DPDP deadline: is the 18 month window being cut to 12 months?

On 22 January 2026 Business Standard reported that MeitY had put a proposal to industry at a stakeholder meeting: cut the compliance window for Significant Data Fiduciaries, on certain provisions, from 18 months to 12. Within 6 weeks the report had been repeated by Moneycontrol, summarised by cadp.in and written up by S.S. Rana & Co., and not one of those accounts rests on a government document.

No instrument changing the commencement periods has been located. On 12 October 2026, the date this page was last reviewed, this site's source registry and timeline still record none, and the 3 phase commencement set on 13 November 2025 still runs on the same 3 periods, changed since only by the corrigenda of 10 December 2025, which reworded the closing words of Rule 1(3) and Rule 1(4) without touching either period. No document about the proposal was found when MeitY's own library was enumerated in full on 1 September 2026, nor when it was enumerated again on 9 October 2026. So far as this site's source registry records, the Act's wording has been changed once in that time, and not on this subject: the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), made under section 43(1) on 5 October 2026 and published in Gazette issue No. 5248 whose printed masthead is dated 6 October 2026, substitutes words in sections 9(1) and 10(2)(c)(ii) and amends neither G.S.R. 843(E) nor Rule 1, so it moves no date on this page. What it changes is set out in the Removal of Difficulties Order explained. The comment deadline that one account reports, and only one, the S.S. Rana commentary of 13 February 2026, was 4 February 2026: if that date is right, the window for industry to answer closed just over 8 months before this review.

That gap between what is reported and what is in force is the whole subject of this page. Below is the notified position, the reporting with its chain of attribution set out, the 4 places where the accounts disagree with each other, what MeitY has actually published, and what an amendment would take if one comes.

Diagram headed "4 accounts report a 12 month deadline, 0 instruments on file appoint one, and nothing has moved", setting the notified commencement position against the reporting behind the reported 12 month window, read as at 6 September 2026. A table at the top gives the 3 groups. On publication: on the Act side sections 1(2) and 2, 18 to 26, 35, 38 to 43, 44(1) and (3), and on the Rules side Rules 1, 2 and 17 to 21, dated 13 November 2025 and official. The 1 year group: section 6(9) and section 27(1)(d), and Rule 4, dated 13 November 2026 and computed. The 18 month group: sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 other than 27(1)(d), 28 to 34, 36, 37 and 44(2), and Rules 3, 5 to 16, 22 and 23, dated 13 May 2027 and computed. Neither instrument states a calendar date, so both computed dates are interpretation until officially confirmed. A highlighted band carries the arithmetic no account carries, marked as this site's reading: rule 1(3) already points at 13 November 2026, so a 12 month window counted from the same publication would create no new deadline but pull the 18 month group back onto the date the 1 year group already occupies, leaving 1 date to carry both the Consent Manager framework and the main duties. 3 panels sit underneath. The 5 accounts, of which 0 cite a government document and only 4 report a 12 month deadline: 17 November 2025, The Indian Express, the Minister on the record that the timeline will be compressed and the law amended, naming no period, no provision and no instrument; 22 January 2026, Business Standard, the proposal itself on unnamed sources, MeitY not responding before press time; 23 January 2026, Moneycontrol, attributing it to sources who told Business Standard; 13 February 2026, S.S. Rana and Co., adding a comment deadline and a date while footnoting press coverage only; and 28 February 2026, cadp.in, naming Moneycontrol as its original source. What MeitY's own library holds: enumerated in full on 1 September 2026 rather than searched, because the endpoint ignores its own search term; 2,401 records held, 28 naming the DPDP framework, 0 being a consultation note, an office memorandum or a draft amendment answering to the proposal, and 0 recording the meeting; the only record titled Enforcement Timeline of the DPDP Act is G.S.R. 843(E) itself, byte identical to the eGazette copy archived here; and re run as a diff on 4 September 2026 and again on 6 September 2026 it reported 28 archived, 28 live, 0 added and 0 removed both times, though an enumeration cannot prove absence and the eGazette was not queried at all. The 4 places the accounts disagree: the date of the meeting, 22 January 2026 against 23 January 2026 where the originating report says Thursday, which the later date was not; who it applies to, Significant Data Fiduciaries only or the Act across the board, with the widest account leaving it open; what the existing deadline is, 1 account giving May 13, 2027 once and May 13, 2026 in 3 later places, which reverses the direction of travel; and whether comments were invited, 1 of the 5 accounts reporting a deadline of 4 February 2026 and the other 4 reporting none. The source line records commencement notification G.S.R. 843(E), and Rule 1 of the DPDP Rules 2025 as corrected by corrigenda G.S.R. 892(E) of 10 December 2025, which reaches the Rules and not G.S.R. 843(E), both instruments being dated 13 November 2025.

