The Brief · Issue 01
Five dates that decide your DPDP year
What is already law, what starts next month, and the date everything else arrives.
The Digital Personal Data Protection Act did not arrive all at once. It is arriving in stages, and two of them are still ahead.
- 11 August 2023. The Act receives the President’s assent.
- 13 November 2025. The DPDP Rules are notified. The provisions setting up the Data Protection Board take effect.
- November 2026. Registration with the Board opens under Rule 4.
- 13 May 2027. Everything else: notices, consent, security safeguards, breach reporting, children’s data and the rights of the people whose data you hold.
- The same day, section 43A of the IT Act and the SPDI Rules of 2011 fall away. Until then, they still apply.
A shorter timeline for the largest companies, the Significant Data Fiduciaries, has been floated. It has not been notified.
The useful reading: the Rules gave businesses eighteen months, and most of that has already gone. What is left is about the time it takes to find out what data you actually hold, where it goes, and who can see it. That part cannot be rushed in the last month.
General information on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified. It is not legal advice for your business.