DPDP Compliance Timeline for Online Sellers: 13 November 2025, 13 November 2026 and 13 May 2027

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and switch on in three steps. Rules 1, 2 and 17 to 21 came into force on publication, Rule 4 (consent managers) comes into force one year after publication, and Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. That makes the main duties for businesses apply from 13 May 2027. This is general information, not legal advice; confirm with a lawyer.

What are the three dates?

Rule 4 is about consent managers, which are separate registered intermediaries. A seller does not have to become one. A brand with a consent flow may later have to work with them.

What applies to me in November 2026?

For an ordinary online seller, very little is enforceable today. The Board-related rules are live, but the notice, consent, security, breach and rights duties start on 13 May 2027. Before that date the Board may issue notices or monitor practices but cannot impose monetary penalties. A compliance review adds that no penalty can be imposed before 13 May 2027.

The Rules also say the Act and Rules do not apply retrospectively to consent already obtained, according to the Bar & Bench summary. Do not read that as permission to skip a refresh. Consent records you cannot prove will be hard to defend.

Could the 13 May 2027 date move earlier?

Possibly, but it has not. A January 2026 report suggested cutting the 18-month window to 12 months, at least for significant data fiduciaries. As of 1 November 2026, a compliance review found no draft or amending notification, so 13 May 2027 stands. The same review warns that a missing draft is not proof, because a fresh commencement notification does not require prior publication. Plan for 13 May 2027 and keep the heaviest work, such as breach handling and data deletion, ready to move earlier.

What must a seller do by 13 May 2027?

These are the duties in the Rules, in the order most sellers need them. The Rule numbers are from the notified text.

1. Notice (Rule 3). Give a plain-language notice that itemises the personal data and the specific purpose for each use, with a link to withdraw consent, exercise rights and complain to the Board.
2. Security (Rule 6). Minimum safeguards include encryption, masking or virtual tokens, access control, logs and monitoring, backups, and retaining logs and personal data for one year to detect and investigate unauthorised access. Processor contracts must carry security terms.
3. Breach (Rule 7). Tell each affected person without delay, tell the Board without delay, and send the Board detailed information within 72 hours of becoming aware, or a longer period the Board allows in writing.
4. Erasure and retention (Rule 8). Erase data when the purpose is served, with notice at least 48 hours before, and retain the specified order and log data for the period the Rule requires.
5. Contact and grievances (Rules 9 and 14). Publish business contact details of a person who can answer questions, and answer data-principal requests within a reasonable period not exceeding 90 days.
6. Children (Rule 10). Obtain verifiable parental consent before processing a child's data.

Our DPDP Rules guide for e-commerce brands goes through each duty in seller terms.

Does the big-platform erasure rule affect small sellers?

The Third Schedule applies to an e-commerce entity with not less than two crore registered users in India. Such an entity must erase personal data three years after the person last approached it, with 48 hours' notice first. That targets the largest platforms, not a typical D2C store with a few lakh customers. If you are below two crore users, the general purpose-based erasure duty and your own retention rules still matter.

What are the penalties?

The Act's Schedule sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify the Board and affected people of a breach, up to ₹200 crore for breaching children's obligations, and up to ₹50 crore for breach of any other provision. They are maximums, not fixed fines. As above, none can be imposed before 13 May 2027, according to commentary.

How does this sit next to the E-Commerce Rules?

They are separate laws with separate dates. The Consumer Protection (E-Commerce) (Amendment) Rules, 2026 start on 1 January 2027 and include a rule that marketplace entities may not use consumer information for specified purposes without express and affirmative consent. The DPDP duties start on 13 May 2027. A consent screen that satisfies one should be checked against the other. Our E-Commerce Amendment Rules guide covers the January 2027 changes.

How should I plan the next six months?

This is our suggested sequence, not a legal requirement. The point of starting in November is that data mapping usually uncovers tools nobody remembered, such as an old courier spreadsheet or a marketing export, and each one needs an owner, a purpose and a deletion rule. Related dates, including the 1 January 2027 e-commerce rules, are in our compliance calendar.

FAQ

When do the DPDP Rules fully apply? The main business duties apply from 13 May 2027, eighteen months after the Rules were published on 13 November 2025. Rule 4 on consent managers applies from 13 November 2026.

What is happening on 13 November 2026? Rule 4 comes into force, covering registration and obligations of consent managers. It does not create new duties for a normal seller.

Can I be fined before 13 May 2027? Commentary says no monetary penalty can be imposed before that date, though the Board may issue notices or monitor practices.

Has the 18-month window been cut? Not as of 1 November 2026, according to one compliance review, which found no draft or amending notification. A shorter window was reported as a possibility in January 2026.

How fast must I report a data breach? Tell the Board without delay, then send detailed information within 72 hours of becoming aware, unless the Board allows longer in writing.

Do marketplace sellers have to comply or only Amazon and Flipkart? Any business that decides how and why it processes personal data has duties under the Act. A seller who gets buyer name and address for fulfilment is processing personal data. How far the platform's notice covers you is a question for your lawyer.

Where to start

Begin with the data map; every later task depends on it. Blooprint is a Bengaluru e-commerce agency and handles the listing and catalogue side of your marketplaces; our catalogue and listing optimisation page explains how we work, while your lawyer owns the data-protection design.