G.S.R. 843(E)
The notification that brings the Act into force in three stages, from 13 November 2025 to 13 May 2027.
MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY NOTIFICATION New Delhi, the 13th November, 2025
G.S.R. 843(E). — In exercise of the powers conferred by sub-section (2) of section 1 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby appoints—
the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2, sections 18 to 26 sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44 of the said Act shall come into force;
one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.
eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
[F. No. AA-11038/1/2025-CL&ES] AJIT KUMAR, Jt. Secy.
*The text above is reproduced from the Gazette copy published by the Ministry of Electronics and Information Technology, including its original punctuation. The official PDF is linked on this page.*
The Act did not come into force all at once. This notification brings it in over three stages, counted from its publication on 13 November 2025:
| Stage | Date | Provisions | What they cover |
|---|---|---|---|
| (a) On publication | 13 Nov 2025 | Section 1(2), Section 2, Sections 18–26, 35, 38–43, Section 44(1) and 44(3) | Definitions; setting up the Data Protection Board; protection for action in good faith; relationship with other laws; bar on civil courts; rule-making, amending the Schedule and removing difficulties; amendments to the TRAI Act and the RTI Act |
| (b) One year later | 13 Nov 2026 | Section 6(9), Section 27(1)(d) | Registration of Consent Managers with the Board; the Board's power to inquire into a breach of a registration condition |
| (c) Eighteen months later | 13 May 2027 | Sections 3–5, Section 6 (except 6(9)), Sections 7–17, Section 27 (except 27(1)(d)), Sections 28–34, 36, 37, Section 44(2) | Who the Act applies to, notice and consent, legitimate uses, every duty of a business, children's data, Significant Data Fiduciaries, the rights and duties of individuals, processing outside India, exemptions, the Board's inquiry powers, appeals, penalties, the Central Government's power to call for information and to direct blocking, and the amendment to the IT Act |
The dates in the second column are worked out from the publication date. The notification itself states the periods ("one year", "eighteen months") rather than the calendar dates. Dates stated as of October 2026.
The notification does not name the Schedule (the table of penalty amounts) separately. Penalties are imposed under Section 33, which comes into force at stage (c), on 13 May 2027.
The DPDP Rules 2025 (G.S.R. 846(E)) were published on the same date and follow the same timetable (Rule 1(2)–(4)):
| Rules | Subject | In force from |
|---|---|---|
| Rules 1, 2 and 17–21 | Commencement, definitions, the Board and its working | 13 Nov 2025 |
| Rule 4 | Registration and obligations of Consent Managers | 13 Nov 2026 |
| Rules 3, 5–16, 22 and 23 | Notice, security, breach intimation, erasure, children's data, Significant Data Fiduciaries, rights of individuals, and the rest | 13 May 2027 |
For a business, the working date is 13 May 2027. That is when its own duties under the Act and the matching Rules begin.
1. From 13 November 2025, the Data Protection Board could be set up. It was established by a separate notification issued the same day (G.S.R. 844(E)). 2. From 13 November 2026, companies can apply to the Board to be registered as Consent Managers. An ordinary business has no new duty on that date. 3. From 13 May 2027, the obligations of businesses, the rights of individuals and the penalty provisions apply. 4. Until 13 May 2027, Section 43A of the Information Technology Act, 2000 remains in force. Section 44(2) of the DPDP Act, which omits it, comes into force at stage (c).