The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed. What is in force today
Sources last verified on 28 October 2026. Methodology
Category
11 articles on this site are filed here. Open any of them for the source documents behind their legal claims, with a claim type label on every source.
Compliance
Certification appears 0 times in the DPDP Act and Rules. The 1 use of certified is First Schedule paragraph 9, a Consent Manager registration condition. Verified 18 October 2026.
Compliance
No DPDP DPO appointment duty is in force yet. Once section 10 commences, only a notified Significant Data Fiduciary must appoint one, subject to section 17.
Compliance
The DPDP duties on a business in 6 groups, none of them in force yet: the 2 grounds, notice, consent, section 8, rights, children, SDF and transfers. Every one is cited to the Gazette.
Compliance
Only notified Significant Data Fiduciaries need a DPDP audit, and the duty has not started: section 10(2)(b) and Rule 13 commence on a computed 13 May 2027. That date is interpretation until officially confirmed. The independent auditor, the 12 month cycle, and the significant observations report.
Compliance
Section 10 adds an India based DPO, an independent auditor and a 12 month Rule 13 DPIA and audit cycle once notified: all 3 commence on a computed 13 May 2027. That date is interpretation until officially confirmed. The DPO answers to the board of directors, and Rule 13 adds algorithmic due diligence and conditional localisation.
Compliance
Only a notified Significant Data Fiduciary will owe a DPIA, and section 10 and Rule 13 both commence on a computed 13 May 2027. That date is interpretation until officially confirmed. What section 10(2)(c)(i) defines, the 12 month Rule 13 cycle, and the GDPR habits that do not carry.
Compliance
Section 7(i) is not in force; computed 13 May 2027, interpretation until officially confirmed. It may later cover employment purpose processing without consent.
Compliance
There is no small business exemption in the DPDP Act's application section, so a small Indian business works the same 10 steps. Section 17(3), computed to commence 13 May 2027, interpretation until officially confirmed, lets the Central Government notify classes including startups as exempt from specified provisions only. Map your data, pick the ground for each purpose, fix your notice and consent, prepare for breaches and rights requests, each step cited to the exact provision.
Compliance
The DPDP obligations belong to your organisation and not to the CTO, and none of these rules is in force yet: all are computed to commence 13 May 2027. That date is interpretation until officially confirmed. Engineering usually leads the technical half: safeguards, retention timers, breach detection, consent withdrawal paths and rights machinery, with the cross functional dependencies made explicit.
Compliance
Startup DPDP checklist: test scope, map data, then prepare 5 control clusters before 13 May 2027, a computed date and interpretation until officially confirmed.
Compliance
Section 10 is not in force; under section 2(z), an SDF is a Data Fiduciary or class the Central Government may notify under section 10. Its 6 named factors have no fixed user, revenue or employee threshold.
Each page carries the official text of the provision, its commencement status and the sources behind it.
Free, no login, and each one shows the provisions its answers rest on.
