Partly, and in stages. The Act was passed in August 2023, but it only starts to bind as the Central Government brings each part into force. These are the dates that have been notified, and what each one switches on.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
In three stages. The definitions and Data Protection Board provisions have been in force since 13 November 2025. Consent Manager registration starts on 13 November 2026. Every substantive duty of a Data Fiduciary, including notice, consent, rights, security, breach intimation and children's data, applies from 13 May 2027.
The Rules were notified and the Act's definitions and Data Protection Board provisions (Sec 18–26) came into force. From this point the enforcement machinery exists in law.
Status: in its answer of 12 August 2026 (Lok Sabha Q.3960), MeitY said recruitment of the Board's Chairperson and four Members was advertised on 6 June 2026.
Sec 6(9) and Rule 4 commence, opening registration for Consent Managers, the Board-registered intermediaries defined at Sec 2(g) and Sec 6(7)–(9). TruPriv is not one of them.
Consent, notice, rights, breach notification, children's data and Significant Data Fiduciary obligations all become enforceable, with penalties attached.
187 days to 13 May 2027, when the DPDP Act's substantive obligations come into force.
The same table as on the DPDP hub, taken from the commencement notification and Rule 1 of the DPDP Rules, 2025.
| Date | DPDP Act, 2023 · G.S.R. 843(E) | DPDP Rules, 2025 · Rule 1 |
|---|---|---|
| Sec 1(2), Sec 2, Sec 18–26, 35, 38–43, Sec 44(1) and (3) | Rules 1, 2, 17–21 | |
| Sec 6(9), Sec 27(1)(d) | Rule 4 (Consent Managers) | |
| Sec 3–5, Sec 6(1)–(8) and (10), Sec 7–17, Sec 27 (except (1)(d)), Sec 28–34, 36, 37, Sec 44(2) | Rules 3, 5–16, 22, 23 |
Read the other way round: from the obligation to the date it binds. Everything a Data Fiduciary has to do falls on 13 May 2027. That is the date the programme should be built for, and the compliance checklist lists the work item by item.
| Obligation | Provision | In force from |
|---|---|---|
| Notice | Sec 5 · Rule 3 | 13 May 2027 |
| Valid consent, withdrawal, proof of consent | Sec 6(1)–(6), 6(10) | 13 May 2027 |
| Legitimate uses without consent | Sec 7 | 13 May 2027 |
| Security safeguards | Sec 8(5) · Rule 6 | 13 May 2027 |
| Breach intimation (72-hour report to the Board) | Sec 8(6) · Rule 7 | 13 May 2027 |
| Erasure and retention | Sec 8(7)–(8) · Rule 8 | 13 May 2027 |
| Children's data and parental consent | Sec 9 · Rules 10–12 | 13 May 2027 |
| Significant Data Fiduciary duties | Sec 10 · Rule 13 | 13 May 2027 |
| Data Principal rights and grievances | Sec 11–14 · Rule 14 | 13 May 2027 |
| Penalties | Sec 33 · Schedule | 13 May 2027 |
| Consent Manager registration | Sec 6(9) · Rule 4 | 13 Nov 2026 |
| Data Protection Board established | Sec 18–26 · Rules 17–21 | 13 Nov 2025 |
No. Petitions challenging parts of the Act, including the section 44(3) amendment to the Right to Information Act, are pending before the Supreme Court, which has issued notice. As of 19 October 2026 we are not aware of any order staying the Act or the Rules, so the commencement dates stand.
The petitions question, among other things, section 44(3), which narrows the personal information exemption in the Right to Information Act, and the State exemptions in section 17. Until a court orders otherwise, plan to the notified dates. We will update this page if that changes.
In three stages. The definitions and Data Protection Board provisions have been in force since 13 November 2025. Consent Manager registration starts on 13 November 2026. Every substantive duty of a Data Fiduciary, including notice, consent, rights, security, breach intimation and children's data, applies from 13 May 2027.
No. Petitions challenging parts of the Act, including the section 44(3) amendment to the Right to Information Act, are pending before the Supreme Court, which has issued notice. As of 19 October 2026 we are not aware of any order staying the Act or the Rules, so the commencement dates stand.
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
