India's DPDP compliance timeline, explained: what switches on, and when

India's data protection law does not arrive all at once. The Digital Personal Data Protection Act, 2023 received the President's assent on 11 August 2023, but most of it was left to start on dates the central government would appoint. On 13 November 2025 the government published those dates in the Gazette of India in notification G.S.R. 843(E), and on the same day notified the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)). Rule 1 of the Rules follows the same schedule. Together they switch the law on in three steps over eighteen months.

Phase one: 13 November 2025

The first phase took effect on the date of publication. It covers the short title and the definitions (sections 1 and 2), the chapter on the Data Protection Board of India (sections 18 to 26), and sections 35 and 38 to 43 of the Act. In the Rules, rules 1, 2 and 17 to 21 apply from the same date. Rules 17 to 21 deal with the Board itself: how its Chairperson and Members are appointed, their terms of service, its meetings and its working as a digital office. A separate notification published the same day, G.S.R. 844(E), established the Board.

Phase two: 13 November 2026

One year after publication, section 6(9) and section 27(1)(d) of the Act come into force, together with rule 4 and the First Schedule of the Rules. These provisions are about Consent Managers. The Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact through which a person can give, manage, review and withdraw consent on an accessible, transparent and interoperable platform.

Rule 4 lets an applicant that meets the conditions in Part A of the First Schedule apply to the Board for registration. Those conditions include that the applicant is a company incorporated in India and that its net worth is not less than two crore rupees.

Phase three: 13 May 2027

Eighteen months after publication, the rest of the Act takes effect: sections 3 to 17 (except section 6(9)), section 27 (except clause (1)(d)), sections 28 to 34, 36 and 37, and section 44(2). In the Rules, rules 3, 5 to 16, 22 and 23 start on the same date. This is the phase most businesses will feel, because it brings in the obligations of Data Fiduciaries, the rights of Data Principals and the penalty Schedule.

Several concrete duties in the Rules start here. Under rule 7, a Data Fiduciary that becomes aware of a personal data breach must inform each affected person without delay and inform the Board without delay, followed by detailed information within seventy two hours unless the Board allows longer. Rule 8(3) requires personal data, associated traffic data and logs of processing to be kept for at least one year. Rule 10 requires verifiable consent of a parent before a child's personal data is processed. Rule 14(3) requires Data Fiduciaries and Consent Managers to publish a period for responding to grievances that does not exceed ninety days.

The Schedule to the Act sets the maximum penalties the Board can impose: up to 250 crore rupees for failing to take reasonable security safeguards to prevent a personal data breach; up to 200 crore rupees each for failing to notify a breach and for breaching the additional obligations relating to children; up to 150 crore rupees for breaching the additional obligations of a Significant Data Fiduciary; and up to 50 crore rupees for breach of any other provision of the Act or the Rules.

Which date to count from

The one year and eighteen month periods run from the date of publication in the Gazette. The Gazette notification is dated 13 November 2025, although the electronic copy was digitally signed on 14 November 2025, which is why some commentary counts from the later date. This article, and the countdown below, use 13 November 2025 as printed on the notification, so the later phases begin at midnight India time on 13 November 2026 and 13 May 2027.

A free plain English reference

Disclosure: dpdpr.in is a sister site of bharat.digital. It is an independent reference, not affiliated with the Government of India or the Ministry of Electronics and Information Technology, and it is not legal advice. It sets out every section of the Act and every rule with the official text, a plain English explanation, who it applies to and when it takes effect, along with a deadlines page, a compliance checklist and a neutral tracker of enforcement news. The countdown below uses the same dates as this article.

Useful links

• dpdpr.in: the DPDP Act and Rules in plain English
• dpdpr.in: DPDP compliance deadlines
• dpdpr.in: DPDP compliance checklist
• dpdpr.in: DPDP enforcement tracker