The DPDP Act is coming into force in three phases. The Rules were notified on 13 November 2025 (G.S.R. 846(E)), when the Board provisions took effect; consent manager registration under Rule 4 applies from 13 November 2026; and the core obligations under Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027 (Rule 1).
Key takeaways
- 13 November 2025: definitions, the Data Protection Board and Rules 1, 2 and 17 to 21 came into force.
- 13 November 2026 (today): section 6(9), section 27(1)(d) and Rule 4 on consent managers apply.
- 13 May 2027: notice, consent, security, breach intimation, rights, children, penalties and the rest.
- The Board is established but no Chairperson or Members had been appointed as of early November 2026.
- The proposal to cut the window to 12 months has not been adopted; 13 May 2027 stands.
Most confusion about the DPDP Act comes from dates. The Act was published in August 2023, the Rules were notified in November 2025, and parts of the law started on different days. People ask "is the DPDP Act in force?" and get answers ranging from "yes, since 2023" to "not until 2027". Both are partly right.
This page is our single source of truth for DPDP dates. It lists exactly which sections and Rules start in each phase, what changed today, and what is still pending. We update it when something new is notified, and the changelog at the end records each update.
Is the DPDP Act in force?
Partly. The Act was published as Act No. 22 of 2023 on 11 August 2023, but section 1(2) left commencement to government notification. On 13 November 2025 the government notified the commencement of the Act (G.S.R. 843(E)), established the Board (G.S.R. 844(E) and 845(E)) and published the DPDP Rules, 2025 (G.S.R. 846(E)). Rule 1 then fixes three phases.
Data Protection Board established; Rules 1, 2 and 17 to 21 in force. Members are yet to be appointed.
Rule 4 applies: the framework for registering consent managers with the Board is in force.
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
What already applies before 13 May 2027
The phased start does not mean personal data is unregulated today. Section 43A of the Information Technology Act stays in force until section 44(2) omits it on 13 May 2027. CERT-In's April 2022 direction to report cyber incidents within six hours applies now and will continue alongside Rule 7. Sectoral rules, such as RBI's requirement on storing payment data, also continue. And if you are building a product or signing a multi-year contract today, it will be live when the DPDP obligations start, so design it for them now.
In short: the institutional machinery is switched on, the consent manager framework starts today, and the obligations on your business start on 13 May 2027. Until then, the penalty provision in section 33 is not in force, but the work to comply typically takes months, so it needs to start now.
Which sections and Rules start in each phase?
The table below is drawn from the commencement notification and Rule 1 of the DPDP Rules, 2025.
| Phase and date | Act sections | Rules | What it covers |
|---|---|---|---|
| Phase 1 13 Nov 2025 | s.1(2), s.2, s.18 to 26, s.35, s.38 to 43, s.44(1), s.44(3) | Rules 1, 2, 17 to 21, with the Fifth and Sixth Schedules | Commencement and definitions; establishment, composition and functioning of the Data Protection Board; protection for good-faith action; relationship with other laws; rule-making; the power to amend the Schedule; removal of difficulties; the TRAI Act change that makes TDSAT the appellate tribunal; the RTI Act amendment; Board appointments, salaries, meetings, digital office and staff |
| Phase 2 13 Nov 2026 | s.6(9), s.27(1)(d) | Rule 4 and First Schedule | Registration of consent managers with the Board, and the Board's power to inquire into a breach of a registration condition |
| Phase 3 13 May 2027 | s.3 to 5, s.6(1) to (8) and (10), s.7 to 17, s.27 (rest), s.28 to 34, s.36, s.37, s.44(2) | Rules 3, 5 to 16, 22, 23 and the Second, Third, Fourth and Seventh Schedules | Application of the Act; grounds, notice and consent; legitimate uses; general obligations including security, breach intimation and erasure; children; SDFs; rights and duties; cross-border transfers; exemptions; Board powers and procedure; appeals; voluntary undertakings; penalties; calls for information; blocking; omission of IT Act section 43A |
Two things in Phase 3 are easy to miss. First, section 3 itself, which sets the territorial scope, starts only on 13 May 2027. Second, section 44(2) omits section 43A of the Information Technology Act on that date, not before. Until then, section 43A compensation claims remain possible.
Why some sources say 12 or 14 November
The Gazette notifications are dated 13 November 2025. The PIB release announcing them is dated 14 November, and some law-firm alerts count the phases from 12 or 14 November. We use the Gazette date throughout this site, which gives 13 November 2026 for Phase 2 and 13 May 2027 for Phase 3. If your contracts or board papers refer to a different day, align them with counsel; a one-day difference should not change your plan.
What started today, 13 November 2026?
Phase 2 brings in three provisions, all about consent managers:
- Section 6(9): every consent manager must be registered with the Board, on the conditions the Rules prescribe.
- Section 27(1)(d): the Board's power to inquire into a breach of a consent manager's registration conditions. The penalty provision (section 33) starts only on 13 May 2027, and the Board has no Members yet.
- Rule 4 and the First Schedule: the eligibility conditions (an Indian company, net worth of at least ₹2 crore, technical, operational and financial capacity, independent certification of the platform) and the ongoing obligations of a registered consent manager.
