Capability roadmap

What you can adopt, and when.

Republished every quarter. A capability marked proposed is declared, not demonstrated — we do not report those as built.

Available now

PublicationSaaS + build

Social feedSaaS + build

Identitybuild

Tenancy — RLS forcedbuild

Audit — append-onlybuild

Feature flagsbuild

Next two quarters

LearningSaaS + build

Messaging & notificationSaaS + build

Document vaultbuild

Entity searchbuild

Reporting & exportbuild

Declared, not built

Entity Searchproposed

Customer Lifecycle Dataproposed

Reporting & Exportproposed

Outbound Webhooksproposed

Extensibilityproposed

…and 11 more16 total

Why this year

The buying window has a date on it.

13 May 2027

When	What changes	What it means for you
14 Nov 2025	DPDP Rules notified	An eighteen-month transition begins.
Nov 2026	Soft enforcement ends	The Data Protection Board moves from awareness to supervision.
Q1 2027	Significant Data Fiduciary duties	Independent audits, DPIAs, an India-based DPO, external auditors.
13 May 2027	Full enforcement	Penalties up to ₹250 crore for security-safeguard failures.

When

What changes

What it means for you

14 Nov 2025

DPDP Rules notified

An eighteen-month transition begins.

Nov 2026

Soft enforcement ends

The Data Protection Board moves from awareness to supervision.

Q1 2027

Significant Data Fiduciary duties

Independent audits, DPIAs, an India-based DPO, external auditors.

13 May 2027

Full enforcement

Penalties up to ₹250 crore for security-safeguard failures.

DPDP permits cross-border transfer unless a country is notified, and none has been. The absolute residency mandates are sectoral — RBI for payment data, MeitY for government workloads, SEBI and IRDAI.