Is the DPDP Act in force?

Assent in 2023 did not switch anything on.

The President gave assent to the Digital Personal Data Protection Act on 11 August 2023, and it was published in the Gazette the same day as Act No. 22 of 2023. That made it law. It did not make it apply to anyone.

Section 1(2) holds the switch. The Act comes into force on the date the Central Government appoints by notification, and different provisions can get different dates. The same subsection adds a rule that is easy to miss. When a provision speaks of “the commencement of this Act”, it means the day that provision itself came into force.

That one sentence moves deadlines. Section 5(2) asks for a notice to everyone who consented before commencement. Section 5 starts in May 2027, so that notice goes to everyone who consented before 13 May 2027, not only those who signed up before August 2023. Section 17(5) gives the government five years from commencement to exempt classes of fiduciaries, and on a plain reading that clock starts with section 17 itself in May 2027.

The Rules moved the target as well. A privacy notice written in 2023 against the bare Act will miss what Rule 3 added in November 2025: an itemised description of the personal data, and a link where a person can withdraw consent as easily as she gave it, use her rights and complain to the Board.

One notification, three start dates.

On 13 November 2025 the Ministry of Electronics and Information Technology published G.S.R. 843(E) in Gazette No. 757, using its power under section 1(2). It appoints three dates, each counted from the day of publication. Figure 1 puts them on one line, with what each one switches on.

Two details in those lists change plans. Section 6 is split in two: the registration of consent managers in section 6(9) starts a year in, while the rest of consent waits for eighteen months. And section 3, which says whose data the Act covers at all, is itself an eighteen-month section.

The Rules run on the same clock.

The DPDP Rules 2025 were published the same day as G.S.R. 846(E), Gazette No. 760. They follow a draft, G.S.R. 02(E) of 3 January 2025, which was published for objections and suggestions. If a page tells you the Rules arrived in January 2025, it is quoting the draft.

Rule 1 sets the same three steps as the Act.

• On publication: Rules 1 and 2, and Rules 17 to 21, which deal with appointing and paying the Board’s members, its meetings, its digital office and its staff.
• One year after publication: Rule 4 on consent managers, with the First Schedule it relies on.
• Eighteen months after publication: Rules 3, 5 to 16, 22 and 23. That covers the day-to-day duties, from notices and safeguards to breaches, erasure and rights, plus appeals (Rule 22) and the government’s power to call for information (Rule 23). The rule-by-rule lesson takes each one in turn.

What has applied since 13 November 2025.

Less than the headlines suggest. These are in force today.

• The definitions in section 2.
• The Data Protection Board of India. G.S.R. 844(E) established it from 13 November 2025 with its head office in the National Capital Region, and G.S.R. 845(E), made under section 19(1), notified that it shall consist of four members. Section 19(1) provides for those Members beside a Chairperson, which is why MeitY’s call for applications lists one Chairperson post and four Member posts. Sections 18 to 26 cover how the Board is made up, paid and staffed.
• The general sections: protection for action in good faith (section 35), the Act’s priority over a conflicting law (section 38), the bar on civil courts (section 39), the powers to make rules (section 40), amend the Schedule (section 42) and remove difficulties (section 43), and the duty to lay rules and some notifications before Parliament (section 41).
• Section 44(1), which amends the TRAI Act so the Telecom Disputes Settlement and Appellate Tribunal can hear appeals under this Act once section 29 starts on 13 May 2027, and section 44(3), which rewrote clause (j) of section 8(1) of the RTI Act to read “information which relates to personal information”.

What the Board cannot do yet matters as much. Its powers to take complaints, inquire and impose penalties sit in sections 27, 28 and 33, and those start at eighteen months. On 6 May 2026 MeitY invited applications for the Chairperson and four Members (F. No. 2(1)/2026-Pers.I). Until the Central Government makes an appointment under Rule 17(3), treat reports about the Board’s activity with care.

For a company, none of this creates a duty to the people whose data it holds. Section 43A of the IT Act still stands, because the provision that removes it, section 44(2), is one of the eighteen-month sections.

What starts on 13 November 2026.

One narrow switch. Section 6(9) requires every consent manager to be registered with the Board, and Rule 4 sets out how to apply and, through Part B of the First Schedule, what a registered consent manager must do. Part A of the First Schedule sets who may apply. Among other conditions, the applicant must be a company incorporated in India with a net worth of at least two crore rupees. Section 27(1)⁠(d) starts the same day and lets the Board inquire into a breach of a registration condition. Rule 4(1) leaves the application’s particulars to whatever the Board publishes on its website, so a would-be consent manager should watch the Board’s site and the Gazette, not only the calendar.

For a business that does not want to become a consent manager, this date changes nothing in its own duties. The pieces around it still wait for May 2027. A person’s right to give or withdraw consent through a consent manager sits in section 6(7), and the Board’s procedure (section 28) and its penalties (section 33) start then too. Lesson 2.3 covers consent and consent managers.

What starts on 13 May 2027.

This is the date that matters for most companies. Everything below starts together.

