The Act and Rules do not take effect on a single date. Treat this as the initial regulatory timeline, subject to verification against official Gazette notifications and any later amendments.
| Date | Stage | What takes effect |
|---|---|---|
| 13 November 2025 | Initial commencement | Provisions that set up the Data Protection Board of India and the framework (short title, definitions, commencement, the Board's constitution and procedures). |
| 13 November 2026 | Consent Manager provisions | Provisions on registration and obligations of Consent Managers. |
| 13 May 2027 | Substantive duties | Notice, consent, security safeguards, breach reporting, retention and erasure, children's data, Data Principal rights, and related Data Fiduciary duties. |
What this means in practice
- Most businesses' operational duties start on the third date - but building notices, consent records, inventories and breach processes takes months.
- The Board-related provisions are already in force; expect the regulator's processes to mature before duties begin.
- A Consent Manager is a different thing from a compliance platform - see the glossary.
Frequently asked questions
Do I have until 2027 to start?+
Duties begin in stages, with most on 13 May 2027, but readiness work (data inventory, notices, consent capture, vendor contracts, breach plan) needs lead time.
Is the date the same for everyone?+
Commencement is by provision, not by company. Some classes may have relaxations by notification.
Relevant provisions
- Section 5Rule 3 · pending verificationPrivacy notice at or before collection
- Section 6(1)-(3)Valid consent for processing
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 8(6)Rule 7 · pending verificationPersonal data breach intimation
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.