DPDP rule set
The versioned dates, periods, lists and rules of the DPDP Act and Rules, their Gazette sources, changes, notices and the version kept on each record.
The DPDP Act check, deadlines, forms, requests, breaches and erasure follow one rule set. It holds the dates, periods, thresholds, lists and wording of the law, and the rules the platform team writes. Each has its Gazette source; the set has a version and a review date. DPDP Act check > Law updates shows it.
Version#
| Field | Value |
|---|---|
version |
2026.2 |
reviewedOn |
7 November 2026, the day the dates, periods and quotes were last checked against the Gazette |
| Publication | 13 November 2025, for both notifications |
The report states it as Rules version 2026.2, reviewed on 7 November 2026. A new release that changes a date, a period, a quote or a check raises the version.
Commencement dates#
The Act came into force under section 1(2), by G.S.R. 843(E) of 13 November 2025. The Rules set their own dates in rule 1 of G.S.R. 846(E), of the same day.
| Key | Date | What comes into force | Source |
|---|---|---|---|
act-publication |
13 November 2025 | Sections 1(2), 2, 18 to 26, 35, 38 to 43, and 44(1) and (3) of the Act | G.S.R. 843(E), on publication |
act-one-year |
13 November 2026 | Sections 6(9) and 27(1)(d) | G.S.R. 843(E), one year after publication |
act-eighteen-months |
13 May 2027 | Sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 except 27(1)(d), 28 to 34, 36, 37 and 44(2) | G.S.R. 843(E), eighteen months after publication |
rules-publication |
13 November 2025 | Rules 1, 2 and 17 to 21 | G.S.R. 846(E), rule 1(2) |
rules-one-year |
13 November 2026 | Rule 4 | G.S.R. 846(E), rule 1(3) |
rules-eighteen-months |
13 May 2027 | Rules 3, 5 to 16, 22 and 23 | G.S.R. 846(E), rule 1(4) |
Law updates links each date to its Gazette copy on egazette.gov.in.
Periods and limits#
All five come from G.S.R. 846(E).
| Key | Value | What it sets | Rule | Used by |
|---|---|---|---|---|
response-period-days |
90 days | The longest time to answer a grievance or rights request | Rule 14(3) | The deadline of each request in India, and the request page |
board-report-hours |
72 hours | The time to send the Board the full report of a breach | Rule 7(2)(b) | The Board deadline of each breach |
erasure-notice-hours |
48 hours | The least notice before erasure for inactivity | Rule 8(2) | Inactivity erasure, which sends subject.erasure_notice 24 hours earlier than this |
inactivity-period-days |
1,095 days | Inactivity before erasure, for the classes in the Third Schedule | Rule 8(1) and the Third Schedule | The DPDP Act check |
log-retention-days |
365 days | The least time to keep personal data and logs of each processing | Rule 8(3) | The evidence retention floor in Settings and the check |
Thresholds, lists and wording#
The platform team can amend each of these from a date, like a period. The product reads the value in force on the day.
| Key | What it holds | Source | What reads it |
|---|---|---|---|
sdf-period-months |
12 months between impact assessments and audits | Rule 13(1) | The next due date of a Significant Data Fiduciary assessment |
child-age |
18: a child has not completed this age | Section 2(f) | The banner's age question and each age declaration |
third-schedule-classes |
The classes whose inactive users are erased | Third Schedule | The inactivity hint in Settings and the check |
eighth-schedule-languages |
English and the 22 languages of the Eighth Schedule | Sections 5(3) and 6(3) | The language checks |
legitimate-uses |
Uses (a) to (i) that need no consent | Section 7 | A purpose's legitimate use, and the legal basis check |
child-exemptions |
The Fourth Schedule exemptions | Fourth Schedule, rule 12 | A purpose's exemption, and decisions for a child |
child-barred-categories |
Purpose categories refused for a child | Sections 9(2) and 9(3) | Decisions recorded for a child |
rights |
The rights a person can ask for | Sections 6(4), 11 to 14 | Request types, and the hosted request page |
acting-as |
Who may act for a person | Section 14, rule 11 | A request's Acting as, and the hosted request page |
restricted-countries |
Countries the Government restricts transfers to; none is notified | Section 16(1) | A processor's country, and the hosting checks |
notice-elements |
What a notice must contain | Section 5, rule 3 | Publishing a DPDP form, and the notice checks |
breach-intimation-fields |
What the first intimation of a breach says | Rule 7(1) | The breach register |
breach-report-fields |
What the full report to the Board says | Rule 7(2) | The breach register |
board-complaint-route |
How to complain to the Board; a link once one is set | Section 13, rule 3(c) | The banner, hosted pages, and publishing a DPDP form |
A list the product acts on by key, such as rights, takes only keys the product understands.
