DPDP: which duties start when.
The Digital Personal Data Protection Act, 2023 received assent on 11 August 2023 and waited two years for a commencement notification. That notification, on 13 November 2025, brought it into force in three phases. Here is what each phase switches on.
The three dates
| Date | What comes into force | Where it says so |
|---|---|---|
| 13 November 2025 | The definitions, and the Data Protection Board of India. | G.S.R. 843(E) and 844(E) |
| 13 November 2026 | Consent Manager registration opens and Rule 4 comes into force. | G.S.R. 843(E) phase 2; Act s.6(9), s.27(1)(d) |
| 13 May 2027 | The substantive duties: notice, consent, security safeguards, breach notification, data principal rights, and the duties of Significant Data Fiduciaries. | G.S.R. 843(E) phase 3; Act ss.3 to 17 |
Who the Act reaches is a functional test, not a size test. A Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. There is no revenue or headcount threshold. The Central Government may notify some fiduciaries as Significant Data Fiduciaries, and those carry extra duties.
Already in force
Since 13 November 2025 the Act's definitions apply and the Data Protection Board of India exists. For most businesses this phase changes nothing day to day, but it fixes the vocabulary: data principal, data fiduciary, data processor, personal data breach. It is worth using those words in your own policies now, because the later duties are written in them.
From 13 November 2026: Consent Managers
A fiduciary that allows consent to be given through a Consent Manager may work only with Consent Managers registered with the Board, which act as the data principal's accountable agent.
Act s.6(7) to (9); Rule 4If you do not intend to take consent through a Consent Manager, this phase asks nothing of you. If you do, the register opens on this date.
From 13 May 2027: the duties most businesses are preparing for
Notice and consent
Before or with every request for consent, the fiduciary must give an itemised notice of the personal data collected, the purpose, and how to withdraw consent, exercise rights or complain to the Board. The notice must stand on its own, in clear plain language, in English or any Eighth Schedule language.
Act s.5(1), s.5(3); Rule 3Consent itself must be free, specific, informed, unconditional, unambiguous and given by clear affirmative action, limited to the data needed for the stated purpose. It must be as easy to withdraw as to give, and the fiduciary carries the burden of proving that notice was given and consent obtained.
Act s.6(1) to (6), s.6(10).
Security safeguards
Reasonable security safeguards must include measures such as encryption, obfuscation, masking or tokenisation; control of access to the computer resources used for processing; logs, monitoring and review to detect and investigate unauthorised access, with those logs and the personal data retained for at least one year; backups for continued processing; and contracts that require data processors to take the same safeguards.
Act s.8(5); Rule 6(1)(a) to (g); Rule 8(3)Breach notification
On becoming aware of a personal data breach, the fiduciary must without delay intimate the Board, and intimate each affected data principal in plain language. Within 72 hours of becoming aware, or such longer period as the Board allows on written request, it must give the Board updated details, the root cause, mitigation and remedial measures taken, and a report on the intimations to data principals.
Act s.8(6); Rule 7(1), 7(2)(a) and (b)Note the sequence. The first intimation is without delay, which is a stricter standard than 72 hours. The 72 hours is for the detailed follow-up.
Erasure and retention
Unless retention is required by law, personal data must be erased once consent is withdrawn or the purpose is no longer served, and the fiduciary must make its processors do the same. For classes of fiduciary listed in the Third Schedule, data must be erased after the prescribed period if the data principal has not come back, with at least 48 hours' warning. Personal data, traffic data and processing logs for Seventh Schedule purposes are kept for at least one year before erasure.
Act s.8(7), (8) and (11); Rule 8(1) to (3).
Rights, a contact person and grievances
The fiduciary must publish the business contact of its Data Protection Officer, or another person able to answer questions about processing, and must establish a grievance mechanism that responds within a period not exceeding 90 days before the data principal may approach the Board.
Act s.8(9), s.8(10), s.13; Rule 9; Rule 14(3)Data principals may ask for a summary of their personal data and who it was shared with, have it corrected, completed, updated or erased, and nominate a person to exercise these rights if they die or lose capacity. The fiduciary must publish how to exercise each right.
Act ss.11 to 14; Rule 14(1), (2) and (4).
Children
Before processing a child's personal data, the fiduciary needs verifiable parental consent, and must not track, monitor the behaviour of or target advertising at children.
Act s.9(1) to (3); Rule 10.
Extra duties for Significant Data Fiduciaries
A fiduciary notified as significant must appoint a Data Protection Officer based in India who reports to the Board of Directors, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and a compliance audit once every twelve months, reporting significant observations to the Board. It must also check that its algorithmic software does not put data principals' rights at risk, and must keep any categories of personal data the Central Government specifies within India.
Act s.10(2); Rule 13(1) to (5).
What to do between now and May 2027
The notice, the consent flow, the security safeguards and the breach procedure all need to exist before the date, and each is a document an auditor or the Board can ask for. In AuditSahi's rulebook the DPDP Act and Rules carry 37 obligations, 31 for every fiduciary and 6 more for significant ones, and the calendar shows the three dates above against your own organisation.
Sources
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). meity.gov.in
- Commencement notification G.S.R. 843(E) and the Digital Personal Data Protection Rules, 2025, G.S.R. 844(E), both dated 13 November 2025. meity.gov.in
Every clause cited here is marked verified in AuditSahi's rulebook, meaning it was read in the Act, the Rules or the notification itself.
AuditSahi holds the DPDP duties for any Indian business, with each date on the calendar and the section beside each obligation.
Create a free account