DPDP Act Commencement Timeline: India, 2026–2027
See which DPDP Act provisions took effect in November 2025, which start in November 2026, and what begins in May 2027. Use the dates to plan review.
Product & Engineering · October 25, 2026 · 5 min read
The Digital Personal Data Protection Act, 2023 does not take effect all at once. The commencement notification sets three start dates: provisions effective on 13 November 2025, a small group effective one year later on 13 November 2026, and the remaining provisions effective 18 months later on 13 May 2027. Use the dates in the notification,not the Act’s 2023 enactment date,to plan your roadmap. 1
This is general information, not legal advice.
The three commencement dates
The Central Government’s notification, dated 13 November 2025, assigns provisions of the Act to three commencement buckets. The periods run from the notification date. 1
| Effective date | What the notification says | Roadmap significance |
|---|---|---|
| 13 November 2025 | Sections 2, 18–26, 35–43, and 44(1) and 44(3) | These listed provisions have commenced. They include institutional and other provisions; do not treat this date as the start of every operational duty. |
| 13 November 2026 | Section 6(9) and section 27(1)(d) | These specific provisions commence one year after publication. |
| 13 May 2027 | All remaining provisions of the Act | The remaining provisions, including the operational provisions not listed in the earlier buckets, commence 18 months after publication. |
The dates above follow the notification’s language: publication was on 13 November 2025, so one year later is 13 November 2026 and 18 months later is 13 May 2027. 1 The Act PDF is useful for checking what a cited section covers; the commencement notification determines when it starts. 2
Do not confuse the Act timeline with the Rules timeline
The Digital Personal Data Protection Rules, 2025 have their own commencement schedule. The Rules notification assigns some rules to commence on publication, one rule to commence after one year, and the remaining listed rules after 18 months. Those dates are also calculated from 13 November 2025, but the Rules and Act are separate instruments with separate provision lists. 3
For a compliance tracker, record both the Act section and any related Rule, with each instrument’s commencement date. Do not assume that a Rule’s start date can be read directly from the Act notification,or that a single date applies to every requirement in a topic area.
Build a dated roadmap
Use this procedure to turn the notifications into an internal plan:
- Start with the official commencement notices. Record the publication date and the provision lists for the Act and Rules separately. 1
- Map relevant provisions to your activities. Ask counsel or your privacy lead which provisions are relevant to your organization and data practices. Use the Act text to verify section references. 2
- Mark status, not just dates. As of 25 October 2026, the 13 November 2025 bucket is already in effect. The one-year bucket is scheduled to start on 13 November 2026; the 18-month bucket is scheduled for 13 May 2027. 1
- Assign owners and review points. Set an owner for each applicable item, document dependencies, and schedule a review before its commencement date. Recheck the official notifications for any later changes.
Example: A team reviewing its roadmap on 25 October 2026 should not label the whole Act “in force” or “not yet in force.” It should mark the first bucket as commenced, the second as due on 13 November 2026, and the third as due on 13 May 2027, then confirm the relevant provisions and Rules for its work. 1
Practical roadmap checklist
| Check | Record |
|---|---|
| Instrument | Act, Rules, or both |
| Provision | Exact section or Rule number |
| Start date | 13 November 2025, 13 November 2026, or 13 May 2027, as applicable |
| Applicability | Why the provision may relate to your organization; confirm internally or with counsel |
| Owner and action | Named owner, planned work, and review date |
| Evidence | Official notification and source text used for the entry |
Keep the record provision-level. A broad label such as “DPDP starts in 2027” hides the earlier commencement buckets and can misstate the status of provisions that already took effect.
Where RepMail fits
RepMail by LetsZero is an outreach platform, not a legal interpretation service. If your team uses it, treat the commencement timeline as one input to your own review of outreach data and processes; do not infer that using a tool establishes compliance. Separate questions about cross-border routing from the question of when a provision commences: see adequacy versus safeguards in cross-border routing. For request-handling workflow context, see data deletion and subject requests. Teams distinguishing organizational addresses from personal addresses may also find B2B corporate subscribers versus individual addresses useful. These resources do not replace advice on how the Act applies to your circumstances.
Common mistakes
- Using the Act’s 2023 enactment date as its general commencement date.
- Treating 13 November 2025 as the start date for every Act provision.
- Applying the Act’s commencement list to the Rules, or vice versa.
- Recording only a year or broad topic instead of the exact provision and date.
- Treating a scheduled future commencement date as proof that every related operational step has the same deadline.
FAQs
When did the DPDP Act commence?
The Act has staggered commencement. The first listed provisions commenced on 13 November 2025; other provisions are scheduled for 13 November 2026 and 13 May 2027. 1
When do the remaining provisions commence?
The notification says provisions not included in the earlier commencement buckets commence 18 months after publication: 13 May 2027. 1
Do the DPDP Rules have the same schedule?
The Rules have their own provision-level schedule in a separate notification. Check that notice rather than assuming the Act’s list applies to the Rules. 3
Does a commencement date determine whether a provision applies to my organization?
No. The date tells you when a provision commences; assessing its application to your organization requires reviewing the provision and your circumstances. Seek qualified legal advice where needed.
Sources
Resources in this guide
| Instrument | Exact provision | Start date | Applicability review | Owner and action | Evidence |
|---|---|---|---|---|---|
| Act or Rules | Section or Rule number | 13 November 2025, 13 November 2026, or 13 May 2027 | Record why it may relate to your organization; confirm internally or with counsel | Named owner, planned work, review date | Official notification and source text |
Common mistakes to avoid
- Using the 2023 enactment date as the Act’s general commencement date.
- Assuming all provisions began in November 2025.
- Applying the Act’s schedule to the Rules without checking their separate notification.
- Tracking broad topics without recording exact provisions and commencement dates.
Frequently asked questions
When did the DPDP Act commence?
It has staggered commencement: the first listed provisions commenced on 13 November 2025, with other provisions scheduled for 13 November 2026 and 13 May 2027.
When do the remaining provisions commence?
The commencement notification places provisions outside the earlier buckets 18 months after publication, on 13 May 2027.
Do the DPDP Rules have the same schedule?
The Rules have a separate provision-level commencement schedule in their own notification. Check it independently.
Does a commencement date determine whether a provision applies to my organization?
No. The date identifies when a provision commences; determining its application requires reviewing the provision and your circumstances.
Continue learning
Review cross-border routing considerations
Separate commencement timing from questions about adequacy and safeguards in cross-border routing.