Is the DPDP Act in force yet — and when does it actually apply to me?
Partly. The framework started phasing in on 13 November 2025, but the obligations you can be penalised for start on 13 May 2027.
Short answer
Yes — but only partly. Some of the DPDP Act is already on the statute book, and none of the obligations that apply to ordinary businesses are enforceable yet. Those switch on 13 May 2027.
The detail
Two different things get called "in force". A provision is in force when the government has commenced it — it legally exists and operates. A provision is enforceable against you when it creates a duty you can be penalised for failing. The DPDP Act separates the two by commencing in phases.
The Act (Act 22 of 2023) was assented on 11 August 2023 but commenced nothing at that point. The DPDP Rules 2025, notified on 13 November 2025, set the timetable: institutional plumbing first, Consent Manager registration a year later, and the substantive duties eighteen months after that.
The practical consequence: today no one can be fined under the Act, and the Data Protection Board is not taking complaints. The eighteen-month runway to 13 May 2027 is the build window — notice flows, consent records, breach procedures, and retention rules all need to be working on day one, not started then.
The three phases
Data Protection Board provisions, the definitions, and the government's rule-making powers came into force. The Board exists in law, but members are not yet appointed and it is not hearing complaints.
Sections 2, 18–26 · Rules 1, 2, 17–21
Consent Manager registration opens — the point at which Consent Managers can be registered with the Board.
Section 6(9), Section 27(1)(d) · Rule 4
The core obligations become enforceable: notice, consent, security and breach reporting, retention, children's data, Significant Data Fiduciary duties, Data Principal rights, cross-border transfers, exemptions — and the penalties that back them.
Sections 5, 6, 8, 9, 10, 11–14, 16, 17, 33 + the Schedule · Rules 3, 5–16, 22, 23
What the penalties actually are
The Schedule sets these ceilings, effective 13 May 2027. The highest figure in the Act is ₹250 crore — there is no ₹10,000 crore tier.
Full breakdown on the penalty schedule page.
What this means for you
You have until 13 May 2027 to have notice, consent records, breach response, and retention working — treat it as a build deadline, not a start date.
Client contracts signed now will still be running in 2027, so write DPDP processor terms into them today rather than renegotiating later.
Audience email lists and community sign-ups fall under the consent rules from 13 May 2027 — start capturing how and when people opted in.
Status
Read next
Primary sources
Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).
Status unverified — no status check recorded
G.S.R. 846(E), 13 November 2025 (Gazette ID CG-DL-E-14112025-267650) — sets the phased commencement dates.
Status unverified — no status check recorded
Citation
Kokate, S. (2026). Is the DPDP Act in force yet — and when does it actually apply to me? India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/is-dpdp-in-force. Educational content, not legal advice.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.