Institutional provisions are already in force, the Consent Manager framework is scheduled for 13 November 2026, and most operational duties are scheduled for 13 May 2027. Plan against the provision that governs each workstream.
Rules 1, 2 and 17–21 commenced on publication with the linked Act provisions for definitions, the Data Protection Board, rule-making and related institutional machinery.
Rules 1, 2, 17–21 · linked provisions of Act §§ 1, 2, 18–26, 35 and 38–44
Rule 4, section 6(9) and the connected Board function are scheduled one year after Gazette publication. This phase establishes registration and operating obligations for Consent Managers.
Rule 4 · Act § 6(9) · § 27(1)(d)
Most provisions on scope, notices, consent, Data Fiduciary obligations, rights, breaches, children, enforcement and penalties are scheduled eighteen months after Gazette publication.
Rules 3, 5–16 and 22–23 · most operative provisions of Act §§ 3–17 and 27–37
| Workstream | Planning date | Evidence to have ready |
|---|---|---|
| Data and purpose inventory | Before notice and consent design | System register, purpose map, processor list, retention rule and accountable owner. |
| Notices and consent | Operational by 13 May 2027 | Versioned notice, purpose IDs, affirmative-action log, withdrawal path and downstream propagation test. |
| Security and processor governance | Operational by 13 May 2027 | Safeguard standard, access controls, logging, backups, incident detection and appropriate processor contract terms. |
| Breach response | Operational by 13 May 2027 | Detection route, decision authority, Data Principal notice, Board intimation workflow and 72-hour information pack. |
| Rights and grievance handling | Operational by 13 May 2027 | Published channel, identity standard, system search list, response record, escalation and contact information. |
| Children and special cases | Operational by 13 May 2027 | Age and parental-consent method, tracking restrictions, exemption analysis and product-control tests. |
Use the readiness checklist to find unsupported controls, then use the template hub to build the inventory, notice, processor, breach and rights artefacts behind them.
Most operational provisions are scheduled to commence on 13 May 2027. The framework is phased, so some institutional provisions are already in force and the Consent Manager phase is scheduled earlier, on 13 November 2026.
No. The commencement notification phases the Act and Rules across 13 November 2025, 13 November 2026 and 13 May 2027 rather than commencing every provision together.
No. Inventories, product changes, processor negotiations, security controls, breach exercises and rights workflows require lead time and should be tested before their governing provisions commence.
Yes. Always check the Gazette and official MeitY publication page for later amendments, corrigenda or commencement notifications before relying on a deadline.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against the notified DPDP Rules, 2025 and commencement notifications. Educational information, not legal advice.