What is notified today

Commencement is set by 2 instruments, one for the Act and one for the Rules, both dated 13 November 2025. Neither states a calendar deadline. Each states a period running from publication, which is why every date in the last column below is computed and carries the interpretation label.

The words that set the longest period are those of Rule 1(4). They are quoted inline rather than as a captioned figure, because the closing words are the ones corrigenda G.S.R. 892(E) substituted, so this is the operative reading of the sub rule rather than the wording on Gazette page 24: "Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette."

Notice what it does not contain: a date. The Act side reads the same way, fixing "eighteen months from the date of publication of this gazette". A period counted from publication is what makes 13 May 2027 an inference rather than a fact of the Gazette, and it is also what makes the 1 day argument about 13 or 14 November matter at all.

One consequence of the arithmetic is worth pulling out, because none of the reporting mentions it. Rule 1(3) already points at the same date a 12 month window would produce, and it is quoted inline for the same reason, since the same corrigenda item reaches its closing words too: "Rule 4 shall come into force one year after the date of publication in the Official Gazette."

So a 12 month window counted from the same publication date would not create a new deadline. It would pull the 18 month group back onto the date the 1 year group already sits on, and that single date, computed as 13 November 2026 and interpretation until officially confirmed, would carry both the Consent Manager registration framework and the main body of operational duties. That is this site's reading of the arithmetic and not a statement of any instrument, and it holds only if an amendment kept counting from the publication of the Rules rather than from its own notification.

What was reported, and by whom

The reporting is easier to weigh once the chain is drawn rather than described.

The first row is the only on the record item about the timeline that predates the reported meeting. Asked by The Indian Express on 17 November 2025 why big technology companies and startups had been given the same runway, the Union Minister for Electronics and Information Technology answered:

"That is something we are talking to the industry about. It is right that big companies already follow laws like Europe’s General Data Protection Regulation (GDPR). We will compress the timeline. We will amend the law"

That is a statement of intention, and it is over 10 months old as at the 12 October 2026 review of this page. It names no period, no provision and no instrument. The same report said the government "will soon issue an amendment to that end"; as at that review, on which this site's source registry and timeline were both re read, they record no instrument compressing the timeline. The 1 instrument they hold that changes the Act's wording, S.O. 5458(E), concerns sections 9(1) and 10(2)(c)(ii) and not when anything comes into force.

The second row is where the substance comes from, and it is worth reading in the words used rather than the headline built on them:

"The Ministry of Electronics and Information Technology (Meity) is likely to shorten the implementation timeline for certain provisions under the administrative rules of the Digital Personal Data Protection (DPDP) Act for significant data fiduciaries (SDFs) to 12 months from the earlier 18 months, sources told Business Standard ."

"Is likely to", on unnamed sources, for certain provisions, for one class of entity. The same report records that MeitY did not confirm it:

"An email sent to the ministry seeking its response to the proposed changes did not elicit any response until press time."

One branch of what follows is a retelling. Moneycontrol's account of the next morning says so in terms, ending its opening sentence with "sources told Business Standard", and cadp.in names Moneycontrol as its original source, so that branch rests entirely on the 22 January report. The S.S. Rana branch does not: it adds a comment deadline, a resulting date and a provision by provision reading that appear in no other account read here, and the footnote carrying its central claim points at a Financial Express report this site has not obtained. What is true of every branch is that not one of them footnotes a government document.

The 4 places the accounts disagree

None of the accounts can be checked against a government document, because none has been located. They can be checked against each other, and they do not agree.

