Eighty-three percent of Indian businesses had not begun comprehensive implementation of the Digital Personal Data Protection Act as of January 2026, according to EY India's survey of nearly 150 professionals across nine sectors. That readiness gap matters because the Act's compliance clock is already running: the DPDP Rules 2025 set a phased schedule that ends with a hard deadline of 13 May 2027, and the penalties for missing it run into hundreds of crores of rupees.
India passed the Digital Personal Data Protection Act in August 2023, but the law sat without operating rules for more than two years. The DPDP Rules 2025, finally notified in November 2025, turned the Act from a statute on paper into a phased set of obligations with real dates attached. The figures below track where Indian businesses actually stand against those dates, sourced from the government's own notifications, a named enterprise readiness survey, and legal reporting on the Data Protection Board's own staffing gap.
How many Indian businesses have implemented the DPDP Act?
Most have not. EY India's survey, published in the report "India's Digital Privacy Crossroads: Understanding the DPDP Act and Rules' Impact and Enterprise Readiness," found that 48 percent of organizations had at least initiated a gap assessment, 44 percent had documented their data processing activities, and 38 percent had categorized personal data and identified third-party processors. Those are first steps, not finished programs: more than 81 percent had not updated or drafted DPDP-aligned privacy policies, and more than 83 percent had not begun comprehensive implementation of the Act's requirements.
Figure 1: Every readiness metric EY tracked showed a majority of surveyed firms still short of the mark. Source: EY India, "India's Digital Privacy Crossroads" (January 2026), survey of nearly 150 professionals.
Readiness also varies sharply by sector. Consumer, retail, and e-commerce firms lead, with 50 percent reporting they have started their DPDP journey, ahead of technology services at 38.8 percent and financial services at 34.7 percent, even though financial services is one of India's most heavily regulated sectors on data generally.
| Sector | Started DPDP journey | Rank |
|---|---|---|
| Consumer, retail and e-commerce | 50% | 1 |
| Technology services | 38.8% | 2 |
| Financial services | 34.7% | 3 |
Close to 70 percent of respondents told EY they find the Act difficult to interpret, and that knowledge gap reportedly extends to leadership teams, not just compliance staff. A law that most surveyed firms say they struggle to read is unlikely to be implemented on schedule without outside help, which is one reason the readiness numbers above sit so far below 100 percent this close to the compliance deadlines.
What are the DPDP Act's key compliance deadlines?
The DPDP Rules 2025 roll out in three phases rather than taking full effect on a single date, and each phase activates a different slice of the Act.
Figure 2: The Act took two years to acquire operating rules, and the rules themselves phase in over another 18 months. Source: PIB, "DPDP Rules, 2025 Notified" (17 November 2025); Lok Sabha and Rajya Sabha passage records.
Phase one, effective 13 November 2025, brought the Data Protection Board of India into legal existence and activated the procedural rules governing how complaints are filed. Phase two, effective 13 November 2026, activates Rule 4 and the First Schedule, the registration framework for Consent Managers, the intermediaries that let a person manage consent across multiple data fiduciaries from one place. Phase three, effective 13 May 2027, is the big one: notice and consent standards, Data Principal rights, security safeguards, breach reporting, retention and deletion rules, children's data obligations, and cross-border transfer conditions all become enforceable on that date.
| Phase | Effective date | What activates |
|---|---|---|
| Phase 1 | 13 November 2025 | Data Protection Board established; complaint procedure live |
| Phase 2 | 13 November 2026 | Consent Manager registration framework (Rule 4, First Schedule) |
| Phase 3 | 13 May 2027 | Notice, consent, security safeguards, breach reporting, children's data, cross-border rules |
The government did not rush to that final rule text. It released the draft Rules for public consultation on 3 January 2025 and received 6,915 inputs from startups, MSMEs, industry bodies, civil society groups, and citizens through consultations held in Delhi, Mumbai, Guwahati, Kolkata, Hyderabad, Bengaluru, and Chennai before finalizing the version notified in November.
