India’s proposed move to accelerate DPDP compliance for Significant Data Fiduciaries has raised an important legal question: can businesses be required to comply within 12 months when the notified framework provides an 18-month transition period?
India’s Digital Personal Data Protection (DPDP) framework is entering a crucial implementation phase. While businesses are preparing for the obligations under the Digital Personal Data Protection Act, 2023 (DPDP Act), reports of a proposed reduction in the compliance timeline for Significant Data Fiduciaries (SDFs) have created uncertainty.
In January 2026, the Ministry of Electronics and Information Technology (MeitY) reportedly proposed reducing the implementation period for certain DPDP obligations from 18 months to 12 months for SDFs.
The proposal raises an important question for businesses, particularly large technology companies, financial institutions and digital platforms: Is the 12-month deadline legally binding, or is the 18-month timeline still applicable?
Understanding the distinction requires examining the notified law, the reported government proposal and the separate annual compliance obligations applicable to SDFs.
1. What does the notified law actually provide?
The DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified with a phased commencement schedule.
Two notifications are particularly relevant:
- G.S.R. 843(E), dated 13 November 2025, specifies the commencement of provisions of the DPDP Act.
- G.S.R. 846(E), dated 13 November 2025, notifies the DPDP Rules, 2025.
Under the notified commencement framework, the implementation is divided into three stages:
| Timeline | Applicable provisions |
|---|---|
| 13 November 2025 | Initial institutional and administrative provisions |
| 13 November 2026 | Rule 4 and related provisions concerning Consent Managers |
| 13 May 2027 | Principal substantive obligations, including SDF obligations |
The eighteen-month period is particularly important because Section 10 of the DPDP Act, which deals with additional obligations of Significant Data Fiduciaries, forms part of the provisions deferred to the final implementation phase.
Similarly, Rule 13, which prescribes additional obligations for SDFs, is scheduled to commence after eighteen months.
Therefore, under the notified framework, the applicable commencement date for these substantive obligations remains May 2027.
2. Where did the proposed 12-month deadline originate?
The discussion gained attention following a stakeholder consultation reportedly conducted by MeitY on 23 January 2026.
According to a report published by Business Standard on 22 January 2026, the Ministry was considering reducing the compliance timeline for certain DPDP provisions applicable to Significant Data Fiduciaries from eighteen months to twelve months.
The reported proposal was intended to accelerate compliance, particularly among large technology companies, social media platforms and major banking, financial services and insurance institutions.
The reported discussions also covered other proposed changes, including:
- Bringing certain government information-request powers into force earlier.
- Accelerating the implementation of specified cross-border data transfer requirements.
- Bringing forward certain data retention requirements, potentially within 90 days of notification of amended rules.
However, these developments were reported as proposals emerging from stakeholder discussions. A stakeholder consultation, government announcement or media report does not, by itself, amend the commencement provisions of an existing notification.
The legal position must be determined by the actual amendment or notification published in the Official Gazette.
3. Is the 12-month deadline binding law?
No. The reported proposal to reduce the general SDF compliance transition period from eighteen months to twelve months should not be treated as binding law.
As of 11 November 2026, the notified commencement framework continues to prescribe an eighteen-month implementation period for Section 10 and Rule 13.
No Gazette amendment changing that commencement period has been identified in the official legal framework reviewed for this article.
Consequently, businesses should distinguish between:
- The existing statutory commencement schedule.
- The reported proposal to accelerate certain compliance requirements.
- Any future amendment that may formally change the existing schedule.
Unless the Government formally amends the relevant commencement notification or Rules through the legally prescribed process, the original notified timeline remains applicable.
It is therefore premature to treat 13 November 2026 as the binding deadline for all SDF obligations.
4. An important distinction: The separate 12-month obligation under Rule 13
There is another provision that businesses should not confuse with the proposed reduction in the implementation timeline.
Rule 13 of the DPDP Rules, 2025 already contains a separate twelve-month requirement for Significant Data Fiduciaries.
Under Rule 13(1), an SDF must undertake:
- A Data Protection Impact Assessment (DPIA); and
- An audit to ensure effective observance of the DPDP Act and Rules,
once in every period of twelve months from the date on which it is notified as an SDF or included in a notified class of SDFs.
Rule 13 also requires the person conducting the assessment and audit to submit a report containing significant observations to the Data Protection Board.
Further, SDFs must exercise due diligence to ensure that their technical measures, including algorithmic software, do not pose risks to the rights of Data Principals.
These are recurring compliance obligations. They are different from the proposed twelve-month reduction in the overall implementation period.
Importantly, Rule 13 itself is scheduled to commence in the eighteen-month phase. Its annual assessment requirement should not be confused with an obligation that became enforceable merely upon notification of the Rules.
5. What should businesses and SDFs do now?
Although the proposed deadline is not binding, organisations should not ignore the possibility of accelerated implementation.
Businesses likely to fall within the SDF category should begin preparing their data governance systems.
Practical steps include:
- Mapping personal data collected, stored and processed across business operations.
- Identifying sensitive or high-risk processing activities.
- Establishing internal data protection governance mechanisms.
- Reviewing algorithmic systems and their potential impact on individual rights.
- Preparing for independent data audits and DPIAs.
- Reviewing data processor agreements and information security arrangements.
It is also important to remember that a company does not automatically become an SDF merely because it is large or processes substantial quantities of personal data.
Under Section 10(1), the Central Government may notify a Data Fiduciary or class of Data Fiduciaries as significant after considering prescribed factors, including the volume and sensitivity of personal data processed and risks to the rights of Data Principals, among other considerations.
6. The legal takeaway
The proposed twelve-month timeline reflects the Government’s interest in accelerating DPDP compliance. However, a policy proposal and a binding legal obligation are two different things.
For now, the eighteen-month commencement schedule remains the applicable legal framework for the substantive SDF obligations.
Businesses should monitor future Gazette notifications rather than rely exclusively on media reports or statements emerging from stakeholder consultations.
In data protection compliance, the distinction between what the Government proposes and what the law actually requires is critical.