The date of the meeting. cadp.in says 22 January 2026. S.S. Rana says 23 January 2026. The originating report does not give a date at all; it says the changes were proposed "during a stakeholder meeting on Thursday", and it was published on Thursday 22 January 2026, which points at that day. That is a reading of the report rather than a fact it states. The calendar also makes one of the 2 dates impossible on the originating report's own terms: 23 January 2026 was a Friday, so it cannot be the Thursday that report describes. A 1 day disagreement about a meeting nobody has published minutes of is a fair measure of how firm the rest is.

Who it applies to. The originating report and cadp.in both confine the compression to Significant Data Fiduciaries. S.S. Rana confines its own section on the compression to them too, but its introduction frames the change as cutting the compliance deadline under the Act without qualification, and it closes by saying in terms that it remains to be seen whether the provisions would be enforced for Data Fiduciaries across the board or only for Significant Data Fiduciaries. So the widest account leaves its own scope expressly open. The 2 readings are very different propositions: Significant Data Fiduciary status only exists once the Central Government notifies an entity or class under section 10(1), and section 10 is itself in the 18 month group, so on the notified position nobody is an SDF yet.

What the existing deadline is. The S.S. Rana commentary gives it as May 13, 2027 in its introduction and then as "May 13, 2026" in 3 later places, including this one:

"The SDFs will be required to fulfill compliance with the DPDPA latest by November 13, 2026, which was earlier set to be May 13, 2026."

18 months after 13 November 2025 is May 2027, so the introduction is right and the body is wrong. It matters because the sentence quoted is the one a reader is most likely to lift: it turns a proposal to move a deadline forward by 6 months into a proposal to move it back by 6.

Whether comments were invited at all. Only S.S. Rana reports a deadline for feedback, 4 February 2026. The originating report gives none and cadp.in gives none. If that date is right, the window for industry to respond closed nearly 7 months before this page was written, and just over 8 months before it was last reviewed.

What MeitY has published

The check that resolves none of the above, and is the most useful thing on this page: MeitY's own document index.

That index can be read whole rather than searched, which is what was done here on 1 September 2026. The ministry's document endpoint takes a search term and ignores it: a nonsense term and "data protection rules" both return the identical set of 2,401 records, which its own total_items field confirms is everything it holds. So this is an enumeration of MeitY's entire published library and not a keyword search of it, and that is a stronger check, because a keyword search can miss a document that does not use your words.

Of those 2,401 records, 28 name the DPDP Act, the Rules, a Data Fiduciary, a Consent Manager or the Data Protection Board in their title or in the fields the index returns. 8 of the 28 are dated in 2026. That subset is a keyword filter and the limit belongs here: the enumeration reads the library's index in full, not the text of the documents in it, so a paper whose title and index fields never name the framework would not appear among the 28. There is no consultation note, no office memorandum and no draft amendment answering to the reported proposal, and no record of the January 2026 stakeholder meeting at all.

Both figures are from the capture archived on 1 September 2026, which is the file the 2 figures above rest on, and the library was read again on 4 September 2026 with the report form of the same script, node scripts/meity-index.mjs, which is the form that prints the library total and the control. That second read is not archived here, so its figures can be re measured but not reproduced against a file. The 2 numbers moved differently, and keeping them apart is the point. The library as a whole held 2,411 records that day, 10 more than the archive; the DPDP subset was unchanged at 28, the same 28 entries with none added, none removed and none retitled. So the ministry's publishing has grown over those 3 days and none of the growth reaches its DPDP material, on the same keyword filter and subject to the same limit as above. The control ran again on that report: a nonsense term and "data protection rules" returned the identical 2,411 records, and the endpoint's own total_items agreed, so the second read was an enumeration on the same terms as the first. The diff carries the same control and exits non zero if the endpoint ever starts filtering, which is what makes a green tripwire evidence that the enumeration is still an enumeration.

One record in that library is worth naming, because a reader opening the archived enumeration will see it and wonder whether this page has read it. An entry of 14 November 2025 titled Enforcement Timeline of the DPDP Act, id 25211, sits in the same library and is on exactly this page's subject. MeitY's copy was downloaded from https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf on 1 September 2026 and compared, and it is not a MeitY explainer of the timeline: it is Gazette issue No. 757 itself, the commencement notification G.S.R. 843(E). It is byte identical to the eGazette copy this site archives, both hashing to SHA256 6df25cd8c76ac8eb18cae81835d51d51128ffbf2ed13262843395efddf0998e5, so the comparison can be repeated rather than taken on trust. So the only thing MeitY publishes under the heading Enforcement Timeline of the DPDP Act is the notification this page is built on, and no other account of the timeline appears anywhere in the enumerated library.

