DPDP Act 2023 · Section 27
Powers and functions of Board
- Status
- Phased commencement
- Commencement
- 13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
- Source
- The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) · Gazette page 14
- Last verified
- 17 August 2026
What section 27 says, in plain English
Plain English
Phased commencement; it commences in 2 parts, on the computed date 13 November 2026, which is interpretation until officially confirmed, then the computed date 13 May 2027, which is interpretation until officially confirmed. No part of it has arrived, so the summary below is what the provision says, not what is in force today. Status last checked 28 September 2026 against the MeitY library and India Code.
On breach intimations, Data Principal complaints, government references or court directions, the Board inquires into personal data breaches and failures by Data Fiduciaries, Consent Managers or intermediaries, directs urgent remedial measures, and imposes penalties under the Act. It may issue binding directions after a hearing, and later modify, suspend, withdraw or cancel them.
How 13 May 2027 is computed, and why it could be 1 day later
Publication date 13 November 2025 printed on Gazette issue No. 757, plus eighteen months. The notification states a period rather than a calendar date and does not state how the period is counted. The eGazette record of this same issue carries a code embedding 14112025, which would move the computed date by 1 day; the printed masthead date is used, and the interpretation label carries that uncertainty. CORRECTED 2026-08-25: this note previously also cited the Government's own PIB release for 14 November 2025. That release is about the DPDP Rules, 2025, G.S.R. 846(E) in Gazette issue No. 760, and says nothing about this Act commencement notification, G.S.R. 843(E) in issue No. 757. The missing space in the phrase "section 6,sections 7 to 10" appears as printed in the Gazette text layer.
Official text of section 27
Section 27. Powers and functions of Board.(1) The Board shall exercise and perform the following powers and functions, namely:— (a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act; (b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act; (c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act; (d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and (e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act. (2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same. (3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.
Commencement basis · Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 other than section 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2) of the Act
“(c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.”
From commencement notification G.S.R. 843(E), Gazette issue No. 757, printed date 13 November 2025.
Sources cited on this page
- [1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 27, p. 14. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Phased commencement; it commences in 2 parts, on the computed date 13 November 2026, which is interpretation until officially confirmed, then the computed date 13 May 2027, which is interpretation until officially confirmed
- [2]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own termsCommencement of this section is split by notification G.S.R. 843(E): section 27 except clause (d) of sub-section (1) is in the group due eighteen months from publication (computed 13 May 2027, interpretation until confirmed), while section 27(1)(d) is in the one year group under paragraph (b) (computed 13 November 2026, interpretation until confirmed).
- [3]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own terms
eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
- [4]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 17 August 2026Document status: published; in effect per its own termsThe calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.