The Act and Rules use phased commencement. Publication or notification does not mean every substantive duty is already in force. This page summarises the official notifications located for this review; check the original Gazette and any later corrigenda before acting.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India’s statutory framework for processing digital personal data. It establishes concepts including Data Principals (the individuals to whom personal data relates) and Data Fiduciaries (entities that determine the purpose and means of processing), subject to the Act’s definitions and scope.
Read the official Act page from MeitY and the Gazette commencement notification dated 13 November 2025 (G.S.R. 843(E)).
What did the 13 November 2025 notification say?
The commencement notification appoints different dates for different provisions. Some provisions came into force on publication; specified provisions are scheduled one year after publication; and a further group—including sections 3 to 5, most of section 6, sections 7 to 17, most of section 27, sections 28 to 34, sections 36 and 37, and section 44(2)—is scheduled for commencement eighteen months after publication. Eighteen months after 13 November 2025 is 13 May 2027.
That date is not a universal statement that every provision of the Act starts on 13 May 2027. It is the scheduled date for the specific group described in the notification. Other provisions have different commencement dates.
What about the DPDP Rules, 2025?
The Rules notification G.S.R. 846(E) is dated 13 November 2025 in the Gazette; some official MeitY summaries refer to 14 November 2025. Rule 1 states that rules 1, 2 and 17 to 21 came into force on publication; rule 4 is scheduled one year after publication; and rules 3, 5 to 16, 22 and 23 are scheduled eighteen months after publication. Because the text ties commencement to publication, verify the date against the official Gazette, subsequent corrigenda, and current official communications before relying on a calendar deadline. Review the official Rules notification (G.S.R. 846(E)), the MeitY publication page, and any listed corrigenda or related notifications.
What should a business review?
As a practical preparation exercise, map the digital personal data you handle, purposes, notices, consent or other applicable processing grounds, access and security practices, retention, vendor arrangements, and routes for requests or incidents. Which legal obligations apply and when depends on the text, facts, exemptions, and commencement status.
Does the same checklist apply to every business?
No. A school, clinic, coaching institute, online service, and local consultancy may handle different data and operate under different circumstances. The Act also contains scope provisions and exemptions. Do not infer that a business is exempt—or subject to identical requirements—based only on its size or industry.
Official source register
- MeitY — Digital Personal Data Protection Act
- Gazette — G.S.R. 843(E), Act commencement notification, 13 November 2025
- Gazette — G.S.R. 846(E), DPDP Rules, 13 November 2025
- MeitY — DPDP Rules 2025 publication and related items
Editorial review date: 21 October 2026. This is general information, not legal advice. Recheck official materials for subsequent changes before relying on the timeline.
Use the readiness checklist ↗