The DPDP Act countdown: what Indian enterprises must do before May 2027.

The Digital Personal Data Protection Rules are notified, and the clock has quietly started. Most boards I speak to still treat DPDP as a 2027 problem, something to pick up after the next quarter. That reading is comfortable and it is wrong. The date on the calendar may say 2027, but the work that gets you there begins now, and the part almost nobody has costed is what your own teams are already doing with AI tools. This is a plain-English countdown for Indian enterprises: what has already happened, the dates that actually matter, what the law asks of you, and where the AI you are adopting fits into all of it.

A quick word before we begin. This is a practitioner’s view meant to help you plan, not legal advice. Your exact obligations depend on your sector, the personal data you hold, and the DPDP Rules as they apply to you, so please work through the specifics with your own counsel.

The clock actually started in November 2025

For two years the DPDP Act sat on the books without the Rules that make it operational. Everyone knew it was coming, and so everyone kept it on the “later” pile. That changed in November 2025, when the Government notified the DPDP Rules. The framework is now switching on in phases, and the whole thing runs on a roughly eighteen-month runway. In plain terms, you have been given time to get ready, not permission to wait.

Eighteen months sounds generous until you count it in the way a business actually moves. It is barely two budget cycles. Mapping where personal data sits, fixing consent and notice at the points you collect it, tightening security safeguards, and getting your vendors to answer honestly all take longer than anyone plans for. The organisations that will look calm in early 2027 are the ones that started the boring work in the middle of 2026.

The timeline that matters

Strip away the legal detail and the countdown comes down to three moments. Keep this in front of whoever owns compliance in your organisation.

The soft period through 2026 is not a holiday. It is the window in which the regulator expects you to put your house in order, so that when hard enforcement lands, the evidence is already there.

What the deadline is really asking of you

Read the obligations together and a picture forms of an organisation that knows exactly what personal data it holds, why it holds it, who can touch it, and how quickly it can answer for it. In practical terms, before May 2027 you should be able to stand behind each of these:

• Notice and consent. Tell people, in clear language, what you are collecting and why, and take consent that is genuine and specific rather than buried in a wall of terms.
• Purpose and storage limits. Use personal data only for what you collected it for, and keep it only as long as you actually need it.
• Reasonable security safeguards. Access control, encryption, and an audit trail you can produce on demand. This is the obligation whose breach carries the ₹250 crore figure, so it is not the place to improvise.
• Breach reporting. Be able to detect, contain and report a personal data breach to the Board and to affected individuals within the expected timelines. Your obligation does not pause while a vendor investigates.
• Data principal rights. When an individual asks what you hold about them, or to correct or erase it, or raises a grievance, you must be able to respond.
• Children’s data. Extra care, including verifiable parental consent, for anyone under eighteen.
• Extra duties if you are large. Organisations classified as Significant Data Fiduciaries carry further obligations, such as appointing a Data Protection Officer and running independent audits and impact assessments.

The Act does not ask whether your intentions were good. It asks whether you can show what you did with someone’s data, and prove it.

The line item most DPDP plans forget: your AI tools

Here is where most readiness plans quietly leave a hole. When a compliance team maps where personal data lives, they think of the CRM, the HR system, the core databases. They rarely think of the chat assistant that half the office has already started using without anyone signing off on it.

Yet every time an employee pastes a customer’s details into a public AI tool to draft a reply, or uploads a scanned document to get a quick summary, personal data has left your building. Under the DPDP Act you remain the Data Fiduciary for that data, and “we did not know our people were doing it” is not a defence. It is the finding. Worse, public AI services often process those requests on infrastructure outside India, so a casual prompt can turn into a cross-border transfer that nobody decided to make.

I have written separately on the eight questions a compliance team should ask of any AI tool. The short version is this: if the honest answer to “where is this processed and who can see it” is “on somebody else’s infrastructure, and we are not entirely sure,” that is a gap, and now it has a deadline attached to it. This same architecture question runs through the RBI’s 2026 draft for banks too, which I covered in what RBI’s AI rules ask of your stack.

A short checklist to run before May 2027

You do not need a consulting engagement to begin. You need a room, a whiteboard, and an honest afternoon. Run these in order.

1. Find your personal data, including the shadow copies. Map the official systems first, then the unofficial ones: the AI tools, the personal email exports, the spreadsheets on someone’s laptop.
2. Write a one-page AI usage policy. Just one page. What staff may put into which tools, and what must never leave your systems.
3. Fix notice and consent at the points where you actually collect data, in language a normal person can read.
4. Put your security safeguards in writing, with an audit trail you can produce. Our security and governance page is a useful reference for what good looks like.
5. Decide retention and erasure. Keep what you need for as long as you need it, and set a real rule for deleting the rest.
6. Rehearse a breach. Know today how you would detect, contain and report one within the timelines, before you are doing it under pressure.
7. Prepare for data principal requests. Access, correction, erasure and grievance handling should be a process, not a scramble.
8. Review your vendors and cross-border flows. For each processor, where do they sit, and can they put it in writing.

Where the answers depend on a third party’s assurances, note them as residual risk. Where they depend on your own infrastructure, note them as evidence. That single sheet usually makes the conversation with leadership very short.

Where a private, India-hosted deployment helps

None of this is a pitch for a product, and no product will do the compliance for you. But architecture quietly decides how hard each item on that checklist turns out to be. When the AI runs on somebody else’s cloud, most of the list becomes a set of clauses you cite and hope hold up. When it runs inside your own boundary, the same items become facts you can show an auditor.

A private, India-hosted platform like ZenithAI supports your DPDP obligations in a few concrete ways:

• Processing stays inside your data centre or private cloud, so “where is this processed” has a one-line answer that you control, not a clause you cite.
• Access and movement are logged. A fail-closed privileged-access audit and egress logging with redaction mean “who saw what” is a report you run, not a request you file with a vendor.
• Retention follows your policy, because the stores are yours and nobody else is quietly keeping a copy.
• The core models are open-weight and served on your hardware, so there is no telemetry path carrying prompts back to a model vendor for training.

Be precise about what that means. Private deployment supports the obligations, it does not discharge them. No software makes an organisation DPDP compliant on its own. Your notices, your consent flows, your grievance handling and your policies still do that work. What the right architecture does is shrink the surface your team has to explain, and put the evidence on your side of the wall.

Start the conversation now, not in 2027

The comfortable reading is that 2027 is far away. The honest reading is that eighteen months is barely two budget cycles, and the AI habits forming in your organisation right now are exactly the ones you will have to account for later. So start the mapping this quarter. Write the one-page policy this month. Get your teams to stop pasting personal data into tools nobody approved.

And if you would like to see what the private-deployment answers look like with your own compliance team in the room, talk to us. We are happy to walk through it in plain language, auditors included, and to be honest about what our architecture does and does not do for you.

Common questions

When does the DPDP Act become enforceable? The Rules were notified in November 2025, starting a phased runway of about eighteen months. Some provisions took effect on notification, consent-manager provisions follow around November 2026, and the substantive obligations become enforceable around May 2027.

Who does it apply to? Any organisation that decides how and why digital personal data of individuals in India is processed, which the Act calls a Data Fiduciary. It cuts across every sector.

What are the penalties? The Act carries a schedule of penalties, with a headline figure of up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach.

Do AI tools create DPDP risk? Yes. Personal data your staff put into AI tools is still your responsibility, wherever that tool processes it, and public services often route it outside India.

Does a private deployment make us compliant? No single product does. It supports your obligations by keeping data and processing inside your boundary and giving you the evidence, but your notices, consent and grievance handling still do the compliance work.

---