Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

Guides

Your rights over your personal data

The DPDP framework gives you rights over your digital personal data and puts duties on the organisations that process it. This page names the rights, quotes their official headings and gives the commencement group and computed start date for each.

What rights do you have over your personal data under the DPDP Act?

Plain English

Chapter III of the Act, headed Rights and Duties of Data Principal, gives a Data Principal, meaning the individual the data is about, 4 rights, in sections 11 to 14: Right to access information about personal data (section 11), Right to correction and erasure of personal data (section 12), Right of grievance redressal (section 13) and Right to nominate (section 14). Where that individual is a child or a person with a disability, the definition of Data Principal also takes in the parents or lawful guardian acting for her. Section 6(4) adds a right that sits outside that chapter: where consent is the basis for processing, you may withdraw it at any time, with ease comparable to the ease with which you gave it. Section 15 sets out 5 duties that run the other way, on you, and entry 5 of the Schedule sets the penalty for breaching them at an amount that may extend to 10,000 rupees, which the Data Protection Board may impose under section 33(1) if, on concluding an inquiry, it determines that the breach is significant. All 4, and the section 6(4) right with them, sit in one commencement group that the notification sets at 18 months from publication of its Gazette, computed as 13 May 2027. Until then they stand on the statute book rather than as rights you can put to an organisation, and the power of the Board to act on a complaint by a Data Principal, in section 27(1)(b), sits in this same group. So do the section 15 duties and the section 33 penalty power through which the Schedule applies, so that penalty is not in force yet either.

The rights, and when each starts

Section 11. Right to access information about personal data
Not yet in force
Section 12. Right to correction and erasure of personal data
Not yet in force
Section 13. Right of grievance redressal
Not yet in force
Section 14. Right to nominate
Not yet in force

Commencement basis: Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 other than section 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2) of the Act on 13 May 2027 · computed date, presented as interpretation until officially confirmed (Publication date 13 November 2025 printed on Gazette issue No. 757, plus eighteen months. The notification states a period rather than a calendar date and does not state how the period is counted. The eGazette record of this same issue carries a code embedding 14112025, which would move the computed date by 1 day. Taken with the unstated counting, the 2 uncertainties together could move it by up to 2 days, to 15 May 2027 at the latest; the printed masthead date is used, and the interpretation label carries both uncertainties. CORRECTED 2026-08-25: this note previously also cited the Government's own PIB release for 14 November 2025. That release is about the DPDP Rules, 2025, G.S.R. 846(E) in Gazette issue No. 760, and says nothing about this Act commencement notification, G.S.R. 843(E) in issue No. 757. The missing space in the phrase "section 6,sections 7 to 10" appears as printed in the Gazette text layer. A MeitY press release of 16 May 2026 (PRID 2261823) reports the Secretary, MeitY, as noting that the Act becomes fully enforceable from 13 May 2027; it is reported speech in a press release and not an instrument, so it corroborates this computation and does not confirm it, and the date basis stays derived.).

What you can do now

The Individual Rights Assistant walks you through your situation step by step: seeing what an organisation you previously gave consent to holds about you, fixing or erasing it, complaining in the right order, nominating someone you trust, and finding who must answer your questions. Every pathway carries its official sources. Data Principal rights under the DPDP Act covers the same ground at article length, with what each right reaches and what switches it off, and the grievance route and its 90 day question sets out the order in which complaints have to travel.

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11, p. 9. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedSection 11 begins on Gazette page 9 and concludes on page 10.
  2. [2]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own termsNotification G.S.R. 843(E) names this section in the group that comes into force eighteen months from the date of publication of the notification gazette. The computed calendar date, 13 May 2027, is interpretation until officially confirmed.
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 12, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 13, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 14, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2, p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025Section 2 begins on Gazette page 2 and concludes on page 3.
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6, p. 5. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmedSection 6 begins on Gazette page 5 and concludes on page 6. The phrase "consent referred in sub-section (1)" appears as printed.
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 15, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedClause (a) is printed without the opening word to that clauses (b) to (e) carry; the wording is reproduced verbatim as printed.
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · Official requirement · Verified 16 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Breach in observance of the duties under section 15. ... May extend to ten thousand rupees.
    Entry 5 of the Schedule to the Act, Gazette page 21, quoted as its description cell and its penalty cell. The ellipsis stands for the intervening serial numbers and column text, because the text layer reads the table column by column; the row pairing was read against the printed order of entries 1 to 7 and penalties 1 to 7, and the India Code consolidated print at its page 24 sets the same row out in line.
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 16. Published 11 August 2023. Official source ↗ · Official requirement · Verified 16 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedSection 33(1) begins on Gazette page 16 and its sentence ends on page 17, where the rest of the hearing condition (from "person an opportunity of being heard") and the reference to the Schedule are printed. The quote joins the 2 pages across the marginal notes the text layer places between them.
  11. [11]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
  12. [12]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 17 August 2026Document status: published; in effect per its own termsThe calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.
  13. [13]
    “National Consultative Workshop on ‘Strengthening Cyber Security Frameworks for State Data’” (Press Information Bureau release, PRID 2261823) (Release ID 2261823), p. 1. Published 16 May 2026. Official source ↗ · An official record, not a legal requirement · Verified 18 October 2026Document status: published official press release of 16 May 2026 on a MeitY workshop of 11 May 2026; it reports the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027; a press release and not an instrument, it cites no provision and no publication dateA press release of 16 May 2026 reporting the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027: the only official statement this site has located, as at 18 October 2026, that names the date this group computes to. Not an instrument and not a confirmation; the period in paragraph (c) is what the notification states.