Executive summary
- The two dates. India's DPDP Rules are now notified, and two milestones govern data fiduciaries: a soft one around November 2026, and a hard one on 13 May 2027.
- The hard date. Most substantive obligations come into force on 13 May 2027, fixed in the Gazette, with no grace period.
- The catch. Consent lineage is the one obligation you cannot satisfy retroactively. It is captured at the moment of collection, or never.
- The point. You can defer an obligation, but you cannot backdate evidence, so the practical start is now, not the week before the deadline.
India's data protection regime stopped being a future problem in November 2025, when the DPDP Rules were notified. For data fiduciaries, two dates now matter, and only one of them is the kind you can prepare for in the final quarter.
Two dates now govern your training data
The Rules set a phased commencement. The headline obligations land on a single fixed date, and a softer milestone sits ahead of it.
The DPDP timeline for data fiduciaries
One half has a deadline. The other has no start button.
Compliance has two parts that people collapse into one. There is the obligation, and there is the evidence that you met it. They behave very differently as the deadline approaches.
Has a deadline
The obligation
By 13 May 2027: standalone notices, valid consent, security safeguards, breach reporting, retention and erasure, data principal rights. These you can stand up in a build sprint. They wait for you.
Has no start button
The evidence
Consent lineage is captured at the moment of collection, or never. On 14 May 2027 you cannot retrofit provenance onto records you processed without it. The trail either exists, or it does not.
You can defer an obligation. You cannot backdate evidence.
Read the clock backwards
Because consent lineage cannot be reconstructed after the fact, the useful way to plan is to start at 13 May 2027 and work back to what has to be true today.
Hard deadline. Show a clean consent chain across every record in your training set.
Legacy scrutiny. Data collected earlier is expected to need valid notice and consent. Gaps take months to fix.
Capture must be live. For an unbroken trail, lineage has to start before the obligation period.
Compliance Review. Map where provenance is captured today, where it breaks, and what an audit would find.
What LabelFort puts in your hands
LabelFort is built for the evidence half of the problem. Every record we process and annotate carries an exportable consent chain of custody, covering basis, purpose, timestamp, and withdrawal status, mapped to the DPDP notice and consent standard rather than a generic activity log.
It is one export that Security, Legal, Procurement, and, for a Significant Data Fiduciary, your auditors can read without a translation layer. The honest scope: it makes consent lineage exportable and auditable. It does not manufacture consent that was never collected upstream, which is exactly why a Compliance Review comes first.
Compliance posture
Five frameworks. One consent trail that Legal, Security, and Procurement can actually read.
FAQ
Q. When do DPDP obligations actually take effect?
Most substantive obligations are in force on 13 May 2027, fixed in the Gazette with no grace period. Consent Manager registration is expected about a year after notification, around November 2026, though the exact commencement is still to be notified.
Q. Can we add consent lineage later, before the deadline?
You can add the capability later, but you cannot recreate lineage for data already collected without it. The trail has to begin before the obligation period, which is why the practical start is now, not May 2027.
Q. What does LabelFort actually provide?
An exportable, per record consent chain of custody covering basis, purpose, timestamp, and withdrawal status, mapped to the DPDP notice and consent standard. It makes consent auditable. It does not manufacture consent you never collected.
Next step
The 13 May 2027 date is fixed. Your runway to it is not.
Start with a Compliance Review, a one hour structured walkthrough where we map where consent provenance is captured in your pipeline today, where it breaks, and scope an evidence grade proof of concept on your real data. No open trials, no price per label comparisons.