DPDP Act Enforcement Date: The Complete Timeline From 2023 Assent to 13 May 2027

Is the DPDP Act in force?

Partly. Since 13 November 2025, section 1(2), the definitions in section 2, the provisions establishing the Data Protection Board (ss.18 to 26) and certain miscellaneous provisions have been in force. The duties that matter to a business, such as notice, consent, security, breach intimation and erasure, are not yet in force as of October 2026. They commence on 13 May 2027 under paragraph (c) of G.S.R. 843(E).

The Rules follow the same pattern. Rule 1(2) brings Rules 1, 2 and 17 to 21 into force on publication. Rule 1(3) brings Rule 4, on consent manager registration, into force one year later. Rule 1(4) brings Rules 3, 5 to 16, 22 and 23 into force eighteen months after publication.

The DPDP Act 2023 commencement timeline

Which sections started on which date?

G.S.R. 843(E) was issued under s.1(2), which lets the Central Government appoint different dates for different provisions. It has three paragraphs, and each one is a tranche.

Why the DPDP Act effective date is still 13 May 2027

In early 2026 the government proposed shortening the eighteen-month window, which would bring the third tranche forward. A proposal is not law. A change would need a fresh notification in the Gazette under s.1(2). As of October 2026, no notification changing the dates in G.S.R. 843(E) had been published, so the DPDP Rules 2025 implementation date for the core duties remains 13 May 2027.

The practical risk runs one way. If the date moves, it is likely to move earlier, not later. Planning to be ready well before 13 May 2027 protects you either way.

The one Gazette change in 2026 is the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), dated 5 October 2026. It is textual only. It adds the word ‘of’ in s.9(1) so that verifiable consent clearly covers the data of a child or of a person with disability who has a lawful guardian, and it changes ‘audit’ to ‘data audit’ in s.10(2)(c)(ii). It changes no dates and no duties.

What should a business have done by each date?

The dates set the law. The order of work below is recommended practice, built backwards from them. Our DPDP compliance checklist guide has the full item-by-item list.

• By 13 November 2025: nothing was legally required, but this was the signal to start. The Rules gave businesses eighteen months of lead time.
• By 13 November 2026: a data inventory, a list of vendors that receive personal data with their renewal dates, and an owner for DPDP work. Decide how you will handle consent given or withdrawn through a registered consent manager under s.6(7); how far a fiduciary must integrate with one is not yet settled.
• By early 2027: notices drafted to Rule 3, consent and withdrawal flows built (s.6), a grievance process with a published response period of not more than ninety days (Rule 14(3)), a rights request process (ss.11 to 14), and a retention schedule reflecting the one-year log minimum (Rules 6(1)(e) and 8(3)).
• By early 2027: vendor contracts updated so each processor operates under a valid contract with a security provision (s.8(2), Rule 6(1)(f)), plus breach notice, erasure and sub-processor terms as recommended practice.
• By 13 May 2027: a tested breach response plan that can meet Rule 7, including the 72-hour report to the Board; security safeguards meeting Rule 6; and, for existing users, a plan to send the s.5(2) notice as soon as reasonably practicable.
• After 13 May 2027: watch for notifications on Significant Data Fiduciaries (s.10), transfer restrictions (s.16) and exemptions (s.17).

When will the DPDP Act be implemented for contracts you sign today?

From 13 May 2027, as of October 2026, whatever the contract says. The Act does not apply only to contracts signed after that date. It applies to processing. A three-year SaaS agreement a Bengaluru company signs in November 2026 will be governed by the Act for roughly two of its three years.

Two provisions make this concrete. Section 8(1) makes the fiduciary responsible for processing by its processors irrespective of any agreement to the contrary, so a contract that is silent on DPDP does not shield you. Section 8(2) requires a valid contract with each processor, and Rule 6(1)(f) calls for an appropriate security provision in it. Both apply to existing engagements from 13 May 2027, not just new ones.

The sensible approach, which is recommended practice rather than a legal requirement, is to write DPDP terms into contracts now, or to include a clause that applies them automatically from the commencement date. Our guides on data processing agreement clauses and on section 8 cover the wording, and our free data processing addendum template gives you a starting draft.

Penalties follow the same date. Sections 28 to 34 also commence on 13 May 2027, so the Board is unlikely to be able to penalise conduct before then under the Act. See our guide on DPDP penalties for the Schedule and how amounts are set.

How to check the current status yourself

Dates in secondary sources, including this page, can go stale. Two primary places are worth checking. The first is the Gazette of India, Extraordinary, where every commencement notification, amendment to the Rules and order under the Act is published. Search for the Digital Personal Data Protection Act and look for any notification after G.S.R. 843(E) of 13 November 2025. The second is the website of the Ministry of Electronics and Information Technology (MeitY), which publishes the Act, the Rules, notifications and press releases.

When you find a notification, check three things: its G.S.R. or S.O. number, the date of publication in the Gazette, and which sections or rules it names. A press report of a proposal is not a change in the law until it appears in the Gazette.

Why check your vendor contracts with ClauseAudit before 13 May 2027?

From 13 May 2027 you answer for your vendors under s.8(1), whatever the contract says, and a failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Many vendor contracts signed before November 2025 are likely to say nothing about DPDP.

You have three honest choices. An advocate’s review is thorough and the right call for material deals, but it is slower and costlier per contract. A free checklist is fast, but you still have to read every clause yourself. ClauseAudit’s DPDP Compliance Check reads the whole agreement, schedules included, in minutes, for ₹999 per contract. Each finding is tied to the section or rule, or labelled recommended practice. You get the clause quoted, a suggested fix, a redline and a negotiation email. You can review as customer or vendor, and the document is not stored after the review.

It is an AI-assisted review and can miss things. For large or sensitive deals, children’s data at scale, or regulated sectors, an advocate should review the contract.