Understand the rule. Stay in the sector context.
Canonical sector reference plus controlled answers to common scenarios. This page covers specific, common scenarios under the notified DPDP framework; it is not an exhaustive ledger of every possible data collection rule.
!Most of this starts on 13 May 2027What is already in force, and what is still ahead
Most of the substantive provisions discussed on this page, including the general obligations, security safeguards, erasure and dormancy rules, and the child data framework, come into force on 13 May 2027.
A small number of provisions commenced earlier, on 13 November 2025: the definitions, the establishment and machinery of the Data Protection Board, and certain procedural powers.
One further stage is still ahead, on 13 November 2026, and it carries only two things: Consent Manager registration under section 6(9), and the Board’s power under section 27(1)(d) to inquire into a breach of a Consent Manager’s registration conditions.
This page is not a complete list of everything an organisation may collect; it only answers specific, common scenarios under the notified framework.