If you have come across the date 13 May 2027 in connection with the DPDP Act, you may be wondering what actually happens on that day. The honest answer is: nothing dramatic happens to your store overnight. What changes is the ground underneath it. Full Section 33 exposure begins 13 May 2027, meaning that is the point past which the obligations the Act created become enforceable against stores that have not acted.
What that phrase means in practice
Up to that date, the Act exists, the obligations exist, but the practical reality for most merchants is that there has been time to get the basics in order without having acted yet. After that date, a store that has not done the groundwork is operating with the full weight of the Act's enforcement mechanism bearing on it, including the Section 33 penalty structure, rather than with a runway still ahead of it.
Nothing about your store's day-to-day operations changes mechanically on that date. Your checkout still works the same way. Your ad pixel still fires the same way. What changes is which stores are in a defensible position if a shopper complaint, a marketplace audit, or a Board inquiry ever reaches them, and which stores are not.
Before the deadline: time to build the basics
Before 13 May 2027, a store has the chance to do four things without time pressure: find out which tools it actually sends customer data to, publish a notice that reflects that honestly, start collecting and recording shopper consent, and set up a place to handle access, correction, and deletion requests when they arrive. None of this requires urgency or expensive legal counsel. It requires starting.
This is also the period where "we are working on it" is a credible, honest position for a store to hold, provided the work has actually started. A store with a visible, growing record of compliance work before the deadline is in a materially different position than a store with nothing.
After the deadline: the same work, under more weight
After 13 May 2027, the same four things still need to be true, but a store that has not started them no longer has "we are working on it" as a credible position; the exposure the law contemplated is now live. The gap between a store that acted early and one that did not becomes visible exactly when it matters most, in front of a shopper, a marketplace, or the Board.
This is also why the deadline is worth treating as a planning date rather than a panic date. A D2C founder with a Rs 1-20 crore store does not need to drop everything today. They need a plan that has the four basics in place well ahead of May 2027, built at a reasonable pace rather than assembled in the final weeks under pressure.
The practical move
Treat the date the way you would treat a tax filing deadline you already know about: not a surprise, just a point on the calendar that the work needs to be finished before. Starting now, even slowly, puts you on the right side of it with room to spare.
Consent Jet is built around exactly this timeline: it scans your store's tools, builds your notice, logs shopper consent, and gives you a record of access, correction, and deletion requests, all before the exposure date makes that groundwork urgent instead of optional.