DPDP Act enforcement date: is it in force, and when?

Is the DPDP Act in force?

The DPDP Act was passed in 2023, but it is being switched on in phases rather than all at once. Its operational Rules were notified on 14 November 2025, and obligations take practical effect across 2026, with full enforcement — including penalties — expected around May 2027. So the Act is “in force” in the sense that the law exists and the clock is running, but the penalty regime lands in 2027.

The DPDP enforcement timeline

• 2023 — the Digital Personal Data Protection Act is passed by Parliament.
• 14 November 2025 — the DPDP Rules 2025 are notified, starting the compliance clock.
• Mid-2026 — Consent Manager operationalisation and the core consent, notice and security obligations take practical effect.
• Late 2026 — the transitional period ends; the Data Protection Board of India shifts from guidance to active supervision.
• Early 2027 — Significant Data Fiduciaries must complete independent audits and Data Protection Impact Assessments.
• Around May 2027 — full enforcement, with the Board's monetary-penalty powers fully in effect.

Why the phased approach

India deliberately built in a transition window so organisations could stand up consent, security, retention and breach processes before penalties apply. It's a runway, not a reprieve — the expectations are fixed; only the enforcement date is staged.

What to do before each milestone

• Now → mid-2026: map your data, fix consent and notices, implement security safeguards, and build a breach runbook.
• Through 2026: integrate Consent Manager mechanisms and operationalise retention and erasure.
• Into early 2027: if you're a Significant Data Fiduciary, complete your DPIAs and independent audits.
• By May 2027: be fully compliant and able to evidence it. Use the DPDP compliance checklist.

Don't wait for the deadline

Compliance programmes take months, not weeks — data mapping and consent redesign especially. The organisations that start now will be ready and calm in 2027; those that wait will be paying consultants a premium to scramble, with penalties already live.

How AramGRC helps

AramGRC helps you sequence your DPDP programme against these milestones, so you're ready before each deadline rather than after it.