DPDP Act timeline: when each part applies

Why there are phases at all

The Act sets out duties, rights and penalties. The Rules fill in the practical detail: how breach intimation works, what security safeguards look like, how Consent Managers are registered, and when each part takes effect.

The government chose a staggered start so that the Data Protection Board could be set up first, Consent Managers could register next, and organisations would have time to change their systems before the main duties apply.

Phase 1: on notification, 13 November 2025

The definitions and the provisions that set up the Data Protection Board came into force when the Rules were notified. This is the machinery of the law. It does not yet put the main compliance duties on most businesses.

The Board is the body that will hear complaints, look into breaches and impose penalties. The provisions setting it up have applied since 13 November 2025. The duties it enforces arrive on the dates in the Rules.

Phase 2: around 13 November 2026

One year after notification, the provisions on Consent Managers apply: registration with the Board and their obligations under Rule 4 and the First Schedule. A Consent Manager must be a company incorporated in India with a net worth of at least 2 crore rupees.

For most businesses this phase matters only if you plan to accept consent through a Consent Manager, or to become one.

Phase 3: around 13 May 2027

Eighteen months after notification, as notified, most duties of Data Fiduciaries apply. This is the phase that touches almost every organisation that handles personal data in India.

• Notices to Data Principals and consent that meets the Act
• Reasonable security safeguards, including the measures in Rule 6
• Breach intimation to affected people and to the Board
• Erasure when the purpose is served, and the retention rules for certain large platforms
• Verifiable parental consent and the other duties for children's data
• The additional duties of Significant Data Fiduciaries
• Handling requests from Data Principals and grievances

What could still change

In January 2026, MeitY consulted on shortening the 18 month period to 12 months. If that were adopted, Phase 3 would move earlier, to around November 2026. The dates given follow the Rules as notified on 13 November 2025; check for later amendments.

The exact day a phase starts depends on how the period is counted from the date of publication in the Gazette. Derived dates are therefore approximate, and your legal adviser should confirm the precise date for your filings and contracts.

How to use the time you have

The longest work is usually operational: finding where personal data sits, which systems copy it, which vendors receive it and who can switch a process off when consent is withdrawn. An NBFC with a loan app, a call centre partner and three credit bureaus will spend months on that mapping alone.

A sensible order is: build the data inventory, fix notices and consent, set up the request and grievance process, then rehearse breach response and erasure. TrustOS helps you run that list as assigned, tracked work with evidence. It does not replace legal advice on what your obligations are.