India’s Digital Personal Data Protection framework is being implemented in phases. Here is a practical guide to what is applicable today, what starts in November 2026 and what businesses must prepare for by May 2027.
India’s Digital Personal Data Protection (DPDP) Act, 2023, marks an important shift in how businesses collect, process, store and use personal data. However, one aspect of the new framework deserves particular attention: not all provisions of the DPDP Act and Rules become applicable at the same time.
The Central Government has adopted a phased implementation approach through two important notifications dated 13 November 2025: G.S.R. 843(E), which specifies the commencement of provisions of the Act, and G.S.R. 846(E), which notifies the Digital Personal Data Protection Rules, 2025.
For businesses, this distinction is important. An obligation being notified does not necessarily mean that it is already legally enforceable.
Let’s understand the implementation timeline and its implications.
1. The DPDP implementation timeline
The implementation framework is divided into three phases.
Phase I: 13 November 2025 – Provisions already in force
Certain institutional and administrative provisions have commenced.
These include:
- Section 2 of the Act, containing definitions.
- Sections 18–26, dealing with the Data Protection Board of India.
- Sections 35 and 38–43, dealing with specified miscellaneous and institutional matters.
- Sections 1(2), 44(1) and 44(3).
- Rules 1, 2 and 17–21 of the DPDP Rules, 2025.
This phase establishes the institutional and administrative foundation of the DPDP framework, including the Data Protection Board and its functioning.
Phase II: 13 November 2026 – Consent Manager framework
The next milestone is the commencement of Rule 4 of the DPDP Rules, 2025, along with Section 6(9) and Section 27(1)(d) of the Act.
Rule 4 deals with the registration and obligations of Consent Managers.
A Consent Manager is an entity registered with the Data Protection Board that provides an accessible, transparent and interoperable platform through which individuals can give, manage, review and withdraw their consent.
The First Schedule prescribes eligibility requirements, including incorporation in India as a company, minimum net worth of ₹2 crore, adequate technical and operational capacity and appropriate governance arrangements.
Importantly, this is not a registration requirement for every business processing personal data. It concerns entities seeking registration to operate as Consent Managers.
Phase III: 13 May 2027 – Core compliance obligations
This is the most significant phase for businesses.
The remaining substantive provisions of the Act and Rules will commence, bringing the principal operational compliance framework into effect.
2. Which obligations will become applicable in May 2027?
The eighteen-month implementation phase covers several important obligations.
| Rule | Compliance area |
|---|---|
| Rule 3 | Notice to Data Principals |
| Rule 5 | Processing by the State for specified benefits and services |
| Rule 6 | Reasonable security safeguards |
| Rule 7 | Personal data breach notifications |
| Rule 8 | Data retention and erasure |
| Rule 9 | Contact information for privacy-related queries |
| Rules 10–11 | Verifiable consent concerning children and persons with disabilities |
| Rule 12 | Specified exemptions concerning children’s data |
| Rule 13 | Additional obligations of Significant Data Fiduciaries |
| Rule 14 | Rights of Data Principals |
| Rule 15 | Transfer of personal data outside India |
| Rule 16 | Exemptions for specified purposes |
Rules 22 and 23 also commence during this phase.
On the Act side, Sections 3–17 and the other provisions specified in G.S.R. 843(E) will become operational, subject to the exceptions expressly provided in that notification.
These provisions address the central responsibilities of Data Fiduciaries, including lawful processing, consent, notice, security, breach reporting, children’s data and individual rights.
3. Who should prepare for DPDP compliance?
The DPDP framework is relevant to organisations processing digital personal data, subject to its territorial scope and statutory exclusions.
Different businesses should prioritise different aspects of preparation.
Startups and MSMEs: Identify the personal data collected from customers, employees and website visitors. Review why the data is collected and how long it is retained.
E-commerce and technology companies: Examine customer consent, marketing practices, privacy notices, third-party integrations and data-sharing arrangements.
Hospitals and healthcare businesses: Review patient information management, access controls, retention policies and data-sharing arrangements.
HR and recruitment companies: Assess how employee, applicant and candidate information is collected, stored and shared.
Fintech and financial institutions: Review customer data processing, vendor contracts, security measures and internal accountability.
Potential Consent Managers: Assess the eligibility requirements under Rule 4 and prepare for the registration framework.
Significant Data Fiduciaries: Prepare for additional requirements, including Data Protection Impact Assessments, independent audits and other obligations under Rule 13.
4. Should businesses wait until May 2027?
Absolutely not.
Although the principal operational obligations are deferred, organisations should use this transition period to identify compliance gaps and establish appropriate systems.
A practical preparation exercise should include:
- Mapping all personal data collected and processed by the organisation.
- Identifying the purpose and legal basis for processing.
- Reviewing existing privacy policies and consent mechanisms.
- Examining agreements with vendors and data processors.
- Establishing data breach detection and response procedures.
- Reviewing data retention and deletion practices.
- Identifying procedures for handling individual requests and grievances.
Early preparation will also help organisations avoid hurried and potentially expensive compliance exercises closer to the commencement date.
5. The bigger picture: Compliance is a business responsibility
The DPDP Act should not be viewed merely as another regulatory requirement to be handled by the legal department.
Its implementation affects technology, human resources, marketing, customer relations, information security and business operations.
The phased commencement gives organisations an opportunity to understand their responsibilities and prepare systematically.
The key takeaway is simple: notification and commencement are two different legal events. Businesses must understand which obligations are currently enforceable, which are approaching and which will become applicable in May 2027.
India’s data protection framework is moving towards full implementation. Organisations that begin preparing today will be better equipped to protect personal data, build customer confidence and reduce regulatory risks tomorrow.
