Skip to content
TruPriv
DPDP hub

The DPDP Act, the DPDP Rules, and the 13 May 2027 deadline.

A working reference for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, written for the person who has to implement them, not for a court. Every claim here names the section it comes from.

Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)

Is the DPDP Act in force?

Partly. Under G.S.R. 843(E), notified on 13 November 2025, the definitions and the Data Protection Board provisions (sections 18 to 26) came into force that day. Section 6(9) on Consent Managers follows on 13 November 2026. Notice, consent, Data Principal rights, security safeguards, breach notification and children's data apply from 13 May 2027.

Commencement of the DPDP Act, 2023 (G.S.R. 843(E)) and the DPDP Rules, 2025 (Rule 1)
DateDPDP Act, 2023 · G.S.R. 843(E)DPDP Rules, 2025 · Rule 1
Sec 1(2), Sec 2, Sec 18–26, 35, 38–43, Sec 44(1) and (3)Rules 1, 2, 17–21
Sec 6(9), Sec 27(1)(d)Rule 4 (Consent Managers)
Sec 3–5, Sec 6(1)–(8) and (10), Sec 7–17, Sec 27 (except (1)(d)), Sec 28–34, 36, 37, Sec 44(2)Rules 3, 5–16, 22, 23
Time to full enforcement ·

187 days to 13 May 2027, when the DPDP Act's substantive obligations come into force.

Take the readiness assessmentFree · scored against the Act · nothing leaves your browserDoes the DPDP Act apply to you?Applicability checker · up to six questions
Digital Personal Data Protection Act, 2023Official text · Gazette of India · PDFOfficial source: MeitY
Digital Personal Data Protection Rules, 2025G.S.R. 846(E) · Gazette of India, 13 November 2025 · PDFOfficial source: MeitY
Commencement notification for the ActG.S.R. 843(E) · Gazette of India, 13 November 2025 · PDFOfficial source: MeitY
Phased commencement

DPDP timeline: three dates that decide when each obligation applies

  1. Passed

    : DPDP Rules notified; Board provisions in force

    The Rules were notified and the Act's definitions and Data Protection Board provisions (Sec 18–26) came into force. From this point the enforcement machinery exists in law. G.S.R. 843(E)

    Status: in its answer of 12 August 2026 (Lok Sabha Q.3960), MeitY said recruitment of the Board's Chairperson and four Members was advertised on 6 June 2026. Last checked .

  2. Next

    : Consent Manager provisions in force

    Sec 6(9) and Rule 4 commence, opening registration for Consent Managers, the Board-registered intermediaries defined at Sec 2(g) and Sec 6(7)–(9). TruPriv is not one of them. G.S.R. 843(E); Rule 1

  3. Enforcement

    : All remaining obligations in force

    Consent, notice, rights, breach notification, children's data and Significant Data Fiduciary obligations all become enforceable, with penalties attached. G.S.R. 843(E); Rule 1

Penalty exposure

DPDP Act penalties: the maximum for each breach

These are ceilings, not tariffs, enforced by the Data Protection Board of India. The Board determines the amount on the facts. The point is the order of magnitude, and that each figure attaches to a specific obligation you can either evidence or not, from security safeguards to breach notification.

  • up to ₹250 croreFailure to take reasonable security safeguardsSec 8(5)
  • up to ₹200 croreFailure to notify a personal data breachSec 8(6)
  • up to ₹200 croreBreach of obligations relating to childrenSec 9
  • up to ₹150 croreBreach of additional Significant Data Fiduciary obligationsSec 10
  • up to ₹10,000Breach of a Data Principal's dutiesSec 15
  • up to the original amountBreach of a voluntary undertaking accepted by the Board, up to the amount for the original breachSec 32
  • up to ₹50 croreBreach of any other provision of the Act or the RulesSchedule item 7

What is the maximum penalty under the DPDP Act?

The highest penalty under the DPDP Act, 2023 is up to ₹250 crore, for failing to take reasonable security safeguards under section 8(5). Breach notification failures and children's-data breaches can attract up to ₹200 crore each. Any other breach of the Act or Rules can attract up to ₹50 crore. The Board decides the amount case by case.

This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.

Two things people get wrong

Two DPDP myths: records of processing and DPIAs

Does the DPDP Act require records of processing?

No. The DPDP Act has no equivalent of GDPR Article 30. But section 11(1) gives every Data Principal the right to a summary of their personal data and of everyone it was shared with, and Significant Data Fiduciaries face audits under section 10. Neither is practical to answer without a maintained record of processing.

Anyone telling you otherwise is selling from a GDPR script. See Sec 11(1)(a)–(b) and Sec 10, and how a maintained record of processing activities answers both.

Is a DPIA mandatory under the DPDP Act?

Not for every business. Under section 10(2)(c) of the DPDP Act, a Data Protection Impact Assessment is mandatory only for organisations notified as Significant Data Fiduciaries. Others are not required to run one, though a DPIA is still a practical way to find out what personal data you process and where the risk sits.

Sec 10(2)(c)

Where TruPriv sits

Is TruPriv a Consent Manager?

No. A Consent Manager is a Board-registered intermediary under section 2(g) and section 6(7) to (9) of the DPDP Act and Rule 4 of the DPDP Rules, 2025. TruPriv is software a Data Fiduciary uses to manage and evidence its own consents. It is not registered as a Consent Manager.

What TruPriv does provide is proof of consent: every consent kept as a versioned, hash-chained artefact, so a Data Fiduciary can discharge the burden of proof at Sec 6(10). The Consent Manager guide sets out the difference, and who can register from 13 November 2026.

ExplainerThe Act, section by sectionPlain English, written for a compliance owner rather than a lawyer.ExplainerThe Rules, rule by ruleWhat each of the DPDP Rules, 2025 requires, and when it commences.GlossaryDPDP terms, definedData Principal, Data Fiduciary, consent artefact, Consent Manager — and why TruPriv is not one.

DPDP guides

DPDP Act explainers, glossary and free tools