When should a college start DPDP compliance?

The short answer: a college should start now. The core duties begin on 13 May 2027, which is 180 days from 14 November 2026. A five-stage preparation plan takes about 24 weeks, or 168 days, so starting today leaves only 12 days of slack.

This is the fifth post in a series. The plan itself is in a 24-week DPDP compliance plan for colleges.

What are the dates?

The Rules were published in the Gazette on 13 November 2025 (G.S.R. 846(E)). Rule 1 sets three starting points.

The wording of Rule 1(3) is “one year after the date of publication”, and Rule 1(4) says “eighteen months after the date of publication”. Some blogs give 14 May 2027, a rounding from the press release date of 14 November. The Gazette is dated 13 November.

What started on 13 November 2026?

Only Rule 4. A consent manager is a company registered with the Board that lets a person give, manage and withdraw consent across several organisations. A college does not need one. The practical effect is that the consent manager market can now open, not that any college duty has begun.

Was an earlier date proposed?

Yes. In January 2026, trade press reported that MeitY had asked industry for comments on cutting the 18-month period to 12 months, with comments due on 4 February 2026. Reports differed on whether the cut would cover all data fiduciaries or only significant ones.

Until a change is notified in the Gazette, the dates in the table above are the law. Plan so the first three stages of the 24-week plan finish early. Those are the map, the notices and consent, and the security and vendor contracts.

Is the Data Protection Board set up?

The Board exists in law (Chapter V of the Act), but staffing is a separate matter. MeitY invited applications on 6 May 2026, and a trade report dated 1 November 2026 found no Chairperson or Member appointed. Treat this as unconfirmed until you see an appointment notice on an official site.

An unstaffed Board does not delay the duties. The date in Rule 1 is fixed, and the Board’s later inquiry can look at what a college did before it existed.

How much time is really left?

Colleges also have terms, exams and admissions in that window. The plan works best when it fits the calendar: map in the break, run notices and consent before the admission cycle, and rehearse the breach plan before results season.

What should a college do this month?

1. Name an owner for the programme, and a person for the published contact (Rule 9).
2. List every system and vendor that holds student or staff data.
3. Check the admission form and marketing against the children’s rules.
4. Ask each vendor, including the ERP provider, for a contract and its safeguards.
5. Put a start date for each stage on the calendar.

See how Tuling ERP supports DPDP compliance for what the software records, and the first post, what the DPDP Act means for a college, for the basics.

Sources

1. Ministry of Electronics and Information Technology, The Digital Personal Data Protection Rules, 2025, Rule 1, Gazette G.S.R. 846(E), 13 November 2025. Checked 14 November 2026.
2. Press Information Bureau, press release on the notification of the Rules, 14 November 2025.
3. Business Standard, MeitY may cut compliance timeline for key DPDP rules to 12 months, January 2026 (trade report).
4. Storyboard18, MeitY seeks industry views on fast-tracking DPDP Act rollout, January 2026 (trade report).
5. PPC Land, A year after India fixed its data board at 4 members, none are appointed, November 2026 (trade report).

Items 3 to 5 are news reports, not official sources. This post is not legal advice.

Update log

• 14 November 2026: first published. Review monthly and after any notification from MeitY.

Facts last checked: 14 November 2026. Rules and dates change, so confirm with your own advisers before acting.

• DPDP Act
• DPDP deadline
• College compliance