Breach and enforcement
When does DPDP come into force?
- Short answer
- In phases. The Act received assent in August 2023 and the DPDP Rules 2025 set a staggered commencement, with the main Data Fiduciary obligations binding around May 2027 and Consent Manager registration provisions applying earlier, from November 2026.
The phasing is the practical point. The obligations that most organisations care about, notice, consent, security, rights and breach reporting, are not immediate, which is what gives you a window to prepare.
That window is shorter than it looks for anything involving systems change. Retention rules, access control and vendor contracts take months rather than weeks, and vendor renegotiation is rarely quick.
Because commencement dates are set by notification and can be adjusted, check the current position against the official notifications rather than relying on a secondary source, including this one.
Where this comes from
- DPDP Act 2023 commencement provisions
- DPDP Rules 2025
The mistake people make
Reading a phased commencement as a reason to do nothing, then discovering the work is systems work rather than paperwork.