For most businesses, nothing changes today. A consent manager is a registered intermediary that acts for individuals, not the consent management software a company buys. As of today no consent manager has been registered and no application portal has been reported, which is unsurprising given the Board has no Members yet. If you plan to accept consent through a consent manager later, see our consent manager guide.
Is the Data Protection Board working?
The Board exists on paper but is not yet functional. G.S.R. 844(E) established it with its head office in the National Capital Region, and G.S.R. 845(E) fixed its strength at four members. Rule 17 sets up search-cum-selection committees to recommend the Chairperson and Members.
As of early November 2026, no Chairperson or Member has been appointed. MeitY invited applications on 6 May 2026 for one Chairperson and four Members. In October 2026 the Centre told the Kerala High Court that the Board was "constituted but not made functional", and the court said it expected the Board to be functional within about eight weeks.
What would change this
A Gazette notification appointing the Chairperson and Members. Once that happens the Board can start registering consent managers and preparing its digital office. Its powers to inquire into breaches by Data Fiduciaries and impose penalties still wait for 13 May 2027.
Will the deadline move?
The 12-month proposal
In January and February 2026 the government discussed with industry a proposal to shorten the 18-month window to 12 months. No amendment has been notified. Rule 1(4) still says Phase 3 starts eighteen months after publication, which is 13 May 2027. If an amendment is published, it will need a Gazette notification, and this page will be updated the same day. Plan on 13 May 2027 and treat any earlier date as an upside risk to your timeline rather than a reason to wait.
The Removal of Difficulties Order, 2026
On 5 October 2026 the government issued the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) under section 43. It makes two textual fixes: section 9(1) now reads "child or of a person with disability", and in section 10(2)(c)(ii) "periodic audit" became "periodic data audit". Neither changes any date.
The Supreme Court challenge
Writ petitions challenge parts of the Act, notably the section 44(3) amendment to the RTI Act, and parts of the Rules. On 16 February 2026 the Supreme Court issued notice, declined to stay anything and referred the matter to a larger bench. The petitions are pending. Without a stay, all the dates above stand.
What has not been notified
No Significant Data Fiduciary has been notified, no country has been restricted under section 16, no order has been issued under Rule 15, no localisation list exists under Rule 13(4), no exemption (including for startups) has been granted under section 17(3) or 17(5), and no age threshold has been set under section 9(5). There is also no official MeitY FAQ on the final Rules. Each of these could arrive by notification at any time.
What should you do before 13 May 2027?
Six months is tight but workable if you start now and run work in parallel. A realistic plan:
- November and December 2026: confirm scope, map personal data across systems and vendors, and fix the lawful ground for each purpose.
- January and February 2027: rewrite notices, rebuild consent capture and withdrawal, and amend processor contracts.
- March 2027: close Rule 6 security gaps (logging, one-year retention, access control) and set up breach intimation to the Board and to individuals.
- April 2027: launch rights and grievance handling, retention schedules and erasure jobs, then rehearse a breach.
- May 2027: final review and evidence pack, so you can prove notice and consent under section 6(10).
The implementation roadmap breaks this into workstreams, and the compliance checklist gives the item-by-item view. If you want a team to run it with you, get in touch.
Changelog
- 13 November 2026: First published. Phase 2 (section 6(9), section 27(1)(d), Rule 4) in force from today. Board established but no Chairperson or Members appointed. 12-month proposal not adopted. Removal of Difficulties Order, 2026 noted.
Frequently asked questions
Is the DPDP Act in force?
Partly. Definitions, the Board provisions and some machinery provisions have been in force since 13 November 2025, and consent manager registration since 13 November 2026. The obligations most businesses care about, such as notice, consent, security and breach intimation, apply from 13 May 2027.
What is the DPDP Act effective date for businesses?
13 May 2027. That is when sections 3 to 17 of the Act (other than section 6(9), already in force), the Board's inquiry and penalty provisions, and Rules 3, 5 to 16, 22 and 23 commence, eighteen months after the Rules were published in the Gazette on 13 November 2025.
When were the DPDP Rules notified?
The DPDP Rules, 2025 were published in the Gazette on 13 November 2025 as G.S.R. 846(E). The commencement notification for the Act was G.S.R. 843(E), and the Board was established by G.S.R. 844(E) and 845(E).
Has the DPDP deadline been shortened to 12 months?
No. A proposal to shorten the 18-month window to 12 months was discussed with industry in January and February 2026, but no amendment has been notified. Until one is published in the Gazette, 13 May 2027 is the date.
Can the Data Protection Board impose penalties now?
No. Section 33, which empowers the Board to impose penalties, commences on 13 May 2027, and the Board has no Chairperson or Members yet. Other laws, such as CERT-In's reporting directions and sectoral rules, continue to apply in the meantime.
Why do some articles say 12 or 14 November?
The Gazette is dated 13 November 2025, the PIB release is dated 14 November, and some law firms count the phases from 12 or 14 November. We use 13 November, the Gazette date, which gives 13 November 2026 and 13 May 2027.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.