Timelines and getting ready

Three commencement dates

G.S.R. 843(E) brought the Act into force in stages. From 13 November 2025: the definitions, the Board provisions (sections 18 to 26), sections 35 and 38 to 43, and sub-sections (1) and (3) of section 44. One year later, in November 2026: Consent Manager registration (section 6(9)) and the Board's power over registration breaches (section 27(1)(d)).

Eighteen months after, around May 2027: everything else. That includes notice, consent, legitimate uses, Fiduciary duties, children, SDFs, rights and duties of people, and cross-border transfers. It also includes exemptions, most Board powers, penalties and appeals, and the omission of IT Act section 43A.

Sources: G.S.R. 843(E)

The Rules follow the same pattern

Rule 1 matches this. Rules 1, 2 and 17 to 21, on the Board, applied from publication, and Rule 4, on Consent Managers, applies one year after. Rules 3, 5 to 16, 22 and 23 apply eighteen months after. A December 2025 corrigendum, G.S.R. 892(E), corrected only wording and typing errors.

Sources: Rules r.1G.S.R. 892(E)

Latest status (28 Sep 2026)

No amendment to the Act or the Rules was located in the Gazette or on MeitY's site; the only later instrument found is the G.S.R. 892(E) corrigendum. MeitY reportedly consulted in January 2026 on cutting 18 months to 12. No notification doing so was located, so the May 2027 date stands.

The Board exists in law, but on 6 May 2026 MeitY was still inviting applications for its Chairperson and four Members. No appointment was confirmed from a primary source by 28 September 2026. Its powers to hear complaints and impose penalties start around May 2027.

No Consent Manager can be registered before Rule 4 starts in November 2026, and no Board registration process was located. No Significant Data Fiduciary, section 16 country restriction, Rule 15 order, startup exemption or official MeitY FAQ was located either. Treat each as not yet issued, and recheck.

Sources: G.S.R. 892(E)MeitY circular 6 May 2026

Sector clocks run alongside DPDP

Sector rules already apply and will keep applying. CERT-In's 2022 Directions require listed cyber incidents, including data breaches and leaks, to be reported within 6 hours of noticing them. RBI's July 2026 Directions require banks and other covered entities to report cyber incidents on its DAKSH portal within 6 hours of detection.

SEBI's CSCRF requires a 6-hour notice to SEBI and CERT-In for serious incidents, with portal details within 24 hours. IRDAI asks insurers to report to CERT-In within 6 hours with a copy to IRDAI. The DPDP Board duty differs: without delay, then a detailed report within 72 hours, from around May 2027.

Sources: CERT-In Directions 2022RBI Cyber Directions 2026SEBI CSCRF 2024IRDAI Guidelines 2026Rules r.7

Getting ready: a sensible order

Most of this work takes months, so start early. Map where personal data sits and why, choose the lawful ground for each purpose, and draft Rule 3 notices and consent records. Set retention and erasure rules, and build breach, rights and grievance processes. Review Processor contracts, and check whether children's data or SDF duties apply.