Rules the platform team writes#
A rule the team writes adds a check to the DPDP Act check. It names the projects it is for, and the conditions that mean a project meets it. Without such conditions, each project confirms it. See Write a DPDP rule.
| Field | Values |
|---|---|
appliesTo |
ALL, SDF, CHILDREN or CONSENT_MANAGER |
appliesWhen, metWhen |
match (ALL or ANY) and up to 12 conditions of fact, operator and value |
severity |
FAIL or WARN |
enforcement |
CHECK, or BLOCK_PUBLISH to refuse publishing a form with LAW_RULE_NOT_MET while it is not met |
startsOn |
The day it starts to apply, or none |
A number fact can be compared with { "rule": "<key>" }, the value in force of a period or threshold above.
| Operators | For |
|---|---|
IS_TRUE, IS_FALSE |
Yes or no facts |
EQ, NE, LT, LTE, GT, GTE, IS_SET, IS_EMPTY |
Numbers |
EQ, NE, IS_SET, IS_EMPTY |
Text |
INCLUDES, EXCLUDES, IS_SET, IS_EMPTY |
Lists |
| Fact | What it is | Type |
|---|---|---|
project.significantDataFiduciary |
Notified as a Significant Data Fiduciary | boolean |
project.asksAge |
A form asks the person’s age | boolean |
project.consentManagers |
Consent Managers connected | number |
settings.privacyContactSet |
A privacy contact email is set | boolean |
settings.grievanceOfficerSet |
A grievance officer is named | boolean |
settings.dpoNamed |
A Data Protection Officer is named | boolean |
settings.responseDays |
Days the project promises to answer a request in | number |
settings.retentionDays |
Days evidence is kept | number |
settings.inactivityDays |
Days of inactivity before erasure (none when off) | number |
form.published |
The form serving India is published | boolean |
form.languages |
Languages the form is written in | list |
form.complaintLinkSet |
The form links to the Board for complaints | boolean |
form.rejectAllShown |
The first layer shows Reject all | boolean |
purposes.count |
Purposes on the form | number |
purposes.consentWithoutData |
Consent-based purposes that do not list their data | number |
purposes.consentWithoutDescription |
Consent-based purposes without a description | number |
purposes.alwaysOnByConsent |
Consent-based purposes that are always on | number |
purposes.legitimateUses |
Legitimate uses the purposes rely on | list |
purposes.childExemptions |
Fourth Schedule exemptions the purposes rely on | list |
site.scanned |
The site has been scanned | boolean |
site.bannerShown |
The banner was shown to a visitor in India | boolean |
site.trackersBeforeConsent |
Trackers set before a choice | number |
site.withdrawalOnPage |
People can withdraw from the page | boolean |
webhooks.withdrawalReceived |
An endpoint receives consent.withdrawn | boolean |
webhooks.erasureNoticeReceived |
An endpoint receives subject.erasure_notice | boolean |
requests.overdue |
Rights requests past their due date | number |
breaches.reportsOverdue |
Breach reports to the Board past their deadline | number |
breaches.reportsPending |
Open breaches still to report to the Board | number |
processors.count |
Processors registered | number |
processors.countries |
Countries processors are in | list |
processors.withoutCountry |
Processors whose country is not recorded | number |
hosting.country |
Country the deployment keeps data in | text |
A fact the product does not know yet, such as a site never scanned, leaves the check Not checked yet.
Which value a case uses#
A value applies from the start of its day in India.
| Case | Value it uses | Kept on the case |
|---|---|---|
| A request | The response period in force on the day it is received | rulesetVersion |
| A breach | The report window in force when the business became aware. Changing the time of awareness takes the window in force then | boardReportHours and rulesetVersion |
| An inactivity notice | The notice period in force when the hourly run sends it | — |
| Saving Settings | The retention floor in force on the day | — |
A case keeps its deadline when the value changes later. The request drawer shows Set under DPDP rules with the version, and the breach drawer shows the hours and the version beside the Board deadline.
How a check is dated#
Each check quotes the provisions it rests on. Its applies from date is the latest commencement among them. A quote from the Government's explainer carries no date. Most checks rest on sections 5, 6, 8 or 9 and on rules 3 to 14, so they apply from 13 May 2027.
A date or value set by the operator#
If the Government changes the law, the platform team records it without a new release. See Change a DPDP rule.
| Where | What it shows |
|---|---|
| Each check | The new applies from date and Date set by the operator on the day it was set |
| Law updates | The new date or value, the notification the operator gave, the day it was recorded and the release's date or value. An amendment that has not started yet is listed under Coming into force |
| The report | rules names each such date. ruleset.dates and ruleset.values hold setBy: "OPERATOR", the release's date or value, and the operator's reason and source |
A date must be a calendar date from 13 November 2025 to 31 December 2035. A value must be a whole number within its limits, and its start date no earlier than 13 November 2025. Either applies to every project on the deployment.
When the rule set changes#
Each project keeps the version and a fingerprint of the dates and values someone last acknowledged. While the rule set in force differs:
- Law updates and the check page list each date, value, list or wording that changed, and each rule written or retired, with I have read this
- the Overview lists The DPDP rule set changed under things to look at
- the project receives one
ruleset.changedwebhook
I have read this needs the permission to change project settings. It clears the notice for everyone in the project until the next change. A project that has never seen a rule set starts from the current one, without a notice.