DPDP Act timeline: key dates to May 2027

13 November 2025: Framework and the Board

The Act and the DPDP Rules, 2025 were notified. The provisions that set up the Data Protection Board and the framework rules (Rules 1, 2 and 17 to 21) came into force on this date.

• No duty to give notice or take consent under the Act applied yet.
• No penalties could be imposed for photos, video or any other data.

13 November 2026: Consent Manager registration

Section 6(9) and Rule 4 apply: companies can apply to the Board to register as Consent Managers. Nothing else changes for a school, event organiser, studio or employer on this date.

• Using a Consent Manager is optional for a Data Fiduciary.
• Your own notice, consent, security and erasure duties still start on 13 May 2027.

13 May 2027: The main duties and penalties

Sections 3 to 17 and the penalty provisions apply, with Rules 3 and 5 to 16. This is the date that matters for photos and video of people.

• Notice (Section 5, Rule 3) and consent (Section 6) for every purpose that is not a legitimate use under Section 7.
• Verifiable parental consent for children's photos (Section 9, Rule 10), with the Fourth Schedule exemptions for specified purposes only.
• Reasonable security safeguards and processor contracts (Section 8, Rule 6), breach intimation to the Board and each affected person (Rule 7), and erasure when consent is withdrawn or the purpose is served (Section 8(7)).
• People's rights to a summary, correction, erasure, grievance redressal and nomination (Sections 11 to 14).
• Penalties up to the maximums in the Schedule, decided by the Board after an inquiry (Section 33).

November to December 2026: Map what you have

• List every place photos and video of people are created, stored and shared: cameras, phones, drives, gallery platforms, WhatsApp groups, websites, social media, CCTV recorders.
• For each, write down the purpose and who decides it. That tells you whether you are the Data Fiduciary or a Data Processor.
• Flag anything involving children (under 18) and anything you publish for publicity or marketing.

January to February 2027: Decide the ground for each purpose

• Match each purpose to consent or a specific legitimate use under Section 7. There is no "legitimate interest" ground.
• Draft standalone notices with an itemised list of data and purposes, and one tick box per purpose.
• For children, plan how you will verify that the person consenting is an identifiable adult (Rule 10).

March to April 2027: Fix vendors, security and records

• Sign processor contracts with your photographer, gallery platform, cloud drive and CCTV vendor (Section 8(2)).
• Set access controls and keep logs for at least one year (Rule 6); write a breach plan that can produce a report to the Board within 72 hours (Rule 7).
• Set up a way to record who agreed to what, and to act on withdrawal and erasure requests across every copy you control.

From 13 May 2027: Run it

• Give notice and take consent before each new shoot, event or term.
• For consent given before 13 May 2027, give the Section 5 notice as soon as reasonably practicable (Section 5(2)).
• Review your records each quarter: withdrawals honoured, photos removed, vendors erased.

When does the DPDP Act come into force?

In stages. The Board and framework provisions came into force on 13 November 2025. Consent Manager registration applies from 13 November 2026. The main duties, including notice, consent, children's data, security, breach intimation, rights and penalties, apply from 13 May 2027.

Do schools and photographers have to comply from 13 November 2026?

No. 13 November 2026 only brings in the registration of Consent Managers. The duties that govern taking, storing and sharing photos and video of people, including parental consent for children, apply from 13 May 2027. The months before that are for preparation.

Can the Data Protection Board fine anyone before 13 May 2027?

The penalty provisions apply from 13 May 2027, together with the duties they enforce. Penalties are maximums, decided by the Board after an inquiry where it finds a breach significant. No Board inquiries or penalties are publicly known.

What about photos and consent collected before 13 May 2027?

Under Section 5(2), where a person gave consent before commencement, the fiduciary must give them a notice as soon as reasonably practicable. Review old consent forms and archives now, so that you can send notices and stop uses you cannot support.