Timeline
The Act is being brought into force in three stages. Proposals and reported orders are labelled.
DPDP Act published in the Gazette
The Digital Personal Data Protection Act, 2023 becomes law. Most of it waits for commencement notifications.
Source: Act, Gazette of India, 11 Aug 2023
DPDP Rules notified; Data Protection Board established
The Rules are notified. Definitions, the Board provisions and Rules 1, 2 and 17 to 21 take effect, and the Data Protection Board of India is established.
Source: G.S.R. 843(E), 844(E), 846(E)
Proposal to shorten the timeline (not law)
MeitY reportedly proposed cutting the 18-month window to 12 months, at least for large businesses. No amending notification has been found, so the published dates still apply.
Source: Secondary reports
Removal of Difficulties Order (reported)
Reported to correct wording in sections 9 and 10. It does not move any commencement date.
Source: Secondary reports
Consent Manager registration begins
Section 6(9) and Rule 4 take effect, so Consent Managers can register with the Board.
Source: G.S.R. 843(E)(b); Rules r.1(3)
Main obligations for apps take effect
Notice, consent, security, breach notification, retention, children's data, user rights, Significant Data Fiduciary duties, cross-border rules and penalties all take effect. Section 43A of the IT Act is omitted.
Source: G.S.R. 843(E)(c); Rules r.1(4)
Common questions
When were the DPDP Rules notified?
The Rules are dated 13 November 2025 (G.S.R. 846(E)). Some summaries give 14 November, the date of the online Gazette upload.
Has the 13 May 2027 deadline been brought forward?
A proposal to shorten it was reported in January 2026, but no amending notification has been published, so the dates in the Rules still apply.
When does the DPDP Act apply to apps?
Most obligations for apps, including notice, consent, security, breach notification, children's data and user rights, take effect on 13 May 2027. The Rules were notified on 13 November 2025 with an 18-month phase-in.
What is a Data Fiduciary?
A Data Fiduciary is any person or company that decides the purpose and means of processing personal data. An app that decides what user data to collect and why is a Data Fiduciary.
What is the maximum penalty under the DPDP Act?
The highest penalty in the Schedule is up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach.
Does the DPDP Act cover data collected before it took effect?
Yes. Where consent was given before commencement, the Act requires a notice to be given as soon as reasonably practicable, and processing can continue until the user withdraws consent.