On this page
- When did the DPDP Act come into force?
- DPDP Act timeline: every date from 2023 to 2027
- Is the deadline May 2027 or November 2026?
- Who does the DPDP Act apply to?
- What should a small business, clinic, school or gym do before each date?
- What are the maximum penalties under the DPDP Act?
- How DVM Techno Can Help
- FAQs
Key takeaways
- The DPDP Act received assent on 11 August 2023, but nothing in it was in force until two Gazette notifications dated 13 November 2025.
- Most duties for businesses, and the penalty provisions, start eighteen months after 13 November 2025, which we count as 13 May 2027.
- The November 2026 date covers only Consent Managers; a shorter overall timeline has been discussed but, as of our check, not notified.
- The highest penalty in the Schedule is up to two hundred and fifty crore rupees, for failing to take reasonable security safeguards.
When did the DPDP Act come into force?
The Digital Personal Data Protection Act, 2023 received the President’s assent on 11 August 2023, but no part of it was in force until 13 November 2025. On that date MeitY notified the DPDP Rules, 2025 and a separate commencement order that switch the law on in three steps: the Data Protection Board at once, Consent Managers after one year, and almost all business duties after eighteen months.
Section 1(2) of the DPDP Act lets the Central Government bring different provisions into force on different dates. Two Gazette notifications dated 13 November 2025 use that power: G.S.R. 843(E) for the sections of the Act and G.S.R. 846(E) for the Rules. The PIB release of 14 November 2025 calls this an "18-month phased compliance timeline".
So does the DPDP Act apply today? The definitions and the Board provisions do. The consent, notice, security, breach and penalty sections that matter to a shop, clinic, school or gym start later.
DPDP Act timeline: every date from 2023 to 2027
Five dates matter, and only the last one brings the main duties and penalties. The notifications say "one year" and "eighteen months" from publication; the exact days below are our count from the Gazette date of 13 November 2025.
| Date | What starts | Who it affects |
|---|---|---|
| 11 August 2023 | Act receives the President’s assent and is published in the Gazette; no provision in force yet | No one directly |
| 3 January 2025 | Draft DPDP Rules published for public comment (G.S.R. 02(E)) | Businesses and citizens, as consultees |
| 13 November 2025 | Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3); Rules 1, 2 and 17 to 21: definitions, the Data Protection Board, rule-making powers and an amendment to the RTI Act | The Government, the Board, and public authorities answering RTI requests |
| 13 November 2026 (by our count) | Section 6(9), Section 27(1)(d) and Rule 4: registration and duties of Consent Managers | Companies that want to work as Consent Managers |
| 13 May 2027 (by our count) | Sections 3 to 17, 28 to 34, 36, 37 and 44(2); Rules 3, 5 to 16, 22 and 23: notice, consent, security, breach reporting, children’s data, rights and penalties | Every Data Fiduciary: businesses, clinics, schools, gyms, apps and websites |
Note the order. Section 33 and the penalty Schedule sit in the eighteen-month group. Section 44(2), which omits Section 43A of the Information Technology Act, 2000 (compensation for failing to protect sensitive personal data), also starts only then, so the older IT Act rules stay in place until the DPDP duties take over.
Is the deadline May 2027 or November 2026?
As notified, the main deadline is eighteen months from 13 November 2025, which we count as 13 May 2027. The November 2026 date applies only to Consent Managers.
Since late 2025 there have been media reports that the Government wants to shorten the eighteen-month window, possibly to twelve months, which would pull the main duties forward to November 2026. A PIB release of 5 August 2026 still describes "an eighteen-month transition period", and we did not find an amending notification on official sites when writing this in October 2026. Any change would need a new Gazette notification, so check the latest MeitY notification before you fix your own dates.
Plan as if the deadline could move earlier. Website, form and software changes take weeks, and none of the work is wasted if May 2027 holds.
Who does the DPDP Act apply to?
It applies to anyone who processes digital personal data in India, and to processing outside India connected with offering goods or services to people in India (Section 3). Data collected on paper and typed into a computer later is covered too.
- Covered: a clinic on Sohna Road with an appointment form, a school with an admission enquiry page, a gym with member software, a shop in Udyog Vihar keeping a WhatsApp order list, an app with sign-ups.
- Not covered: personal data used by an individual for personal or domestic purposes, and personal data that the person made public themselves or that someone is legally required to publish.
