What is in force today
Verified August 2026 · Checked fortnightly
Two documents commence in stages and they are often confused. The Act has its own commencement notification. The Rules have their own commencement clause. Both were issued on 13 November 2025 and both run on three dates.
The Board provisions and the rule-making power are in force. Almost none of the obligations are in force. Definitions, the Board and the rule-making power started in November 2025. Notice, consent, security, breach reporting, rights, transfers and penalties start on 13 May 2027.
The Act
Section 1(2) allows different dates for different provisions. The Central Government appointed those dates by a notification of 13 November 2025.
| Provision | What it covers | Starts | Status |
|---|---|---|---|
| s.1(2), s.2 | Commencement clause and the definitions in section 2. See all twenty-eight defined terms. | 14 Nov 2025 | In force |
| ss.18–26 | The Data Protection Board of India. Establishment, composition, appointment, salary, terms and officers. | 14 Nov 2025 | In force |
| s.35, ss.38–43 | Miscellaneous provisions, including the bar on civil court jurisdiction in section 39 and the power to make rules under section 40. See what that bar means while the Board has no powers. | 14 Nov 2025 | In force |
| s.44(1) | The amendment to the Telecom Regulatory Authority of India Act, 1997, which sends appeals to the Appellate Tribunal. The right of appeal itself starts in May 2027 — see the courts. | 14 Nov 2025 | In force |
| s.44(3) | The substitution of section 8(1)(j) of the Right to Information Act, 2005. | 14 Nov 2025 | In force |
| s.6(9), s.27(1)(d) | One duty relating to consent, and one function of the Board. | 13 Nov 2026 | Starts later |
| ss.3–5 | Application of the Act, grounds for processing, and the notice a Data Fiduciary must give. See who the Act applies to and the notice languages. | 13 May 2027 | Starts later |
| s.6 (rest), ss.7–10 | Consent, certain legitimate uses, general obligations of a Data Fiduciary, children's data, and Significant Data Fiduciaries. | 13 May 2027 | Starts later |
| ss.11–17 | Rights and duties of a Data Principal, transfer outside India, and exemptions. | 13 May 2027 | Starts later |
| s.27 (rest), ss.28–34 | Powers and procedure of the Board, appeals, alternate dispute resolution, penalties and adjudication. See the penalties. | 13 May 2027 | Starts later |
| s.36, s.37 | Power to call for information and power to issue directions to block. | 13 May 2027 | Starts later |
| s.44(2) | The amendment to the Information Technology Act, 2000, which omits section 43A of that Act. | 13 May 2027 | Starts later |
Section 44(2) is not in force. Section 43A of the Information Technology Act, 2000 has therefore not been omitted and is still law. So are the rules made under it. Published commentary often says otherwise. Section 43A and the DPDP Act provisions now in force both apply until 13 May 2027.
The Rules
Seven of the twenty-three DPDP Rules are in force. The remaining sixteen carry start dates in November 2026 and May 2027.
| Provision | What it covers | Starts | Status |
|---|---|---|---|
| Rules 1, 2 | Short title, commencement and definitions. | 14 Nov 2025 | In force |
| Rules 17–21 | Appointment, salary and terms of the chairperson and members. The procedure for meetings. The Board as a digital office. The terms of its officers and employees. | 14 Nov 2025 | In force |
| Rule 4 | Consent Manager registration, together with the First Schedule. See the conditions in full. | 13 Nov 2026 | Starts later |
| Rule 3 | The notice given by a Data Fiduciary to a Data Principal. See which languages it must be available in. | 13 May 2027 | Starts later |
| Rule 6 | Reasonable security safeguards. Rule 6(1)(e) sets a one year retention period for logs. See how that sits against the erasure rule. | 13 May 2027 | Starts later |
| Rule 7 | Intimation of a personal data breach. | 13 May 2027 | Starts later |
| Rule 8 | Erasure after a period of dormancy, together with the Third Schedule. See retention and erasure. | 13 May 2027 | Starts later |
| Rule 10 | Verifiable consent of a parent or lawful guardian for a child. | 13 May 2027 | Starts later |
| Rule 13 | Additional obligations of a Significant Data Fiduciary. See what a Significant Data Fiduciary is. | 13 May 2027 | Starts later |
| Rule 14 | Exercise of rights by a Data Principal. | 13 May 2027 | Starts later |
| Rule 15 | Transfer of personal data outside India. | 13 May 2027 | Starts later |
| Rules 5, 9, 11, 12, 16 | The remaining provisions in the eighteen month group. | 13 May 2027 | Starts later |
| Rules 22, 23 | Rule 22 sets the procedure for an appeal to the Appellate Tribunal. Rule 23 lets the Central Government call for information from a Data Fiduciary or an intermediary. | 13 May 2027 | Starts later |
Both notifications carry the date 13 November 2025. Several sources record publication in the Gazette on 14 November 2025. The twelve month and eighteen month periods run from the date of publication, so every future date on this page can fall one day later than shown. Read the commencement clause yourself where a single day matters.
Powers the Government has not used
Six powers under the Act and the Rules remain unexercised. Each one decides who an obligation applies to. Until the Government uses the power, the obligation has no one to attach to.
| Power | What the silence means | Status |
|---|---|---|
| s.10(1), Rule 13 | The Central Government has designated no Significant Data Fiduciary. No audit duty or impact assessment duty has attached to anyone. | Not used |
| s.16 | No country has been restricted as a destination for personal data. Transfers remain governed by contract and by sector regulators. | Not used |
| Rule 13(4) | No class of personal data has been required to stay inside India. | Not used |
| s.17(3) | No startup has been exempted. The exemption cannot yet be relied on by anyone. See the exemptions. | Not used |
| Rule 4 | No Consent Manager has been registered. Registration opens in November 2026. See the registration conditions. | Not used |
| The Board | No chairperson and no member has been appointed against the advertisement of 6 June 2026. | Not used |
How to read this page
In force means the provision binds the organisations it applies to today. Starts later means the provision is notified and carries a date that has not arrived. Not used means the power exists in the law and the Government has not exercised it.
This site uses green to mark a provision that is in force. It marks nothing else.
A notification in the Gazette of India bringing a provision into force, designating a Significant Data Fiduciary, restricting a destination country, or exempting a class of startup. An appointment to the Data Protection Board. A registration granted to a Consent Manager.
This page is checked against the Gazette and the MeitY website every fortnight. The date at the top is the date of the last check, not the date of the last change.