The library was enumerated in full again on 9 October 2026, with the same control passing, and that capture is archived too. It held 1,564 records, fewer than the 2,401 of 1 September, and 19 of them name the framework on the same keyword filter, against 28 then; this page does not explain the difference and rests nothing on it. 7 of the 19 are dated in 2026. Read by title, they are the summary of submissions of 14 January 2026, 4 records on recruitment for the Data Protection Board and for a DPDPA project, and S.O. 5458(E) listed twice. There is still no consultation note, no office memorandum and no draft amendment answering to the reported proposal, and still no record of the January 2026 stakeholder meeting; the record titled Enforcement Timeline of the DPDP Act is still listed under 14 November 2025. The library listed S.O. 5458(E) on 9 October 2026, 3 days after its Gazette masthead date, which is a reminder that a published library trails the Gazette: it corroborates a negative and does not prove one.

An enumeration still cannot prove a document does not exist. It can establish that none has been published where this ministry publishes its DPDP documents, and the archive shows what that library holds: the Act itself, the draft Rules of 3 January 2025, the notice extending the consultation on them, the notified Rules, the corrigendum, the Data Protection Board papers, the commencement notification and, since 9 October 2026, S.O. 5458(E).

What the 8 of the 1 September 2026 capture were is worth setting out, because 3 of them were substantive and none was about commencement timing. The circular of 6 May 2026 inviting applications for the Chairperson and 4 Members of the Data Protection Board, and the advertisement issued with it, account for 2 of the 3. Their subject is appointments, so their silence on commencement timing proves nothing; what they do show is that the ministry was still publishing detailed DPDP documents in May 2026, addressed to every Ministry, Department, State and Union Territory, so the absence of anything about the proposal is not the absence of DPDP publishing. The remaining 5 records in that capture were 2 recruitment advertisements by Digital India Corporation, 2 site entries repeating the same Board vacancy, and a banner image for a DPDPA workshop uploaded on 6 July 2026 that carried no document; the 9 October 2026 capture lists only 1 of those advertisements, 1 of those vacancy entries and no banner.

The third substantive document is the one that speaks to commencement, and it points the other way. It is a summary of the submissions received on the draft Rules, published on 14 January 2026, 8 days before the reported meeting. It records the scale of that consultation:

"processing 6,951 comments and submissions received via the MyGov portal"

And its very first substantive entry, the feedback on Rule 1, is the one worth quoting in full, because it runs the other way to the proposal:

"Need for a clearly defined implementation period and calls for phased rollouts and exemptions based on entity size."

"Allow additional time for notified significant data fiduciaries (SDFs) to comply once designated."

Those 2 lines are everything MeitY's published record says stakeholders asked for on commencement. The class the reported proposal would accelerate first is the class the published record shows asking for more time once designated. That is not evidence the proposal is untrue. It is evidence that the most recent published MeitY material on the question points the opposite way, which is the sort of thing a page telling you a deadline has moved ought to mention.

What an amendment would actually take

The machinery is not the obstacle here, and that is worth being precise about, because "it would need an act of Parliament" is a common and wrong assumption. Every power involved is already in force.

On the Rules side, an amendment to Rule 1 would be made under section 40(1):

"The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act."

Section 40 is in the group that commenced on 13 November 2025, so the power is live. The sub section attaches a condition of previous publication to its exercise. What that condition requires is settled by general law that is not on file here, so this site does not state what satisfies it; what can be said from the text alone is that the power carries a publication condition, and that a closed stakeholder meeting with no published document is not obviously a publication.

Rules made under the Act are also laid before Parliament:

"Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days …"

On this site's reading the qualifier attaches to the notifications and every rule is laid, because the section is headed Laying of rules and certain notifications, and because neither section 16 nor section 42 confers a power to make rules, so a rule "made under section 16 and section 42" would be an empty class. That is a construction and not the words of the Act. Either way the laying happens after the rule is made, so it delays nothing.

