The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed. What is in force today
Sources last verified on 9 October 2026. Methodology
Archive
56 articles on the DPDP Act 2023 and the DPDP Rules 2025, newest first. Every legal claim cites the official source it rests on.
Rights
Rule 14(3), not in force yet, names 90 days in a sentence printed with no object for "publish", so what the 90 days caps is not stated on its face. This site reads it as the response period. Once section 13 commences, individuals get a right to readily available grievance redressal, and must exhaust it before approaching the Board.
Rights
The 4 Chapter III rights plus section 6(4) withdrawal, all computed to commence on 13 May 2027, interpretation until officially confirmed. What each one reaches, the consent gate on 2 of them, and the 3 section 17 exemptions, only 1 of which removes all 4.
Penalties
No penalty under the DPDP Act can be imposed yet: section 33, the route to the Schedule caps of up to 250 crore rupees, commences on a computed 13 May 2027. That date is interpretation until officially confirmed, as is this site's reading that no amount in the Schedule is reachable before section 33 commences. Section 33 sets who decides and on what factors, and the Schedule pairs each listed failure with a ceiling.
Vendors
Once section 8(2) and Rule 6 are in force, a Data Processor may be engaged only under a valid contract, and that contract must carry safeguard provisions. The 2 anchors, and what to add.
Retention
The DPDP framework sets no retention period. It sets a purpose test, 1 deemed timer for 3 named classes, and 2 rules that make you keep data for a year.
Security
Rule 6 names 7 security minimums and not 1 is in force yet: the Rule commences on a computed 13 May 2027, interpretation until officially confirmed. The 7: encryption or masking, access control, visibility through logs and monitoring, backups, logs and personal data retained 1 year unless another law requires otherwise, processor contract terms and organisational measures.
Penalties
Section 32 is not in force: the voluntary undertaking settlement track starts on a computed 13 May 2027, interpretation until officially confirmed. Once it commences the Data Protection Board may accept an undertaking that bars further proceedings on its contents, and breaking a term revives the section 33 penalty route.
Definitions
Usually yes in ordinary business records. The Act's definition turns on identifiability, and in real records names and email addresses identify people. What the definition says and what follows.
Compliance
No Significant Data Fiduciary duty is in force yet: section 10 commences on a computed 13 May 2027, interpretation until officially confirmed. SDF status will arrive by government notification against the section 10 factors, not by crossing a user count. The real numbers in the framework, the duties that follow, and the vendor thresholds that do not exist.
