Skip to content
DPDPA penalties can reach up to ₹250 crore. Know where you stand. See what's at stake →
AGICENTRAL
ResourcesTimeline

DPDP Act and Rules: key dates and commencement

The Act does not begin all at once. Its provisions start on three dates: 13 November 2025, and 13 November 2026 and 13 May 2027, which Agicentral computes from the periods the notifications state. The Rules follow the same three. This page shows what begins on each date, with a link to every provision.

The three dates at a glance

  1. Date has passed

    Date of publication of the notification

    The Act (G.S.R. 843(E))
    • Sections 2, 18–26, 35 and 38–43
    • Section 1 — sub-section (2)
    • Section 44 — sub-sections (1) and (3)
    See the list for this date
    The Rules (rule 1)
    • Rules 1, 2 and 17–21
    See the list for this date
  2. Upcoming

    One year from publication

    The Act (G.S.R. 843(E))
    • Section 6 — sub-section (9)
    • Section 27 — clause (d) of sub-section (1)
    See the list for this date
    The Rules (rule 1)
    • Rule 4
    See the list for this date
  3. Upcoming

    Eighteen months from publication

    The Act (G.S.R. 843(E))
    • Sections 3–5, 7–17, 28–34, 36 and 37
    • Section 6 — sub-sections (1) to (8) and (10)
    • Section 27 — the rest of the section, except clause (d) of sub-section (1)
    • Section 44 — sub-section (2)
    See the list for this date
    The Rules (rule 1)
    • Rules 3, 5–16, 22 and 23
    See the list for this date

13 November 2026 and 13 May 2027 are computed by Agicentral from the stated periods (one year from publication and eighteen months from publication, counted from 13 November 2025). The instruments state the periods, not those calendar dates.

The Act, provision by provision

Section 1(2) of the Act lets the Central Government appoint different dates for different provisions. Notification G.S.R. 843(E) appoints three.

Source: Notification appointing the dates on which provisions of the Act come into force (G.S.R. 843(E), 13 November 2025). Official copy (opens in a new tab) · Our copy (PDF)

Date has passed

Basis: Date of publication of the notification.

19 provisions

  • Section 1 · Short title and commencementBegins on this date: Sub-section (2)The notification is made under sub-section (2) of section 1 and names that sub-section. It does not separately name sub-section (1), the short title.
  • Section 2 · Definitions
  • Section 18 · Establishment of Board
  • Section 19 · Composition and qualifications for appointment of Chairperson and Members
  • Section 20 · Salary, allowances payable to and term of office
  • Section 21 · Disqualifications for appointment and continuation as Chairperson and Members of Board
  • Section 22 · Resignation by Members and filling of vacancy
  • Section 23 · Proceedings of Board
  • Section 24 · Officers and employees of Board
  • Section 25 · Members and officers to be public servants
  • Section 26 · Powers of Chairperson
  • Section 35 · Protection of action taken in good faith
  • Section 38 · Consistency with other laws
  • Section 39 · Bar of jurisdiction
  • Section 40 · Power to make rules
  • Section 41 · Laying of rules and certain notifications
  • Section 42 · Power to amend Schedule
  • Section 43 · Power to remove difficulties
  • Section 44 · Amendments to certain ActsBegins on this date: Sub-sections (1) and (3)

Upcoming

Basis: One year from publication. This date is computed from the 13 November 2025 publication date; the notification states the period, not the calendar date.

2 provisions

  • Section 6 · ConsentBegins on this date: Sub-section (9)
  • Section 27 · Powers and functions of BoardBegins on this date: Clause (d) of sub-section (1)

Upcoming

Basis: Eighteen months from publication. This date is computed from the 13 November 2025 publication date; the notification states the period, not the calendar date.

26 provisions

  • Section 3 · Application of Act
  • Section 4 · Grounds for processing personal data
  • Section 5 · Notice
  • Section 6 · ConsentBegins on this date: Sub-sections (1) to (8) and (10)
  • Section 7 · Certain legitimate uses
  • Section 8 · General obligations of Data Fiduciary
  • Section 9 · Processing of personal data of children
  • Section 10 · Additional obligations of Significant Data Fiduciary
  • Section 11 · Right to access information about personal data
  • Section 12 · Right to correction and erasure of personal data
  • Section 13 · Right of grievance redressal
  • Section 14 · Right to nominate
  • Section 15 · Duties of Data Principal
  • Section 16 · Processing of personal data outside India
  • Section 17 · Exemptions
  • Section 27 · Powers and functions of BoardBegins on this date: The rest of the section, except clause (d) of sub-section (1)
  • Section 28 · Procedure to be followed by Board
  • Section 29 · Appeal to Appellate Tribunal
  • Section 30 · Orders passed by Appellate Tribunal to be executable as decree
  • Section 31 · Alternate dispute resolution
  • Section 32 · Voluntary undertaking
  • Section 33 · Penalties
  • Section 34 · Crediting sums realised by way of penalties to Consolidated Fund of India
  • Section 36 · Power to call for information
  • Section 37 · Power of Central Government to issue directions
  • Section 44 · Amendments to certain ActsBegins on this date: Sub-section (2)

Not named in the notification

  • The ScheduleG.S.R. 843(E) does not name the Schedule. It is printed with the cross-reference “[See section 33 (1)]”; section 33 is in the eighteen-month group (13 May 2027).

