Is the DPDP Act in force yet — and when does it actually apply to me?
Partly. The framework started phasing in on 13 November 2025, but the obligations you can be penalised for start on 13 May 2027.
Short answer
Yes — but only partly. Some of the DPDP Act is already on the statute book, and none of the obligations that apply to ordinary businesses are enforceable yet. Those switch on 13 May 2027.
The detail
Two different things get called "in force". A provision is in force when the government has commenced it — it legally exists and operates. A provision is enforceable against you when it creates a duty you can be penalised for failing. The DPDP Act separates the two by commencing in phases.
The Act (Act 22 of 2023) was assented on 11 August 2023 but commenced nothing at that point. The DPDP Rules 2025, notified on 13 November 2025, set the timetable: institutional plumbing first, Consent Manager registration starts 13 November 2026 (one year after 13 November 2025). Most duties start 13 May 2027 (eighteen months after 13 November 2025).
The practical consequence: today no one can be fined under the Act, and the Data Protection Board is not taking complaints. The eighteen-month runway to 13 May 2027 is the build window — notice flows, consent records, breach procedures, and retention rules all need to be working on day one, not started then.
The three phases
Definitions, the Board sections, and some general sections started on this date. The rule-making Rules 1, 2 and 17 to 21 also started.
Act: Section 1(2), 2, 18–26, 35, 38–43, 44(1) and 44(3) · Rules 1, 2, 17–21 · G.S.R. 843(E)(a), Rule 1(2)
The Consent Manager sections and Rule 4 (Consent Manager registration) start.
Act: Section 6(9), 27(1)(d) · Rule 4 · G.S.R. 843(E)(b), Rule 1(3)
Most duties start. This covers notice, consent, security, breach reports, children's data, rights, cross-border transfers, penalties and the change to the IT Act.
Act: Sections 3–5, 6(1)–(8) and 6(10), 7–17, 27 (except 27(1)(d)), 28–34, 36, 37, 44(2) · Rules 3, 5–16, 22, 23 · G.S.R. 843(E)(c), Rule 1(4)
What the penalties actually are
The Schedule sets these ceilings, effective 13 May 2027. The highest figure in the Act is ₹250 crore — there is no ₹10,000 crore tier.
Full breakdown on the penalty schedule page.
What this means for you
You have until 13 May 2027 to have notice, consent records, breach response, and retention working — treat it as a build deadline, not a start date.
Client contracts signed now will still be running in 2027, so write DPDP processor terms into them today rather than renegotiating later.
Audience email lists and community sign-ups fall under the consent rules from 13 May 2027 — start capturing how and when people opted in.
Status
Read next
Primary sources
Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).
Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).
G.S.R. 846(E), 13 November 2025 (Gazette ID CG-DL-E-14112025-267650) — sets the phased commencement dates.
Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).
13 November 2025. Sets when each section of the Act starts.
Notified — checked 2026-10-06. Opened G.S.R. 843(E) (Gazette PDF).
Citation
Kokate, S. (2026). Is the DPDP Act in force yet — and when does it actually apply to me? India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/is-dpdp-in-force. Educational content, not legal advice.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.