G.S.R. 843(E)
The notification that brought the Act into force on 13 November 2025, and what it started.
MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY NOTIFICATION New Delhi, the 13th November, 2025
G.S.R. 843(E). — In exercise of the powers conferred by sub-section (2) of section 1 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby appoints the 13th day of November, 2025 as the date on which the following provisions of the said Act shall come into force, namely:—
sections 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 and 17;
sections 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32 and 33;
sections 34, 35, 36, 37, 38, 39, 40, 41, 42, 43 and 44; and
the Schedule.
[F. No. 4(11)/2023-DPDP] S. KRISHNAN, Secretary to the Govt. of India
This notification brings all sections of the DPDP Act into force on 13 November 2025, including:
- Chapter I (Sections 1–3): Preliminary provisions, application of Act - Chapter II (Sections 4–10): Obligations of Data Fiduciaries - Chapter III (Sections 11–15): Rights and duties of Data Principals - Chapter IV (Sections 16–17): Special provisions, exemptions - Chapter V (Sections 18–26): Data Protection Board of India - Chapter VI (Sections 27–28): Powers, functions and procedure of Board - Chapter VII (Sections 29–32): Appeal and alternate dispute resolution - Chapter VIII (Section 33): Penalties and adjudication - Chapter IX (Sections 34–44): Miscellaneous - The Schedule: Penalty amounts
While the Act is in force from 13 November 2025, the compliance obligations on Data Fiduciaries become enforceable only as the corresponding Rules come into force:
| Obligation | Rules | Effective Date |
|---|---|---|
| Board establishment & governance | Rules 17–21 | 13 Nov 2025 (immediate) |
| Consent Manager registration | Rule 4 | 13 Nov 2026 (1 year) |
| Notice requirements | Rule 3 | 13 May 2027 (18 months) |
| Data Fiduciary compliance obligations | Rules 5–16, 22–23 | 13 May 2027 (18 months) |
Hard Compliance Deadline: 13 May 2027
This notification marks the official "go-live" of the DPDP framework in India:
1. The Data Protection Board of India (DPBI) is legally constituted from this date 2. Companies have 18 months (until May 2027) to implement full compliance 3. The penalty provisions of the Act (up to ₹250 crore) become applicable from May 2027 4. This is the reference date for all timeline calculations in the Rules