Key dates of the DPDP Act and Rules
When each part of India's DPDP Act and DPDP Rules, 2025 starts, what each date means for a business, and the two points that are not settled.
The DPDP Act and Rules start in three stages from 13 November 2025, under G.S.R. 843(E) and 846(E).
Not legal advice
This page is a summary, not legal advice. It leaves out detail and exceptions, and the law may change. Read the Act and the Rules, and ask your own counsel.
The three stages#
| From | Sections of the Act (G.S.R. 843(E)) |
|---|---|
| 13 November 2025 | 1(2), 2, 18 to 26, 35, 38 to 43, and 44(1) and (3): definitions, setting up the Board, the power to make rules and changes to other laws |
| 13 November 2026 | 6(9) and 27(1)(d): registration of Consent Managers and the Board's power over them |
| 13 May 2027 | 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 except 27(1)(d), 28 to 34, 36, 37 and 44(2): notice, consent, the duties of a business, rights, children, transfers, the Board's inquiries, appeals and penalties |
| From | Rules (Rule 1) |
|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21: definitions and the Data Protection Board |
| 13 November 2026 | Rule 4: registration and obligations of Consent Managers |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23: notice, security, breach, erasure and retention, contact details, children, Significant Data Fiduciaries, rights, transfers outside India and the rest |
The DPDP Act check dates each finding from these dates. Its rule set has a version and a review date. See DPDP rule set.
What each date means for you#
13 November 2025. The rules on definitions and on the Data Protection Board start. The Board is where people may complain.
13 November 2026. Registration opens for Consent Managers. That is a separate role from yours. PIEDAP Consent serves you, the Data Fiduciary, and does not act as a Consent Manager.
13 May 2027. The rules that set the main duties of a business start. They cover the notice, security, breaches, erasure and retention, your contact details, children, rights requests and transfers outside India.
What is not settled#
Two points are open.
- 13 or 14 November. The Gazette issue and the notification are dated 13 November 2025. The Government's explainer says the Rules were notified on 14 November 2025. These pages follow the Gazette. If 14 November were taken as the date of publication, each later date would move by one day.
- A shorter timeline was proposed. In January 2026 the Ministry of Electronics and Information Technology was reported to have proposed cutting the 18 months to 12. That would bring the main duties forward to 13 November 2026. Reports differ on whether this would apply to every business or only to Significant Data Fiduciaries. We found no Gazette notification making this change by early October 2026. If one comes, the operator of your deployment can set the new date, and the check tells you.
Check the Gazette, or ask your counsel, before you plan around 13 May 2027.
The three years of inactivity#
Some large platforms must erase a person's data after three years without contact. As we read the Third Schedule, those three years cannot start before the Rules commenced. The Rules start in stages, and we found no statement of which date is meant. Ask your counsel.
The product counts from the earliest date, 13 November 2025, for records under the Act. Erasure is then never later than required. See Existing data and retention.
How the product helps#
The DPDP Act check, in the top bar, reports what passes and what needs fixing in your set-up. It covers only what the product can see: a website and your project. It is not an audit of your organisation. See Run the DPDP check.