DPDP Act: A Board Readiness Checklist Before May 2027

India’s data protection law is no longer a distant prospect. The Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules, notified on 13 November 2025, take effect in three phases. The second phase begins on 13 November 2026, and full compliance becomes mandatory on 13 May 2027.

Many boards still treat this as a task for the IT department. That is a costly misreading. Personal data now sits at the heart of almost every business, from customer records and payroll to marketing lists and vendor databases. A single breach can trigger penalties of up to ₹250 crore, regulatory scrutiny and lasting reputational harm.

Data protection has become a governance question. The board that asks the right questions today will be far better placed in May 2027.

The timeline

The Rules were notified on 13 November 2025 and come into force in three stages.

Phased commencement of the DPDP Act, 2023 and Rules, 2025

Phase 2 is narrow: it covers the registration of Consent Managers. Phase 3 is the real deadline, when the duties of every Data Fiduciary, the rights of individuals and the penalty regime all take effect.

What is at stake

The Data Protection Board of India can impose monetary penalties under Section 33 of the Act. The Schedule to the Act sets the upper limits.

Breach	Maximum penalty
Failure to take reasonable security safeguards to prevent a data breach	₹250 crore
Failure to notify the Board and affected individuals of a breach	₹200 crore
Breach of obligations relating to children’s data	₹200 crore
Breach of additional obligations of a Significant Data Fiduciary	₹150 crore
Breach of any other provision of the Act or Rules	₹50 crore

These penalties are imposed on the company as the Data Fiduciary. The Board considers factors such as the gravity and duration of the breach, the harm caused and the steps taken to limit it. Prompt and documented action can therefore reduce exposure.

Why directors are accountable

The DPDP Act places its obligations on the company. Directors, however, cannot treat compliance as someone else’s concern. Three duties bring it squarely into the boardroom.

Duty of care: Section 166(3) of the Companies Act, 2013 requires directors to act with due and reasonable care, skill and diligence. Oversight of a risk of this scale falls within that duty.
Risk oversight: Listed companies must have a Risk Management Committee under the SEBI Listing Regulations, and its remit expressly includes cyber security.
Independent directors: Schedule IV of the Companies Act expects independent directors to safeguard stakeholder interests and to probe the adequacy of internal systems.

The six-month readiness checklist

The months from November 2026 to April 2027 give boards a practical window. The plan below spreads the work so that the company is ready well before the final deadline.

Month	Board action	What management should deliver
November 2026	Assign ownership	A senior executive accountable for DPDP compliance, reporting to the board or a committee
December 2026	Commission a data map	An inventory of what personal data is held, where, why and for how long
January 2027	Review consent and notices	Plain-language privacy notices and consent records that meet the Act’s standards
February 2027	Test breach readiness	An incident response plan, tested through a mock drill, with the 72-hour reporting path to the Board defined
March 2027	Review vendors	Updated contracts with every processor that handles personal data on the company’s behalf
April 2027	Final assurance	A readiness report, ideally with an independent audit, presented to the board

Each step should be minuted. A clear record of board oversight is itself evidence of diligence.

Questions to ask at the next board meeting

Directors need not be technology experts to exercise effective oversight. They need to ask precise questions and expect evidence in reply.

Who in management is accountable for DPDP compliance, and when will they next report to us?
Do we know every category of personal data we hold, including data held by our vendors?
Could we notify the Data Protection Board within 72 hours of discovering a breach?
Do we process children’s data, and if so, how do we obtain verifiable parental consent?
Could we be classified as a Significant Data Fiduciary, with its additional duties?
What budget and resources have we committed, and is that sufficient?

Vague answers to any of these questions are a signal that more work is needed.

Conclusion

The DPDP Act changes how Indian companies must treat the personal data entrusted to them. The penalties are significant, but the larger cost of a breach is lost trust.

Boards that begin now can build compliance steadily rather than in a last-minute rush. The November 2026 milestone is the right moment to place data protection firmly on the board agenda.

This article is for general information only and does not constitute legal advice.

References

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Sections 8, 9, 10, 27, 33 and the Schedule. Published in the Gazette of India, Extraordinary, Part II, Section 1, Ministry of Law and Justice (Legislative Department), 11 August 2023.
The Digital Personal Data Protection Rules, 2025, Rules 4 and 7. Notified by the Ministry of Electronics and Information Technology, Government of India, in the Gazette of India, Extraordinary, 13 November 2025.
The Companies Act, 2013 (Act No. 18 of 2013), Section 166(3) and Schedule IV (Code for Independent Directors). Ministry of Corporate Affairs, Government of India.
Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015, Regulation 21 and Schedule II, Part D. Securities and Exchange Board of India.

Disclaimer: This article is for general information and educational purposes only and does not constitute legal advice. Readers should consult a qualified professional and refer to the official texts of the DPDP Act and Rules before acting on any information.