14/09/2026
The Digital Personal Data Protection Act (DPDPA), 2023 is India's first comprehensive data protection law. It governs how organisations collect, process, store, and share the digital personal data of individuals ("Data Principals") in India, or relating to Indian residents even if processed abroad in connection with offering goods/services to them.
Core obligations on companies:
Obtain clear, specific, and informed consent before processing personal data (with narrow exceptions like legal compliance or employment purposes).
Provide a plain-language notice explaining what data is collected and why.
Implement reasonable security safeguards to prevent data breach
Notify the Data Protection Board of India (DPBI) and affected individuals in the event of a breach.
Honor Data Principals' (Citizens) rights — access, correction, erasure, and grievance redressal.
Extra obligations for SDFs: appoint an India-based Data Protection Officer, conduct independent data audits, and carry out Data Protection Impact Assessments (DPIAs).
Special protections for children's data (verifiable parental consent) and restrictions on tracking/targeted advertising to minors.
Mandatory Implementation Timeline
The Act was passed in 2023, but it only takes legal effect through phased notifications:
14 Nov 2025 — DPDP Rules, 2025 notified, starting an 18-month rollout.
13 Nov 2026 — Consent Manager registration begins; this is widely expected to end the current "soft compliance" phase.
13 May 2027 — Full enforceability of the Act — all obligations become binding, and penalties (up to ₹250 crore for certain violations) become enforceable by the DPBI.
This makes it a critical preparation window rather than an active-enforcement period:
The companies that build compliant data-mapping, consent architecture, and breach-response processes now will be ready when enforcement kicks in, rather than scrambling under regulatory pressure closer to 2027.
