Is the DPDP Act in Force? What Applies Today and What Switches On in 2026–27

"Is the DPDP Act in force?" is the most common question we get, and the honest answer is partly. The Act was passed in August 2023, but it only began to commence when the government notified the DPDP Rules 2025 on 13 November 2025 and chose a three-phase rollout.

Phase 1: in force since 13 November 2025

The notifications of that date were the Rules (G.S.R. 846(E)), the commencement notification (G.S.R. 843(E)) and the establishment of the Data Protection Board (G.S.R. 844(E)). Corrigenda fixing textual errors followed in December 2025.

What commenced:

• Act: Sections 1(2), 2 (definitions), 18–26 (the Data Protection Board), 35, 38–43 (rule-making, protection of action in good faith, removal of difficulties) and 44(1) and 44(3) (amendments to other laws, including the RTI Act).
• Rules: Rules 1, 2 and 17–21, covering the Board's appointment, service conditions, functioning and techno-legal operation.

What this means: the institution exists, but no Data Fiduciary obligation or Data Principal right is enforceable yet, and Section 33 (penalties) has not commenced.

Phase 2: 13 November 2026

One year after notification, Rule 4 and the First Schedule commence along with Sections 6(9) and 27(1)(d), so Consent Managers can be registered by the Board. Details: Consent Managers go live on 13 November 2026.

Phase 3: May 2027 (18 months)

Eighteen months after notification, so on or around 13 May 2027, the substance of the law switches on:

• Rules 3, 5–16, 22 and 23: notice, state processing, security safeguards, breach intimation, retention and erasure, contact details, children and persons with disability, SDF obligations, rights, cross-border transfers, research exemptions and government calls for information.
• Sections 3–17 of the Act, plus the penalty regime in Section 33 and the Schedule (fines up to ₹250 crore).

Most commentary treats the May 2027 date as derived from the 18-month formula rather than separately confirmed. Some secondary sources quote 12, 13 or 14 May. Plan for the earliest date.

Could the timeline get shorter?

In January 2026 MeitY reportedly consulted industry on compressing the 18-month window to 12 months for some or all Data Fiduciaries. As of 15 October 2026 no notification giving effect to that proposal has been published, so the May 2027 date stands. See MeitY's proposal to shorten the DPDPA timeline.

What has changed in 2026

• 16 February: The Supreme Court issued notice on challenges to the Act, refused a stay and referred the RTI questions to a larger bench (details).
• 6 May: MeitY invited applications for the Board's Chairperson and four Members (details).
• October: The Removal of Difficulties Order amended the wording of Sections 9(1) and 10(2)(c)(ii) (details).

The practical takeaway

There are roughly seven months between today and the date enforcement begins. That is not long for data discovery, consent redesign, breach runbooks and vendor contracts. Use our 210-day roadmap and the readiness assessment to plan the work.

Position as of 15 October 2026. Verify dates against the Gazette of India. Not legal advice.