Vakil Help Desk News: the DPDP framework is rolling out in phases, with core business obligations expected by 2027. We set out the timeline and a practical checklist to be ready in time.
Vakil Help Desk News, DPDP & Data Privacy. With the DPDP Rules, 2025 notified, the framework is being implemented in phases. Businesses have time to prepare — but the core obligations arrive on a fixed clock, so the work should start now.
The phases
- Phase 1: standing up the Data Protection Board of India, which will hear complaints and impose penalties.
- Phase 2: registration of consent managers — the entities that help people give, manage and withdraw consent.
- Phase 3 (expected 2027): the core obligations for data fiduciaries take effect — data-principal rights, security safeguards and breach reporting.
What to have ready before the core obligations bite
- Valid data-processing contracts with every vendor that handles personal data for you.
- Clear privacy notices — the framework contemplates notices in multiple Indian languages.
- Working consent mechanisms where consent is the basis for processing.
- Reasonable security safeguards to prevent breaches.
- A process to handle access, correction and erasure requests.
- A published grievance-redress timeline (not exceeding the prescribed limit), and a breach-reporting process to the Board.
Why act now
These controls take months to design, contract and test. Starting early turns a deadline into an orderly project instead of a last-minute scramble.
What this means for you
Treat 2027 as the date your controls must already be working, not the date to start. Build a phased plan now: data mapping, vendor contracts, notices and consent, security safeguards, data-principal request handling, grievance timelines and breach reporting. We help businesses build a practical, staged DPDP compliance roadmap and the underlying documents.