The DPDP Compliance Timeline: When the DPDP Rules 2025 and the DPDP Act Commence for Banks and NBFCs

The DPDP regime rolls out through two separate notifications that share identical time triggers but activate different legal provisions at each step.

The Ministry of Electronics and Information Technology issued two gazette notifications on 13 November 2025. One appoints commencement dates for the Act. The other publishes the DPDP Rules, 2025. Both use three triggers: publication day, one year later, and eighteen months later.

On publication, the Act notification brought the Data Protection Board into force. It activated provisions for Board members, appointments, and meetings. The Rules notification started definitions and internal Board operations. Section 38 also began immediately. It provides that DPDP runs alongside other laws and prevails only in direct conflict.

At the one-year mark (13 November 2026), the second stage starts registration rules for consent managers (entities that allow individuals to give, manage, review, and withdraw consent). A common mistake is assuming the Board can hear complaints or levy fines from this date. In fact, the Board’s inquiry and penalty powers under Section 27 sit in the eighteen-month tranche. The Board cannot entertain customer complaints at one year.

At eighteen months (13 May 2027), the third stage activates all substantive duties. These include notice rules, breach reports, customer rights, and Board fines. Role definitions appear on sibling pages for Data Fiduciary, Data Processor, Consent Manager, and the Data Protection Board of India.

The eighteen-month milestone introduces new breach reporting workflows, specific vendor contract terms, and customer rights handling that build upon existing financial sector controls.

For an RBI-regulated bank or NBFC, DPDP rules land on top of existing supervisory frameworks. The table below maps these new duties against existing controls.

Once in force, these additions will affect daily operations in three areas. On breach response, banks will need to establish a customer notification capability alongside their six-hour CERT-In and RBI filings. On vendor contracts, institutions will need to amend existing outsourcing agreements to add specific security safeguards and one-year log retention. On rights handling, the grievance redressal rule will establish a ninety-day window to resolve complaints, using customer identifiers such as customer identification file numbers and mobile numbers.

The automatic three-year erasure clock under the Third Schedule applies exclusively to e-commerce, gaming, and social media platforms, leaving financial institutions subject to a different legal standard.

The automatic erasure schedule under the Third Schedule applies only to three named classes:

• e-commerce entities with at least two crore registered users in India
• online gaming intermediaries with at least fifty lakh registered users in India
• social media intermediaries with at least two crore registered users in India

No bank, NBFC, or financial entity appears in that schedule. The forty-eight-hour advance deletion notice also hangs off that specific mechanism and does not reach the financial sector.

Instead, once the eighteen-month tranche commences, financial institutions will be governed by Section 8 of the Act. That section will require erasing personal data when consent is withdrawn or the purpose is served. Crucially, it contains an explicit carve-out: retention is permitted where necessary to comply with any law in force.

Under Section 38 of the Act, which has been in force since 13 November 2025, DPDP prevails over other laws only in direct conflict. On record retention, PMLA and RBI rules require preserving customer identity and transaction records for at least five years after an account closes, falling within the statutory compliance carve-out under Section 8.

A March 2026 advisory from the Reserve Bank of India provides banks and NBFCs with twelve operational themes for customer data protection that mirror DPDP requirements.

On 25 March 2026, the RBI’s Department of Supervision issued Advisory No. 3/2026 on customer data protection best practices. The advisory draws on a 2025 thematic study across commercial banks and NBFCs. It covers twelve themes, including consent management, purpose limitation, breach notice, third-party risk, and grievance redressal.

Published analysis by Consent.in notes that while the advisory is non-binding, its themes map directly onto DPDP workstreams. Consent.in also reads the advisory’s third-party risk focus as a signal that banking supervisors expect institutions to govern data protection practices across their entire vendor network, not merely within their own walls.

Neither commencement notification provides a grace period, while an unnotified government proposal could accelerate substantive deadlines to twelve months.

Neither commencement notice contains a transitional or grace period. Once an appointed date arrives, the corresponding provisions take effect immediately. Penalty details and appellate procedures are covered on the Data Protection Board of India page.

However, timelines could accelerate. On 23 January 2026, MeitY held industry consultations and proposed accelerating DPDP implementation. The proposal suggested compressing the transition from eighteen months to twelve months. That shift would advance the compliance deadline to 13 November 2026. The Ministry also proposed enforcing cross-border transfer rules for Significant Data Fiduciaries immediately. As of September 2026, no amending notice had been located, leaving the proposal unnotified.

The observations below represent KYCKART’s editorial reading of the regulatory instruments cited above.

Read together, the Third Schedule’s entity exclusions and the statutory compliance carve-out suggest that retention for banks and NBFCs is primarily a documentation task. Because financial firms sit outside the three named consumer classes, they do not need an automated deletion tool. The practical implication is that teams should build a data register linking each customer data element to its governing PMLA or RBI retention rule. Maintaining this documentation prepares an institution to demonstrate its legal basis to both banking supervisors and data protection authorities.

On incident management, existing six-hour reporting rules to CERT-In and RBI could lead compliance teams to view the DPDP seventy-two-hour window as generous. In our view, that reading looks incomplete. The seventy-two-hour filing is an exhaustive second-stage dossier for a new regulator, the Data Protection Board. More importantly, the duty to notify affected customers without delay requires a new communication capability operating alongside regulatory filings.

For vendor management, paragraph 16 of RBI’s IT outsourcing directions has required security, audit, and confidentiality clauses since October 2023. That overlap suggests contract remediation under the security safeguards rule does not require starting from scratch. Instead, compliance teams should focus on amending existing agreements to add specific technical safeguards, such as tokenization, access logs, and one-year processor log retention.

Finally, a forward-looking hypothesis on timeline risk. If MeitY eventually notifies its January 2026 compression proposal, substantive enforcement would advance to 13 November 2026. Because neither commencement instrument contains a grace period, planning against the final weeks of the eighteen-month window carries real timing risk. On this piece’s reading, setting internal targets well ahead of May 2027 provides a prudent buffer.