Six months into the staged rollout of the Digital Personal Data Protection Act, 2023 — and the DPDP Rules notified by MeitY on 13 November 2025 — the practitioner architecture is now substantially visible. Phase I (the Data Protection Board's establishment) is live; Phase II (the consent-manager regime) takes effect on 14 November 2026; Phase III (the compliance obligations and the ₹250 crore penalty ceiling) takes effect on 14 May 2027. A practitioner read on where data fiduciaries should be at the six-month mark and what the remaining eighteen months require.