Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 23 September 2026. Methodology

DPDP Act 2023 · The Schedule

The Schedule: monetary penalties

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) · Gazette page 21
Last verified
17 August 2026

What the Schedule says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. That status is a reading of notification G.S.R. 843(E), which does not name this Schedule at all. Status last checked 28 September 2026 against the MeitY library and India Code.

The Schedule caps penalties: 250 crore rupees for not taking reasonable security safeguards, 200 crore each for breach notification failures and children's provisions, 150 crore for Significant Data Fiduciary obligations, ten thousand rupees for Data Principal duties, 50 crore otherwise, and up to the underlying breach amount for breaching a voluntary undertaking.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 757, plus eighteen months. The notification states a period rather than a calendar date and does not state how the period is counted. The eGazette record of this same issue carries a code embedding 14112025, which would move the computed date by 1 day; the printed masthead date is used, and the interpretation label carries that uncertainty. CORRECTED 2026-08-25: this note previously also cited the Government's own PIB release for 14 November 2025. That release is about the DPDP Rules, 2025, G.S.R. 846(E) in Gazette issue No. 760, and says nothing about this Act commencement notification, G.S.R. 843(E) in issue No. 757. The missing space in the phrase "section 6,sections 7 to 10" appears as printed in the Gazette text layer.

Official text of the Schedule

Official requirement · verbatim

The Schedule.THE SCHEDULE [See section 33(1)] Sl. No. Breach of provisions of this Act or rules made thereunder Penalty (1) (2) (3) 1. Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. May extend to two hundred and fifty crore rupees. 2. Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. May extend to two hundred crore rupees. 3. Breach in observance of additional obligations in relation to children under section 9. May extend to two hundred crore rupees. 4. Breach in observance of additional obligations of Significant Data Fiduciary under section 10. May extend to one hundred and fifty crore rupees. 5. Breach in observance of the duties under section 15. May extend to ten thousand rupees. 6. Breach of any term of voluntary undertaking accepted by the Board under section 32. Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. 7. Breach of any other provision of this Act or the rules made thereunder. May extend to fifty crore rupees.

Commencement basis · Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 other than section 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2) of the Act

“(c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.”

From commencement notification G.S.R. 843(E), Gazette issue No. 757, printed date 13 November 2025.

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedThe Schedule is printed as a three column table (serial number, breach description, penalty). The Gazette text layer reads the table column by column, so the linear text here re pairs each description with its penalty by the printed serial numbers 1 to 7, and adds nothing: the column headings and the column numbers are reproduced as printed and no label is inserted before any amount. The pairing is corroborated independently by the India Code consolidated print at its page 24, which linearises the same table row by row. This note was rewritten on 2026-08-28 because it still described an earlier reconstruction that inserted the word Penalty before each amount and dropped the headings; that text was replaced on 2026-08-28 and the note had not followed it.
  2. [2]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 17 August 2026Document status: published; in effect per its own termsNotification G.S.R. 843(E) names sections only and does not name the Schedule. The Schedule operates through section 33(1), which is in the eighteen month group, so the Schedule is presented as commencing with section 33. That reading is interpretation.
  3. [3]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
  4. [4]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 17 August 2026Document status: published; in effect per its own termsThe calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.