How much can regulators fine companies under the DPDP Act?
The DPDP Act's Schedule, referenced under Section 33(1), sets fixed rupee ceilings rather than a percentage-of-turnover formula like GDPR. The Data Protection Board sets the actual penalty within each ceiling based on the nature, duration, and impact of the violation.
Figure 3: Security failures carry the single largest penalty cap in the Act. Source: DPDP Act, 2023, Schedule under Section 33(1).
| Violation | Section | Maximum penalty |
|---|---|---|
| Failure to implement reasonable security safeguards | Section 8(5) | 250 crore rupees |
| Failure to notify the Board or affected individuals of a breach | Section 8(6) | 200 crore rupees |
| Non-compliance with children's data obligations | Section 9 | 200 crore rupees |
| Breach of Significant Data Fiduciary obligations | Section 10 | 150 crore rupees |
| Breach of any other provision of the Act or Rules | Catch-all | 50 crore rupees |
A separate, much smaller provision applies to individuals rather than companies: a Data Principal who provides false information or files a frivolous complaint faces a penalty of up to 10,000 rupees under Section 15. That gap, from 10,000 rupees for an individual's bad-faith complaint to 250 crore rupees for a company's security failure, illustrates how heavily the Act's deterrence is aimed at data fiduciaries rather than the people whose data they hold.
Who counts as a Significant Data Fiduciary, and what extra applies to them?
Every organization that processes personal data digitally in India, or that offers goods or services to people in India, is a Data Fiduciary under the Act and owes baseline obligations: give notice before or at the time of collecting personal data, obtain valid consent, and implement reasonable security safeguards. A subset gets designated a Significant Data Fiduciary based on factors including the volume and sensitivity of personal data processed, the risk to individuals' rights, and potential impact on India's sovereignty, public order, or electoral integrity.
Figure 4: The baseline obligations apply to every Data Fiduciary; Significant Data Fiduciary status adds a dedicated compliance layer. Source: DPDP Act, 2023, Sections 8 and 10; DPDP Rules 2025.
A Significant Data Fiduciary must appoint a Data Protection Officer based in India who answers to its board of directors, and it must complete a Data Protection Impact Assessment and an independent data audit at least once every 12 months from the date of its designation. Because the baseline notice obligation applies to every Data Fiduciary regardless of size, a privacy policy is typically the first document a compliance review checks; you can generate a DPDP-ready privacy policy that itemizes what personal data you collect, why, and how long you retain it, in the format the Act's notice requirement expects.
Is India's regulator ready to enforce the law?
Not yet, and that gap is unusually visible for a law this far into its rollout. The Data Protection Board of India's establishment provisions took effect on 13 November 2025, but as of August 2026 the Board had no appointed Chairperson and no appointed Members. The Ministry of Electronics and Information Technology issued a notification dated 6 May 2026 inviting applications for the Chairperson and Member posts, followed by a further notification on 6 June 2026, and reporting through mid-2026 indicates the Search-cum-Selection process was still at the stage of soliciting names rather than finalizing them.
Info
A notified deadline does not wait for the regulator that enforces it. Consent Managers cannot register with a Board that is not accepting applications, and any business relying on a registered Consent Manager for the 13 November 2026 deadline has no counterparty to integrate with yet. Legal commentary consistently advises treating the phase dates as live regardless of the Board's staffing status, since institutional readiness has historically been a poor predictor of whether a notified deadline gets enforced on schedule.
Figure 5: Fewer than one in five surveyed enterprises had moved meaningfully past the planning stage. Source: EY India, "India's Digital Privacy Crossroads" (January 2026).
