DPDP timeline and deadlines: what's in force now, and what's coming

At a glance

India’s DPDP Rules were notified on 13 November 2025, and the law is rolling out in stages. The Data Protection Board, the definitions, and the penalty framework are in force now. Rules for Consent Managers must be met by 13 November 2026. The substantive obligations — notice, consent, security, breach reporting, retention, rights — become binding on 13 May 2027. That last date is the one to plan around.

Educational resource only. This explains the commencement timeline of India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and its 2025 Rules; it is not formal legal advice.

When did the DPDP Act actually take effect?

The Act was passed in 2023 but sat dormant for two years — it only came alive when the Rules were notified on 13 November 2025. Parliament enacted the DPDP Act in August 2023, but a law like this needs its Rules to be operable: the Rules fill in the how — how a notice reads, how a breach is reported, how consent is managed. A draft appeared in January 2025, and the final Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025.

Crucially, notification did not switch everything on at once. The Rules use a staggered commencement — some parts immediately, others at 12 and 18 months — so “is DPDP in force?” has a different answer depending on which obligation you mean.

What’s in force right now?

Since 13 November 2025, the institutional and enforcement machinery is live — the regulator exists and can act. The parts that came into force immediately are the ones that set up the system rather than impose day-to-day duties:

• The Data Protection Board of India — its constitution, composition and functioning. The Board is established (in the National Capital Region) and is the body that will investigate complaints and impose penalties.
• The definitions and core interpretive provisions.
• The penalty and enforcement framework — the Board’s power to inquire and fine.

So the referee is on the field. What isn’t fully switched on yet is the rulebook of substantive obligations that the referee will enforce.

What happens in November 2026?

By 13 November 2026 — the 12-month mark — the framework for Consent Managers must be in place. A Consent Manager is a Data Protection Board–registered platform that lets people give, manage and withdraw consent across services from one dashboard. The provisions governing who can be one and how they register carry a 12-month clock, landing on 13 November 2026. This is when registered Consent Managers can begin to exist — the consent infrastructure the Act envisions starts to come online.

The big one: 13 May 2027

The substantive obligations — the ones most businesses actually have to implement — become binding 18 months after notification, on 13 May 2027. This is the deadline that matters for a typical Data Fiduciary. Coming into force on this date:

• The notice requirement (what you must tell people at collection).
• The consent standard (free, specific, informed, and the rest).
• Reasonable security safeguards.
• Breach notification (the “without delay” plus 72-hour reporting).
• Retention and erasure rules.
• Data Principal rights and the duty to fulfil them.
• Significant Data Fiduciary obligations.
• Cross-border transfer conditions and the Appellate Tribunal provisions.

In short: on 13 May 2027, the working obligations of the DPDP Act become enforceable, and the penalties attached to them become real exposure.

What should a business do with this runway?

Treat 13 May 2027 as a build deadline, not a start date — most of these obligations take months to implement properly. The instinct to wait is understandable, but the load-bearing obligations aren’t switch-flips. Getting consent captured correctly at every intake point, standing up a breach-response process, being able to answer a rights request, and holding a demonstrable record of consent — these are systems and habits, not last-week tasks.

The businesses that struggle in mid-2027 will be the ones that read “13 May 2027” as when to begin. The ones that are ready will have used the runway. Which specific obligations apply to you depends on your role — the linked pillars below break each one down.

FAQ