DPDP deadline: is the 18 month window being cut to 12 months?

On 22 January 2026 Business Standard reported that MeitY had put a proposal to industry at a stakeholder meeting: cut the compliance window for Significant Data Fiduciaries, on certain provisions, from 18 months to 12. Within 6 weeks the report had been repeated by Moneycontrol, summarised by cadp.in and written up by S.S. Rana & Co., and not one of those accounts rests on a government document.

No amending instrument has been located. On 1 September 2026, the date this page was verified, the 3 phase commencement set on 13 November 2025 still runs on the same 3 periods, changed since only by the corrigenda of 10 December 2025, which reworded the closing words of Rule 1(3) and Rule 1(4) without touching either period. No document about the proposal was found when MeitY's own library was enumerated that day, and the comment deadline that one account reports passed almost 7 months ago.

That gap between what is reported and what is in force is the whole subject of this page. Below is the notified position, the reporting with its chain of attribution set out, the 4 places where the accounts disagree with each other, what MeitY has actually published, and what an amendment would take if one comes.

What is notified today

Commencement is set by 2 instruments, one for the Act and one for the Rules, both dated 13 November 2025. Neither states a calendar deadline. Each states a period running from publication, which is why every date in the last column below is computed and carries the interpretation label.

The words that set the longest period are those of Rule 1(4). They are quoted inline rather than as a captioned figure, because the closing words are the ones corrigenda G.S.R. 892(E) substituted, so this is the operative reading of the sub rule rather than the wording on Gazette page 24: "Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette."

Notice what it does not contain: a date. The Act side reads the same way, fixing "eighteen months from the date of publication of this gazette". A period counted from publication is what makes 13 May 2027 an inference rather than a fact of the Gazette, and it is also what makes the 1 day argument about 13 or 14 November matter at all.

One consequence of the arithmetic is worth pulling out, because none of the reporting mentions it. Rule 1(3) already points at the same date a 12 month window would produce, and it is quoted inline for the same reason, since the same corrigenda item reaches its closing words too: "Rule 4 shall come into force one year after the date of publication in the Official Gazette."

So a 12 month window counted from the same publication date would not create a new deadline. It would pull the 18 month group back onto the date the 1 year group already sits on, and that single date, computed as 13 November 2026 and interpretation until officially confirmed, would carry both the Consent Manager registration framework and the main body of operational duties. That is this site's reading of the arithmetic and not a statement of any instrument, and it holds only if an amendment kept counting from the publication of the Rules rather than from its own notification.

What was reported, and by whom

The reporting is easier to weigh once the chain is drawn rather than described.

The first row is the only on the record item about the timeline that predates the reported meeting. Asked by The Indian Express on 17 November 2025 why big technology companies and startups had been given the same runway, the Union Minister for Electronics and Information Technology answered:

"That is something we are talking to the industry about. It is right that big companies already follow laws like Europe’s General Data Protection Regulation (GDPR). We will compress the timeline. We will amend the law"

That is a statement of intention, and it is over 9 months old as at the verification date of this page. It names no period, no provision and no instrument. The same report said the government "will soon issue an amendment to that end"; as at the 1 September 2026 verification this site's source registry and timeline record none.

The second row is where the substance comes from, and it is worth reading in the words used rather than the headline built on them:

"The Ministry of Electronics and Information Technology (Meity) is likely to shorten the implementation timeline for certain provisions under the administrative rules of the Digital Personal Data Protection (DPDP) Act for significant data fiduciaries (SDFs) to 12 months from the earlier 18 months, sources told Business Standard ."

"Is likely to", on unnamed sources, for certain provisions, for one class of entity. The same report records that MeitY did not confirm it:

"An email sent to the ministry seeking its response to the proposed changes did not elicit any response until press time."

One branch of what follows is a retelling. Moneycontrol's account of the next morning says so in terms, ending its opening sentence with "sources told Business Standard", and cadp.in names Moneycontrol as its original source, so that branch rests entirely on the 22 January report. The S.S. Rana branch does not: it adds a comment deadline, a resulting date and a provision by provision reading that appear in no other account read here, and the footnote carrying its central claim points at a Financial Express report this site has not obtained. What is true of every branch is that not one of them footnotes a government document.

The 4 places the accounts disagree

None of the accounts can be checked against a government document, because none has been located. They can be checked against each other, and they do not agree.

The date of the meeting. cadp.in says 22 January 2026. S.S. Rana says 23 January 2026. The originating report does not give a date at all; it says the changes were proposed "during a stakeholder meeting on Thursday", and it was published on Thursday 22 January 2026, which points at that day. That is a reading of the report rather than a fact it states. The calendar also makes one of the 2 dates impossible on the originating report's own terms: 23 January 2026 was a Friday, so it cannot be the Thursday that report describes. A 1 day disagreement about a meeting nobody has published minutes of is a fair measure of how firm the rest is.

