: mandatory India-based Data Protection Officers, annual third-party audits, and formal Data Protection Impact Assessments. Classification isn't self-declared. The government decides who qualifies.

What Indian Companies Need To Fix Before 2027

Map your data first. You cannot protect what you haven't inventoried. Every business collecting Indian user data needs a clear record of what's collected, why, where it's stored, and who else touches it.

Rewrite your consent flows. Consent under DPDP has to be specific, clear, and available in local languages — not a pre-ticked checkbox buried in a 40-page terms document.

Fix your vendor contracts. If your data processor gets breached, you're still liable. Every outsourcing agreement needs security clauses that hold up to Board scrutiny.

Build a real breach response plan. The Board expects notification without unreasonable delay. That means a tested process, not an improvised one, for the day something goes wrong.

Set retention and deletion policies. Personal data has to be deleted once its purpose is served. Most Indian companies still don't have a documented policy for when data gets purged.

The Real Risk Isn't The Fine

Penalties get headlines. But the bigger cost for most companies will be trust. Indian users are more aware of data misuse than ever — every leaked database, every telemarketing call from an app they deleted months ago, chips away at that trust a little more.

Getting DPDP-ready isn't just about avoiding a ₹250 crore number in a press release. It's about being the company that didn't have to explain, in a public breach notice, why it never bothered to ask permission properly in the first place.

The 18-month runway that started in November 2025 is already shorter than most companies think. The ones who start their gap assessment this quarter will spend 2027 operating normally. The ones who wait will spend it explaining themselves to a regulator.