On the Act side the power is section 1(2):

"It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act …"

This is where a genuine question sits, and it is one no source read for this page addresses. The Central Government has already exercised that power, in G.S.R. 843(E), for every provision it named. Whether it can exercise it again to appoint an earlier date for provisions whose commencement date is already appointed but has not yet arrived is not answered by section 1(2), by G.S.R. 843(E) or by the Rules. This site does not assert an answer. It is flagged because the reported package needs exactly that step for section 10(1), for section 17(2) and for section 36, which are Act provisions rather than rules, and because a reader planning against the reported dates is relying on it without being told.

If it happened, what would move

Set out against the notified position, the reported package is 5 separate changes with 4 different clocks. Nothing in this table is in force, and nothing in it is proposed by any document this site has been able to locate.

3 of those 5 have no date at all, because they run from an instrument nobody has produced. The retention limb is the clearest example:

"While this requirement was earlier slated to be implemented within 18 months, the government is now likely to propose that it be operationalised within 90 days of the amended rules being notified in the Gazette of India, another source said."

90 days from a notification nobody has seen is not a deadline anyone can plan to. The retention floor in Rule 8(3) and the cross border provisions are the 2 limbs with real build time behind them, and both are in the 18 month group today.

What this means for a compliance plan

This part is a recommendation and not a requirement of any instrument.

Plan to the notified dates, because they are the only ones that exist, and treat the reported proposal as a reason to sequence work rather than to change the target. 2 things follow from the arithmetic rather than from the reporting.

First, the computed November 2026 date already exists in the framework, but it binds a narrow class. Rule 4 and section 6(9) govern the registration and obligations of Consent Managers, and section 27(1)(d) gives the Board a power over breaches of those registration conditions. An ordinary Data Fiduciary owes nothing on that date. If the reported change were notified, that same date would acquire the rest of the framework, so an organisation that has already done Consent Manager side work for 13 November 2026 has a shorter distance to travel than the headline suggests, and one that has not is looking at the whole 18 month programme on a 12 month clock.

Second, the limbs reported as immediate are the ones to look at now, because they are the ones with no runway at all if they land. Restrictions on transfers outside India and a power to call for information both start operating on the day an instrument says so. That is an argument for knowing where your data sits and what you could produce on request, which is work worth doing under the notified timetable in any case.

What this page will not do is compute a date from a proposal. Every calendar date on this site is derived from a published instrument and labelled where it is derived; a date derived from a report of a meeting would be a different kind of thing entirely.

What would change this page

The tripwire is specific. This page changes when an instrument changing the commencement periods appears in the Gazette of India, or when MeitY publishes the consultation document behind the reported proposal. Either would be found in the same 2 places the rest of this site's commencement material comes from: the eGazette, and MeitY's own document library, which is listed with the rest of the official documents here.

Of those 2 places, only the second was read for this page, and the limit is worth stating plainly rather than leaving a reader to assume otherwise. MeitY's library was enumerated in full and is archived here. The eGazette was not queried: its search runs as a browser session form that this site's checks cannot drive, so the negative above rests on MeitY's own library and on this site's source registry, not on a search of the Gazette itself.

The tripwire is a diff and not a memory, which is what lets this page report a date later than the archive it is built on. Running node scripts/meity-index.mjs --check re enumerates the library and compares its DPDP records against the latest archived capture, and it exits non zero if a single record has been added, removed or retitled. Against the 1 September capture it was run on 4 September 2026 and again on 6 September 2026, and reported 28 records archived, 28 live, 0 added, 0 removed both times. The capture it now diffs against is the one of 9 October 2026, and on 12 October 2026 it reported 19 records archived, 19 live, 0 added, 0 removed. This site's source registry and timeline were re read on 12 October 2026 and register no instrument changing the commencement periods, the most recent instrument touching Rule 1 in either being the corrigenda of 10 December 2025. The registry does hold S.O. 5458(E), which changes the wording of sections 9(1) and 10(2)(c)(ii) and not commencement, and other amending Acts, the Jan Vishwas Acts of 2023 and 2026 among them, neither of which touches this framework. Neither check reaches the Gazette, so the dates above narrow what has been looked at rather than widening what is claimed.

Until one of those appears, the position is the one at the top: the 18 month group has not moved, the calendar dates for it and for the 1 year group are computed and are interpretation until officially confirmed, and the only change to the commencement position since 13 November 2025 is the corrigenda of 10 December 2025, which reworded Rule 1(3) and Rule 1(4) without moving either date.