The Rules, provision by provision

Rule 1 of the Rules sets the commencement of the Rules themselves, on the same three dates.

Source: Rule 1 (Short title and commencement) of the Rules (G.S.R. 846(E), rule 1, 13 November 2025). Official copy (opens in a new tab) · Our copy (PDF)

Date has passed

Basis: Date of publication of the notification.

7 provisions

  • Rule 1 · Short title and commencementSub-rules (3) and (4) of this rule were corrected by G.S.R. 892(E) to read “in the Official Gazette” instead of “of this Gazette”; the one-year and eighteen-month periods are unchanged.
  • Rule 2 · Definitions
  • Rule 17 · Appointment of Chairperson and other Members
  • Rule 18 · Salary, allowances and other terms and conditions of service of Chairperson and other Members
  • Rule 19 · Procedure for meetings of Board and authentication of its orders, directions and instruments
  • Rule 20 · Functioning of Board as digital office
  • Rule 21 · Terms and conditions of appointment and service of officers and employees of Board

Upcoming

Basis: One year from publication. This date is computed from the 13 November 2025 publication date; the rule states the period, not the calendar date.

1 provision

  • Rule 4 · Registration and obligations of Consent Manager

Upcoming

Basis: Eighteen months from publication. This date is computed from the 13 November 2025 publication date; the rule states the period, not the calendar date.

15 provisions

  • Rule 3 · Notice given by Data Fiduciary to Data Principal
  • Rule 5 · Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities
  • Rule 6 · Reasonable security safeguards
  • Rule 7 · Intimation of personal data breach
  • Rule 8 · Time period for specified purpose to be deemed as no longer being served
  • Rule 9 · Contact information of person to answer questions about processing
  • Rule 10 · Verifiable consent for processing of personal data of child
  • Rule 11 · Verifiable consent for processing of personal data of person with disability who has lawful guardian
  • Rule 12 · Exemptions from certain obligations applicable to processing of personal data of child
  • Rule 13 · Additional obligations of Significant Data Fiduciary
  • Rule 14 · Rights of Data Principals
  • Rule 15 · Transfer of personal data outside the territory of India
  • Rule 16 · Exemption from Act for research, archiving or statistical purposes
  • Rule 22 · Appeal to Appellate Tribunal
  • Rule 23 · Calling for information from Data Fiduciary or intermediary

Not named in the notification

  • First ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rule 4]”; rule 4 commences one year after publication (13 November 2026).
  • Second ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rules 5(1) and 16]”; rules 5 and 16 are in the eighteen-month group (13 May 2027).
  • Third ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rule 8(1)]”; rule 8(1) is in the eighteen-month group (13 May 2027).
  • Fourth ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rule 12]”; rule 12 is in the eighteen-month group (13 May 2027).
  • Fifth ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rule 18]”; rule 18 commences on the date of publication (13 November 2025).
  • Sixth ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rule 21(2)]”; rule 21(2) commences on the date of publication (13 November 2025).
  • Seventh ScheduleRule 1 does not list the Schedules separately. This Schedule is printed with the cross-reference “[See rule 23(1) and 8(3)]”: rule 23 is in the eighteen-month group (13 May 2027) and rule 8 likewise.

What has happened so far

Each entry records a published notification or a check we made, with its source.

  1. The DPDP Act, 2023 receives assent

    Act No. 22 of 2023, assented to on 11 August 2023 and published in the Gazette of India, Extraordinary, Part II — Section 1, No. 25.

    Source: Official Gazette PDF (MeitY) (opens in a new tab) · Our copy (PDF)

  2. Commencement dates for the Act appointed

    Notification G.S.R. 843(E) appoints the dates on which the provisions of the Act come into force: date of publication of the notification, one year from publication and eighteen months from publication.

    Source: G.S.R. 843(E) (MeitY) (opens in a new tab) · Our copy (PDF)

  3. Data Protection Board of India established

    Notification G.S.R. 844(E), under section 18 of the Act, establishes the Data Protection Board of India with effect from the date of publication of the notification.

    Source: G.S.R. 844(E) (MeitY) (opens in a new tab)

  4. The DPDP Rules, 2025 notified

    The Ministry of Electronics and Information Technology notifies the Rules as G.S.R. 846(E): 23 rules and 7 Schedules.

    Source: Official Gazette PDF (MeitY) (opens in a new tab) · Our copy (PDF)

  5. Corrigendum to the Rules

    Corrigenda G.S.R. 892(E) to G.S.R. 846(E). 8 corrections, listed beside the affected rules. See the list of corrections.

    Source: G.S.R. 892(E) (MeitY) (opens in a new tab) · Our copy (PDF)

  6. · Agicentral

    Text on this site verified against the Gazette PDFs

    The Act and the Rules on this site were last checked word for word against the official PDFs on 1 October 2026.

Sources

Dates and provision lists come from the commencement notification and rule 1. Titles are as printed in the Gazette. Text last verified against the official PDFs on 1 October 2026.

General information, not legal advice. The Gazette notification is the authoritative text. The dates computed from stated periods, the summaries and the labels on this page are Agicentral’s own and are not part of the law.