India's data protection law, translated.
The DPDP Act, 2023 and the DPDP Rules, 2025 set rules for personal data. They cover how you collect, use, store and share it. This hub explains the framework in plain English. We link claims to official sources. Where we have not confirmed one, we say so on the page.
Short answer: is the DPDP Act in force?
Yes, in part. The DPDP Act, 2023 is India's data protection law. The DPDP Rules, 2025 set out how it works. The first provisions started on 13 November 2025, including the setting up of the Data Protection Board. Consent Manager registration starts on 13 November 2026. Most core duties apply from 13 May 2027. See the full deadlines page and is the DPDP Act in force?
A Data Fiduciary is the business that decides why and how personal data is used. A Data Principal is the person the data is about.
From 13 May 2027, a Data Fiduciary must give a notice when it asks for consent (Section 5(1), Rule 3). It must keep data safe and report data breaches to the people affected and to the Board (Section 8(6), Rule 7). It must also erase data when the purpose is served, and handle complaints. People gain rights to see, fix and erase their data.
Penalties go up to ₹250 crore per breach, under the Act's Schedule (see the penalty schedule). Large firms the government names as Significant Data Fiduciaries have extra duties.
At its core, the DPDP Act sets duties for the Data Fiduciary — the business deciding how personal data is used. It also sets rights for the Data Principal — the person whose data it is. Hover either term for a quick definition.
5 things to know
- 1If you decide the purpose and means of processing personal data of Indian users, you are a Data Fiduciary — even as a solo founder.
- 2Consent must be free, specific, informed, unconditional, unambiguous — and separable from other terms (DPDP Section 6).
- 3Every Data Principal must have a way to raise complaints (a grievance-redressal mechanism, Section 8(10)) and a Board escalation path.
- 4Cross-border transfers are permitted unless the Central Government restricts a destination country (DPDP Section 16).
- 5Penalty ceilings are per breach, not per user affected — but the Board can compound (see the DPDP Schedule).
Written by Sandesh Kokate, reviewed against primary sources.Connect on LinkedIn →
Full enforcement
UPCOMINGuntil full enforcement · 13 May 2027
18 months from the 13 Nov 2025 notification.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
Educational only. Re-verify enforcement dates against the Gazette of India before relying on them.
Explore this cluster
Each sub-article traces to a primary source. Items marked Pending confirmation flag facts not confirmed in the source material used here.
DPDP Act deadlines: 2026 vs 2027
A scannable timeline: 13 Nov 2025 done, 13 Nov 2026 Consent Manager registration, 13 May 2027 full enforcement.
ReadIs the DPDP Act in force yet?
In force vs enforceable: the three commencement phases and the 13 May 2027 date that matters for most businesses.
ReadIs the ₹10,000 crore DPDP penalty real?
No. The highest penalty in the Act is ₹250 crore. The real Schedule tiers, and why the bigger figure is wrong.
ReadIs the Data Protection Board operational yet?
Established in law (DPDP Act s.18; G.S.R. 843(E)). Chairperson and four Members to be appointed (Lok Sabha reply, 12 Aug 2026). The reply does not report any appointment.
ReadThe DPDP Act & Rules — full index
Every section and rule in one place, one plain-English line each, with status and links into each topic.
ReadWho the DPDP Act applies to
Who the Act covers (Section 3). It covers digital data in India, and work abroad for people in India. Two main cases are left out.
ReadDoes the DPDP Act apply to foreign startups?
Yes. Being a foreign company does not get you out. If you offer goods or services to people in India, Section 3(b) applies — no revenue or headcount threshold.
ReadNotice — what a consent notice must say
Section 5 + Rule 3: the itemised, standalone notice that must precede every consent request, and how to refresh old consents.
ReadData Fiduciary vs Data Processor
The Fiduciary decides why and how data is used. The Processor follows its orders. The Fiduciary stays responsible.
ReadData Fiduciary obligations
Your main duties (Section 8, Rules 6 and 9). Keep data safe and correct. Report leaks. Delete data. Handle complaints.
ReadRetention & erasure
Rule 8 + Third Schedule + Section 8(6)–(8): one-year minimum log retention, three-year dormancy rule for large platforms, and the 48-hour erasure warning.
ReadExemptions — startups, research, legal claims, and the State
When some duties do not apply (Section 17, Rule 16). Startups do not get relief by default.
ReadData-breach response
Rule 7 + Section 8(6): the five things every affected user must be told without delay, and the 72-hour detailed report to the Board.
ReadDPDP Rules, 2025
The operational rulebook — how to ask for consent, what to do after a breach, and how to handle complaints.
ReadYour Rights Under the DPDP Act
Your rights: see, fix and delete your data, name someone, and complain.
ReadCross-Border Data Transfers
What happens when personal data of Indian users is sent or stored abroad — foreign clouds and tools included.
ReadConsent Manager
A new kind of firm that manages your consents. Registration provisions commence 13 November 2026 — watch status.
ReadPenalty Schedule
The penalty ceilings in the Act's Schedule, from ₹10,000 to ₹250 crore, and what each one covers.
ReadDPIA Guide
How to do a risk review (DPIA). Large firms named by the government must do one (Rule 13).
ReadData Protection Board of India
Established in law. Chairperson and four Members to be appointed; posts advertised 6 June 2026. The Lok Sabha reply of 12 Aug 2026 does not report any appointment. Last checked 6 Oct 2026.
ReadSignificant Data Fiduciary
Who the DPO, audit and DPIA duties are actually for — and why no organisation has been designated yet.
ReadChildren's data
A child is anyone under 18. Get a parent's proven consent. No tracking and no targeted ads. A few narrow exceptions apply.
ReadData breach response for government departments
One incident, several clocks — CERT-In in 6 hours, the Board and affected citizens under Rule 7 — and which one is actually live today.
ReadAm I a Data Fiduciary?
Want to check your own duties? Run the 2-minute self-check to see exactly what applies to your product.
Run it nowTimeline
How India's privacy law grew, from the 2011 SPDI Rules to the May 2027 deadline.
- 2011
India's first narrow privacy rules
The SPDI Rules covered only some kinds of data, such as money and health data.
India Code — IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 - 2017
Privacy becomes a Fundamental Right
In the Puttaswamy case, the Supreme Court said privacy is a basic right.
Supreme Court of India — Puttaswamy judgment (Primary source not yet confirmed)
- 2018
A dedicated data protection blueprint appears
The Srikrishna Committee wrote a report. It asked for a new privacy law.
Justice Srikrishna Committee Report, 2018 (Primary source not yet confirmed)
- 2023
India enacts a standalone privacy law
The Digital Personal Data Protection Act was passed.
MeitY — DPDP Act, 2023 - 2025Current
Operational rules make the law actionable
The DPDP Rules came out. They tell firms how to handle consent, leaks and complaints.
PIB — DPDP Rules notification - May 2027
Full compliance deadline
By 13 May 2027, firms must have consent notices, rights requests and leak reports working. Reported, not confirmed: press reports say MeitY may shorten this time. We have found no official notice.
PIB — DPDP Rules notification
Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).
Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).
Frequently asked questions
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
How does this apply to you?
Take the 2-minute self-check to find out whether you're a Data Fiduciary, Data Processor, or both — with your personalised action checklist.
Take the DPDP Applicability CheckYour answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.