When the DPDP law takes effect
The law did not arrive on one day. These are the dates the assessment's roadmap is built against. Today is 8 November 2026.
-
11 August 2023In effect
DPDP Act, 2023 receives assent. The Act became law, but its provisions came into force only on dates the government notified under section 1(2).
-
13 November 2025In effect
DPDP Rules, 2025 notified. The Rules were published and the phased start began. Provisions setting up the Data Protection Board took effect at once.
-
13 November 2026Upcoming
Consent Manager provisions take effect. The registration framework for Consent Managers takes effect: companies can apply to the Board to register as platforms through which people give, manage and withdraw consent. A year after the Rules were notified.
-
13 May 2027Upcoming
Remaining obligations take effect. The remaining duties take effect, 18 months after the Rules were notified: notices, consent, security safeguards, breach reporting, retention, children's data and rights. From this date the Board can inquire into breaches and impose the penalties in the Schedule.
Dates are taken from the commencement notification for the Act (G.S.R. 843(E)) and rule 1 of the Rules, both of 13 November 2025. Under legal review: Any amendment to these dates, including a reported proposal to shorten the 18-month period, should be checked in the e-Gazette. Check the e-Gazette for any later notification that changes them; changes are also posted under Changes in the law.