11 August 2023 Assent
Presidential assent - DPDP Act, 2023
Parliament’s Digital Personal Data Protection Act becomes law. Commencement of provisions remains subject to Central Government notification.
Phased commencement
DPDP Act compliance timeline: key dates to May 2027.
The Act is in force in stages. Use this timeline to sequence governance, Consent Manager readiness, notices, and security safeguards.
13–14 November 2025 In force
DPDP Rules, 2025 notified · Board & definitions commence
Rules operationalise the Act. Under G.S.R. 843(E), definitions, Data Protection Board provisions (sections 18–26), and related machinery come into force on the gazette date. The compliance runway for substantive duties begins.
13 November 2026 +12 months
Consent Manager provisions
Provisions relating to Consent Managers (including section 6(9) and related Board functions) commence one year from the November 2025 notification. Organisations depending on consent intermediaries should validate registration, India incorporation, and integration paths before this date.
13 May 2027 +18 months
Substantive Data Fiduciary obligations
Eighteen months from the November 2025 gazette: notice and consent duties, reasonable security safeguards, breach intimation, children’s data rules, Data Principal rights, retention purpose limits, cross-border rules, and most remaining operative sections apply. This is the primary deadline for end-to-end operational readiness.
| Planning focus | Suggested window | Implementation focus |
|---|---|---|
| Data mapping & purpose inventory | Now → mid-2026 | Discover systems, vendors, outbound flows |
| Notices, consent UX, retention clocks | 2026 | Design enforceable purpose-bound flows |
| Consent Manager / rights APIs | Before Nov 2026 | Integration & evidence of withdrawal |
| Security safeguards & breach runbooks | Through May 2027 | Controls + Board-ready intimation |
| SDF / Board governance (if applicable) | Ongoing | DPO, audits, documentation pack |
Dates follow the Central Government commencement notification of 13 November 2025 (G.S.R. 843(E)) and public reporting on the DPDP Rules, 2025. Always verify against the Official Gazette for your compliance programme.
FAQ
Timeline questions
When did the DPDP Rules, 2025 come into force?
The Rules were notified around 13–14 November 2025. Board and definitional provisions commenced with the 13 November 2025 gazette notification (G.S.R. 843(E)).
When do Consent Manager provisions apply?
About one year after the November 2025 notification, i.e. around 13 November 2026.
When do most Data Fiduciary duties start?
Eighteen months after the November 2025 notification: around 13 May 2027 for notice, consent, security safeguards, breach intimation, children’s data duties, and rights fulfilment.
What should we do in 2026?
Map personal data and purposes, redesign notices and consent, prepare Consent Manager integrations if needed, and harden security and breach playbooks before May 2027. Use the Need Assessor to prioritise.