Who it applies to. The originating report and cadp.in both confine the compression to Significant Data Fiduciaries. S.S. Rana confines its own section on the compression to them too, but its introduction frames the change as cutting the compliance deadline under the Act without qualification, and it closes by saying in terms that it remains to be seen whether the provisions would be enforced for Data Fiduciaries across the board or only for Significant Data Fiduciaries. So the widest account leaves its own scope expressly open. The 2 readings are very different propositions: Significant Data Fiduciary status only exists once the Central Government notifies an entity or class under section 10(1), and section 10 is itself in the 18 month group, so on the notified position nobody is an SDF yet.

What the existing deadline is. The S.S. Rana commentary gives it as May 13, 2027 in its introduction and then as "May 13, 2026" in 3 later places, including this one:

"The SDFs will be required to fulfill compliance with the DPDPA latest by November 13, 2026, which was earlier set to be May 13, 2026."

18 months after 13 November 2025 is May 2027, so the introduction is right and the body is wrong. It matters because the sentence quoted is the one a reader is most likely to lift: it turns a proposal to move a deadline forward by 6 months into a proposal to move it back by 6.

Whether comments were invited at all. Only S.S. Rana reports a deadline for feedback, 4 February 2026. The originating report gives none and cadp.in gives none. If that date is right, the window for industry to respond closed nearly 7 months before this page was written.

What MeitY has published

The check that resolves none of the above, and is the most useful thing on this page: MeitY's own document index.

That index can be read whole rather than searched, which is what was done here on 1 September 2026. The ministry's document endpoint takes a search term and ignores it: a nonsense term and "data protection rules" both return the identical set of 2,401 records, which its own total_items field confirms is everything it holds. So this is an enumeration of MeitY's entire published library and not a keyword search of it, and that is a stronger check, because a keyword search can miss a document that does not use your words.

Of those 2,401 records, 28 name the DPDP Act, the Rules, a Data Fiduciary, a Consent Manager or the Data Protection Board in their title or in the fields the index returns. 8 of the 28 are dated in 2026. That subset is a keyword filter and the limit belongs here: the enumeration reads the library's index in full, not the text of the documents in it, so a paper whose title and index fields never name the framework would not appear among the 28. There is no consultation note, no office memorandum and no draft amendment answering to the reported proposal, and no record of the January 2026 stakeholder meeting at all.

One record in that library is worth naming, because a reader opening the archived enumeration will see it and wonder whether this page has read it. An entry of 14 November 2025 titled Enforcement Timeline of the DPDP Act, id 25211, sits in the same library and is on exactly this page's subject. MeitY's copy was downloaded from www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf on 1 September 2026 and compared, and it is not a MeitY explainer of the timeline: it is Gazette issue No. 757 itself, the commencement notification G.S.R. 843(E). It is byte identical to the eGazette copy this site archives, both hashing to SHA256 6df25cd8c76ac8eb18cae81835d51d51128ffbf2ed13262843395efddf0998e5, so the comparison can be repeated rather than taken on trust. So the only thing MeitY publishes under the heading Enforcement Timeline of the DPDP Act is the notification this page is built on, and no other account of the timeline appears anywhere in the enumerated library.

An enumeration still cannot prove a document does not exist. It can establish that none has been published where this ministry publishes its DPDP documents, and the archive shows what that library holds: the Act itself, the draft Rules of 3 January 2025, the notice extending the consultation on them, the notified Rules, the corrigendum, the Data Protection Board papers and the commencement notification.

What the 8 are is worth setting out, because 3 of them are substantive and none is about commencement timing. The circular of 6 May 2026 inviting applications for the Chairperson and 4 Members of the Data Protection Board, and the advertisement issued with it, account for 2 of the 3. Their subject is appointments, so their silence on commencement timing proves nothing; what they do show is that the ministry was still publishing detailed DPDP documents in May 2026, addressed to every Ministry, Department, State and Union Territory, so the absence of anything about the proposal is not the absence of DPDP publishing. The remaining 5 records are 2 recruitment advertisements by Digital India Corporation, 2 site entries repeating the same Board vacancy, and a banner image for a DPDPA workshop uploaded on 6 July 2026 that carries no document.

The third substantive document is the one that speaks to commencement, and it points the other way. It is a summary of the submissions received on the draft Rules, published on 14 January 2026, 8 days before the reported meeting. It records the scale of that consultation:

"processing 6,951 comments and submissions received via the MyGov portal"

And its very first substantive entry, the feedback on Rule 1, is the one worth quoting in full, because it runs the other way to the proposal:

"Need for a clearly defined implementation period and calls for phased rollouts and exemptions based on entity size."