The Consent Manager framework that activates in November 2026 sets a demanding bar even once the Board is staffed: registration requires incorporation in India, a minimum net worth of 2 crore rupees, a fiduciary duty toward the Data Principal, technical capability to keep routed personal data unreadable to the Consent Manager itself, and consent-record retention of at least seven years. Separately, once Phase 3 obligations take effect, the DPDP Rules set a two-stage breach notification process: a Data Fiduciary must inform the Board and affected individuals without delay with an initial description of a breach, then submit a detailed follow-up report to the Board within 72 hours, or a longer period if the Board grants a written extension request.
The Bottom Line
The headline numbers tell a consistent story: a law that took two years to get operating rules, a rules package that phases in obligations over another 18 months, and a compliance rate among Indian businesses that lags every one of those dates so far. Eighty-three percent of surveyed enterprises had not begun comprehensive implementation as of January 2026, even as the Consent Manager deadline in November 2026 and the full compliance deadline in May 2027 remain fixed. The unstaffed Data Protection Board does not change either date; it mainly means businesses have less regulatory guidance than they might expect this close to enforcement, which raises the value of getting baseline notice, consent, and security-safeguard obligations right without waiting for an active enforcement track record to force the issue. India's rollout is part of a broader pattern of Asia-Pacific enforcement regimes maturing at different speeds, a comparison covered in our global privacy law tracker and in China's PIPL enforcement data, where a similarly quiet early period gave way to a small number of very large fines.
Frequently Asked Questions
What percentage of Indian businesses are ready for the DPDP Act? Only 17 percent of Indian enterprises had begun comprehensive DPDP Act implementation as of EY India's survey published in January 2026, meaning 83 percent had not, based on responses from nearly 150 professionals across nine sectors.
When do businesses have to fully comply with India's DPDP Act? 13 May 2027, the third and final phase of the DPDP Rules 2025 rollout. The Consent Manager registration framework activates earlier, on 13 November 2026, and the Data Protection Board of India's establishment provisions took effect on 13 November 2025.
What is the maximum fine under India's DPDP Act? Up to 250 crore rupees, roughly $29 million, for failing to implement reasonable security safeguards to prevent a personal data breach, the single largest penalty in the Act's Schedule under Section 33(1). Separate caps of 200 crore rupees apply to breach-notification failures and to violations of children's data obligations, and 150 crore rupees applies to Significant Data Fiduciary obligations.
Has India's Data Protection Board started operating? Not fully. The Board's establishment provisions took effect in November 2025, but as of August 2026 no Chairperson or Members had been appointed. The Ministry of Electronics and Information Technology issued a fresh call for nominations in May 2026 and a follow-up notice in June 2026, according to reporting on the appointment process.
Where the Numbers Come From
- EY India. (2026). "India's Digital Privacy Crossroads: Understanding the DPDP Act and Rules' Impact and Enterprise Readiness." Survey of nearly 150 professionals across nine sectors, published January 2026.
- Press Information Bureau, Government of India. (2025). "DPDP Rules, 2025 Notified." Gazette notification 13 November 2025; consultation figures including 6,915 inputs received.
- LiveLaw. (2023). "President Gives Assent To Digital Personal Data Protection Act 2023." Lok Sabha and Rajya Sabha passage dates, presidential assent 11 August 2023.
- DPDPA.com. Legal interpretation of the Schedule to the Digital Personal Data Protection Act, 2023, referenced under Section 33(1). Penalty amounts by violation category.
- ComplianceHub.Wiki. (2026). "India's Consent Manager Deadline Lands 13 November 2026, and the Regulator That Is Supposed to Register Them Does Not Yet Exist." Data Protection Board staffing status and Consent Manager registration conditions, checked August 2026.
- Business Today. (2025). "MeitY Releases Draft Rules of DPDP Act for Public Consultation." Draft Rules released 3 January 2025.
Note: All figures verified as of August 2026. The Data Protection Board of India's appointment status, and the corresponding readiness of the Consent Manager registration process, were unresolved at the time of writing and may change before this post's next scheduled refresh.
