DPDP Act 2023 and Rules 2025: what is in force in August 2026?

India has a data protection law, but not all of it operates yet. Here is the position as of 17 August 2026, with every date traced to its official source.

The Act exists and the Rules are notified

The Digital Personal Data Protection Act, 2023 became Act No. 22 of 2023 on 11 August 2023. The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) on 13 November 2025 in Gazette of India Extraordinary issue No. 760, and a corrigenda notification, G.S.R. 892(E), corrected eight points of the text in December 2025.

What operates today

Rule 1 of the Rules sets three commencement groups.

"Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette."

That means the short title, the definitions and the provisions about the Data Protection Board have operated since 13 November 2025. On the same day, the Government established the Data Protection Board of India under notification G.S.R. 844(E), with its head office in the National Capital Region, and fixed it at four members under G.S.R. 845(E).

What comes next

The other two groups follow with lead time. Rule 4, which covers Consent Manager registration, comes into force one year after publication. The main operational rules, Rules 3, 5 to 16, 22 and 23, come into force eighteen months after publication. Those cover the notice requirements, security safeguards, breach intimation, retention and erasure, children's data and the machinery for exercising rights.

Computed from the publication date, that puts Rule 4 at 13 November 2026 and the main group at 13 May 2027. Treat both computed dates as interpretation until an official confirmation exists: the official text states the periods, not the calendar dates.

The Act's own sections

Section 1(2) of the Act provides that it comes into force on such date as the Central Government notifies, and that different dates may be appointed for different provisions. That notification exists: G.S.R. 843(E), published in Gazette of India Extraordinary issue No. 757 with the printed date 13 November 2025, appoints three groups.

From the date of publication, section 1(2), section 2 (the definitions), sections 18 to 26 (the Data Protection Board), sections 35 and 38 to 43, and section 44(1) and (3) operate. One year from publication, section 6(9) and section 27(1)(d), which concern Consent Managers, follow. Eighteen months from publication, the core of the framework arrives: sections 3 to 5, most of section 6, sections 7 to 17 (the grounds for processing, the obligations of Data Fiduciaries and the rights of Data Principals), the rest of section 27, sections 28 to 34, 36 and 37, and section 44(2).

Computed from the printed publication date, the one year group lands on 13 November 2026 and the eighteen month group on 13 May 2027, matching the Rules dates above. Treat the computed calendar dates as interpretation until officially confirmed: the official text states the periods, not the dates.

What to do

If you are working towards the May 2027 group, the practical reading is that you have a defined runway. Check whether the framework applies to you, then build one company plan against the obligations rather than reacting rule by rule.