• Notice and consent under sections 5 and 6, with Rule 3 on what a notice must say. Consent, in depth.
• The lawful uses that need no consent, under section 7.
• Security safeguards under section 8(5) and Rule 6, including a year of logs. Every fiduciary duty.
• Breach intimation to each affected person and to the Board under section 8(6) and Rule 7, with a detailed report to the Board within 72 hours. Breaches, step by step.
• Erasure under section 8(7) and Rule 8, and a published contact under section 8(9) and Rule 9.
• Rights and grievances under sections 11 to 14 and Rule 14. The rights people have.
• Children and persons with disability under section 9 and Rules 10 to 12.
• Significant data fiduciaries under section 10 and Rule 13, once one is notified. What an SDF must add.
• Transfers outside India under section 16 and Rule 15. Sending data abroad.
• The Board’s complaints, inquiries and penalties, sections 27 to 34. The Schedule sets ceilings, not fixed sums. The highest, for failing to take reasonable security safeguards, may extend to two hundred and fifty crore rupees. How penalties work.
• Section 44(2), which removes section 43A from the IT Act.

Figure 2 turns those lists into the founder’s question: what applies to my company, and from when.

Three companies, three timetables.

The same three dates land differently depending on what you do with personal data. The three businesses below are illustrations, not clients.

What still waits on the government.

Some parts of the Act wait for a further step by the government, whatever the date: a notification, or for the Board, its appointments.

• Significant data fiduciaries. Section 10(1) lets the government notify a fiduciary or a class of them, weighing factors such as the volume and sensitivity of the data. Until a notification names you or your class, the section 10 duties do not apply to you.
• Restricted countries. Section 16(1) restricts transfers only to the countries or territories the government notifies. Section 16(2) keeps any stricter sector law in place.
• Notified exemptions. Section 17(3) lets the government exempt notified fiduciaries, including startups, from section 5, sections 8(3) and 8(7), and sections 10 and 11. Under section 17(5) it can also declare, within five years of commencement, that any provision does not apply to a fiduciary or a class of them for a period.
• The Board’s Chairperson and Members. They are appointed under section 19(2) and Rule 17. MeitY invited applications on 6 May 2026, and under Rule 17(3) the Central Government appoints only after a search-cum-selection committee recommends. We found no appointment in the Gazette on 22 October 2026.

The printed texts can change too. In October 2026 the government made an order under section 43, the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), published in the Gazette dated 6 October 2026. It corrects two pieces of wording. Section 9(1) now speaks of the personal data of “a child or of a person with disability”, and the periodic audit a significant data fiduciary carries out under section 10(2)⁠(c)⁠(ii) becomes a “data audit”. It moves none of the dates in Figure 1.

Section 43(2) bars new orders three years after commencement, and section 43 started on 13 November 2025, so on a plain reading that window closes in November 2028. Before you quote a section or rule word for word in a contract or a policy, check eGazette for anything newer.

13 or 14 November? Reading the dates.

Neither G.S.R. 843(E) nor Rule 1 prints a calendar date for the later steps. They count “one year” and “eighteen months” from publication, so 13 November 2026 and 13 May 2027 are arithmetic. Figure 3 shows the count, and where the one-day question comes from.

The Act shows the same pattern. Its Gazette issue, and the Act’s own heading, are dated 11 August 2023, while its eGazette file ID and digital signature carry 12 August. That points to the issue date as the date of publication. It is still a reading, not a ruling, so plan to the 13th and ask counsel to confirm.

Some published timelines print 12 November 2026 and 12 May 2027 instead. The Gazette prints none of these dates, only “one year” and “eighteen months”, so whichever day your counsel settles on, the safe plan is to be finished weeks before it.

What to do this quarter.

From the DPO’s chair, this is the list I would put in front of a founder this quarter. Most items take weeks, and every one is easier to build before the duty starts than after. In our engagements a DPDP programme typically runs 8–10 weeks for a small company, 12–14 weeks for an MSME and more than 16 weeks for an enterprise, so count back from 13 May 2027. On those bands the latest start is about 4 March 2027 for a small company, 4 February 2027 for an MSME and before 21 January 2027 for an enterprise, and that is before your own approvals and testing.

1. Map the personal data. Where you collect it, why, where it sits and who processes it for you. Every later step points back to this map.
2. Draft the Rule 3 notice, and plan the section 5(2) notice for everyone who signed up before May 2027.
3. Put processor contracts in order. Section 8(2) needs a valid contract, and Rule 6 expects security terms in it.
4. Write the breach runbook with both audiences in Rule 7: each affected person without delay, and the Board without delay and again within 72 hours.
5. Set up the grievance desk to answer well inside the ninety days Rule 14(3) allows.
6. Decide whose contact goes on the website under Rule 9: a DPO if you have one, otherwise a person who can answer for you.
7. Settle the consent-manager question before 13 November 2026: whether you will accept consent through one, and whether you mean to be one.
8. Keep your section 43A practices running until 13 May 2027. They do not lapse early.

For the plan behind that list, read the phased roadmap, the Rules roadmap quarter by quarter and what working back from 13 May 2027 looks like. The deadline countdown keeps every date in one place. If you want an auditor to check where you stand, book a free 30-minute call about a DPDP gap assessment.