"Allow additional time for notified significant data fiduciaries (SDFs) to comply once designated."

Those 2 lines are everything MeitY's published record says stakeholders asked for on commencement. The class the reported proposal would accelerate first is the class the published record shows asking for more time once designated. That is not evidence the proposal is untrue. It is evidence that the most recent published MeitY material on the question points the opposite way, which is the sort of thing a page telling you a deadline has moved ought to mention.

What an amendment would actually take

The machinery is not the obstacle here, and that is worth being precise about, because "it would need an act of Parliament" is a common and wrong assumption. Every power involved is already in force.

On the Rules side, an amendment to Rule 1 would be made under section 40(1):

"The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act."

Section 40 is in the group that commenced on 13 November 2025, so the power is live. The sub section attaches a condition of previous publication to its exercise. What that condition requires is settled by general law that is not on file here, so this site does not state what satisfies it; what can be said from the text alone is that the power carries a publication condition, and that a closed stakeholder meeting with no published document is not obviously a publication.

Rules made under the Act are also laid before Parliament:

"Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days …"

On this site's reading the qualifier attaches to the notifications and every rule is laid, because the section is headed Laying of rules and certain notifications, and because neither section 16 nor section 42 confers a power to make rules, so a rule "made under section 16 and section 42" would be an empty class. That is a construction and not the words of the Act. Either way the laying happens after the rule is made, so it delays nothing.

On the Act side the power is section 1(2):

"It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act …"

This is where a genuine question sits, and it is one no source read for this page addresses. The Central Government has already exercised that power, in G.S.R. 843(E), for every provision it named. Whether it can exercise it again to appoint an earlier date for provisions whose commencement date is already appointed but has not yet arrived is not answered by section 1(2), by G.S.R. 843(E) or by the Rules. This site does not assert an answer. It is flagged because the reported package needs exactly that step for section 10(1), for section 17(2) and for section 36, which are Act provisions rather than rules, and because a reader planning against the reported dates is relying on it without being told.

If it happened, what would move

Set out against the notified position, the reported package is 5 separate changes with 4 different clocks. Nothing in this table is in force, and nothing in it is proposed by any document this site has been able to locate.

3 of those 5 have no date at all, because they run from an instrument nobody has produced. The retention limb is the clearest example:

"While this requirement was earlier slated to be implemented within 18 months, the government is now likely to propose that it be operationalised within 90 days of the amended rules being notified in the Gazette of India, another source said."

90 days from a notification nobody has seen is not a deadline anyone can plan to. The retention floor in Rule 8(3) and the cross border provisions are the 2 limbs with real build time behind them, and both are in the 18 month group today.

What this means for a compliance plan

This part is a recommendation and not a requirement of any instrument.

Plan to the notified dates, because they are the only ones that exist, and treat the reported proposal as a reason to sequence work rather than to change the target. 2 things follow from the arithmetic rather than from the reporting.

First, the computed November 2026 date already exists in the framework, but it binds a narrow class. Rule 4 and section 6(9) govern the registration and obligations of Consent Managers, and section 27(1)(d) gives the Board a power over breaches of those registration conditions. An ordinary Data Fiduciary owes nothing on that date. If the reported change were notified, that same date would acquire the rest of the framework, so an organisation that has already done Consent Manager side work for 13 November 2026 has a shorter distance to travel than the headline suggests, and one that has not is looking at the whole 18 month programme on a 12 month clock.

Second, the limbs reported as immediate are the ones to look at now, because they are the ones with no runway at all if they land. Restrictions on transfers outside India and a power to call for information both start operating on the day an instrument says so. That is an argument for knowing where your data sits and what you could produce on request, which is work worth doing under the notified timetable in any case.

What this page will not do is compute a date from a proposal. Every calendar date on this site is derived from a published instrument and labelled where it is derived; a date derived from a report of a meeting would be a different kind of thing entirely.

What would change this page

The tripwire is specific. This page changes when an amending instrument appears in the Gazette of India, or when MeitY publishes the consultation document behind the reported proposal. Either would be found in the same 2 places the rest of this site's commencement material comes from: the eGazette, and MeitY's own document library, which is listed with the rest of the official documents here.

Of those 2 places, only the second was read for this page, and the limit is worth stating plainly rather than leaving a reader to assume otherwise. MeitY's library was enumerated in full and is archived here. The eGazette was not queried: its search runs as a browser session form that this site's checks cannot drive, so the negative above rests on MeitY's own library and on this site's source registry, not on a search of the Gazette itself.

Until one of those appears, the position is the one at the top: the 18 month group has not moved, the calendar dates for it and for the 1 year group are computed and are interpretation until officially confirmed, and the only change to the commencement position since 13 November 2025 is the corrigenda of 10 December 2025, which reworded Rule 1(3) and Rule 1(4) without moving either date.