The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed. What is in force today
Sources last verified on 7 October 2026. Methodology
Archive
56 articles on the DPDP Act 2023 and the DPDP Rules 2025, newest first. Every legal claim cites the official source it rests on.
Children
The child definition is in force and the section 9 duties are not: they commence on a computed 13 May 2027, interpretation until officially confirmed. What section 9 requires, the tracking and targeted advertising ban, Rule 10 verification and the Fourth Schedule exemptions.
Compliance
The DPDP duties on a business in 6 groups, none of them in force yet: the 2 grounds, notice, consent, section 8, rights, children, SDF and transfers. Every one is cited to the Gazette.
Consent
A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for consent, not software. Computed commencement for registration under Rule 4 is 13 November 2026, interpretation until officially confirmed. The section 2(g) definition, the section 6 consent channel, and the First Schedule's Part A conditions and Part B obligations, quoted and cited.
Vendors
The DPDP Act prescribes little about a DPA, and none of that little is in force: a contract, Rule 6(1)(f) safeguards, erasure, from a computed 13 May 2027. Every other clause is drafting the statute never asks for, and that date is interpretation until officially confirmed.
Compliance
Only notified Significant Data Fiduciaries need a DPDP audit, and the duty has not started: section 10(2)(b) and Rule 13 commence on a computed 13 May 2027. That date is interpretation until officially confirmed. The independent auditor, the 12 month cycle, and the significant observations report.
Notice
The section 5(3) language option is not in force yet: it commences on a computed 13 May 2027, interpretation until officially confirmed. Section 5(3) gives the Data Principal the option of English or any Eighth Schedule language. A readiness duty, not 22 published versions, and no 250 crore penalty.
Compliance
Section 10 adds an India based DPO, an independent auditor and a 12 month Rule 13 DPIA and audit cycle once notified: all 3 commence on a computed 13 May 2027. That date is interpretation until officially confirmed. The DPO answers to the board of directors, and Rule 13 adds algorithmic due diligence and conditional localisation.
Compliance
Only a notified Significant Data Fiduciary will owe a DPIA, and section 10 and Rule 13 both commence on a computed 13 May 2027. That date is interpretation until officially confirmed. What section 10(2)(c)(i) defines, the 12 month Rule 13 cycle, and the GDPR habits that do not carry.
Compliance
Section 7(i), not in force yet, lets employers process employee personal data for the purposes of employment without consent; the ground is purpose based. Computed commencement for section 7 is 13 May 2027, interpretation until officially confirmed, so this is a planning window: it is not a blanket for everything HR touches, and the general obligations still apply.
