The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed. What is in force today
Sources last verified on 9 October 2026. Methodology
Tag
12 articles on this site carry this tag. Open any of them for the source documents behind their legal claims, with a claim type label on every source.
Applicability
Artificial intelligence, machine learning and profiling appear 0 times in the DPDP Act and Rules. Section 3 commences on a computed 13 May 2027, interpretation until confirmed.
Penalties
On the Gazette prints on file, read as at 6 September 2026. Entry 32 of the Jan Vishwas Act 2023 Schedule amended 11 provisions of the Information Technology Act, 2000 through 11 lettered limbs, multiplied all 3 section 44 penalties by 10, replaced imprisonment with a penalty in 5 provisions, and did not touch section 43A.
Current status
On the Gazette prints on file, read as at 6 September 2026, the Information Technology SPDI Rules 2011 still bind a body corporate. Rule 3 is where sensitive personal data is defined in Indian law, and section 44(2) of the DPDP Act, which directs the omission of section 43A, has not commenced.
Rights
The DPDP Act 2023 gives a Data Principal no right to sue and no compensation. Section 39 bars civil courts from matters the Board is empowered over. On the India Code print dated 27 June 2025 the older section 43A route was intact, and it is an adjudication rather than a lawsuit.
Current status
MeitY was reported in January 2026 to have proposed cutting the DPDP compliance window from 18 months to 12. No amending instrument has been located. Here is the whole record.
Consent
The word cookie appears 0 times in the DPDP Act 2023 and 0 times in the DPDP Rules 2025. So do explicit, granular and banner. What actually governs a cookie is the personal data inside it.
Consent
Marketing to Indian customers sits under 2 separate regimes. The TRAI regulations are in force now and cover voice calls and messages. The DPDP consent rules are not in force until 2027.
Enforcement
The Data Protection Board of India exists in law and has no appointed members. Even fully staffed it could not take a complaint, because section 27 is not in force. Those are 2 different gaps.
Consent
The DPDP Act 2023 contains no deemed consent and no legitimate interest ground: what replaced them is section 7, not in force until a computed 13 May 2027. That date is interpretation until officially confirmed. Both phrases come from the 2022 consultation draft Bill, which was never introduced in Parliament, and section 7 is headed Certain legitimate uses, with 9 clauses.
Applicability
Section 3 carries no turnover, headcount or user threshold, so a 2 person company is inside the Act once section 3 commences on a computed 13 May 2027. That date is interpretation until officially confirmed. Size still decides which duties bite, in 3 named places, and section 17(3) names startups without exempting a single one.
Transfers
Transfers out of India are permitted by default under Rule 15, which is not in force yet. But Rule 13(4) does impose localisation, once it commences, on Significant Data Fiduciaries for data the Central Government specifies, including the traffic data pertaining to its flow.
Retention
The DPDP framework sets no retention period. It sets a purpose test, 1 deemed timer for 3 named classes, and 2 rules that make you keep data for a year.
Each page carries the official text of the provision, its commencement status and the sources behind it.
Free, no login, and each one shows the provisions its answers rest on.