- No size exemption by default: the Act has no general exemption for small businesses. Section 17(3) lets the Government notify classes of Data Fiduciaries, including startups, that are exempt from some sections, so check the latest MeitY notification before assuming you are exempt.
- Extra duties for a few: only businesses the Government notifies as Significant Data Fiduciaries must appoint a Data Protection Officer, an independent data auditor and run impact assessments.
Your hosting company, CRM and WhatsApp provider are usually Data Processors. Under Section 8(1), the responsibility stays with you as the Data Fiduciary.
What should a small business, clinic, school or gym do before each date?
Use the time up to November 2026 to find your data, the months after it to fix forms and contracts, and treat May 2027 as the day everything must already work.
| Window | What to do | Done when |
|---|---|---|
| Now to 13 November 2026 | List every place you collect personal data: website forms, WhatsApp, billing software, CCTV, registers that get typed in. Note what each holds and why. | You have a one-page data map |
| November 2026 to early 2027 | Remove form fields you do not need; draft a plain notice in English and Hindi; add separate unticked consent boxes; decide how long to keep each type of data. | Forms and privacy page are drafted |
| Early 2027 to 13 May 2027 | Sign vendor contracts with security clauses; write a breach plan; publish a contact person and a way to ask for access, correction or erasure; train staff. | Live on the website and at the front desk |
| After 13 May 2027 | Keep consent records, answer requests within your published period of not more than 90 days, review old data on schedule. | A routine, not a project |
- Clinics: keep symptoms and reports out of open web forms and staff WhatsApp groups. Our DPDP checklist for clinic and school websites covers the form wording.
- Schools: anyone under 18 is a child, so admission and fee systems need verifiable parental consent. If you use school management software, ask how it records that consent.
- Gyms: offer a way in that does not need a fingerprint; our gym biometric attendance and DPDP Act guide compares the options.
- Shops and service businesses: a WhatsApp CRM or customer list used for offers needs consent for that purpose, separate from the order itself.
What are the maximum penalties under the DPDP Act?
The highest penalty in the Schedule to the Act is up to two hundred and fifty crore rupees, for failing to take reasonable security safeguards to prevent a personal data breach. The Data Protection Board imposes penalties after an inquiry under Section 33, which starts with the eighteen-month group.
| Breach | Maximum penalty (Schedule) |
|---|---|
| Failing to take reasonable security safeguards (Section 8(5)) | Up to two hundred and fifty crore rupees |
| Failing to tell the Board or affected people about a breach (Section 8(6)) | Up to two hundred crore rupees |
| Breaking the additional duties for children’s data (Section 9) | Up to two hundred crore rupees |
| Breaking the additional duties of a Significant Data Fiduciary (Section 10) | Up to one hundred and fifty crore rupees |
| Breaching a voluntary undertaking accepted by the Board (Section 32) | Up to the amount for the original breach |
| Any other breach of the Act or Rules | Up to fifty crore rupees |
| A Data Principal breaking their own duties (Section 15), such as filing a false complaint | Up to ten thousand rupees |
These are ceilings, not fixed fines. Section 33(2) asks the Board to weigh the nature, gravity and duration of the breach, the type of data, whether it was repeated, any gain made or loss avoided, the steps taken to limit harm, and the likely impact of the penalty on the business. Penalties go to the Consolidated Fund of India, not to the affected person.
How DVM Techno Can Help
DVM Techno is a web and software company with its team in Gurgaon. Before the deadline, we can update your website with a privacy notice page, short notices on each form, separate consent checkboxes, a published grievance contact and secure enquiry handling. See our website development services in Gurgaon or call +91-8448523313. We handle the website and software side; a lawyer should review the legal wording.
This is general information, not legal advice. Dates and duties can change by notification, so check the latest MeitY notification and ask a lawyer how the DPDP Act applies to your business.
Frequently Asked Questions
When did the DPDP Act come into force?
The DPDP Act received the President’s assent on 11 August 2023, but it came into force in parts. Definitions and the Data Protection Board provisions started on 13 November 2025 under Gazette notification G.S.R. 843(E). Consent Manager provisions follow one year later, and most duties for businesses, along with penalties, start eighteen months after 13 November 2025, which we count as 13 May 2027.
What is the DPDP Act compliance deadline?
As notified, most duties, including notice, consent, security safeguards, breach reporting, children’s data and the rights of individuals, start eighteen months after the Rules were published in the Gazette dated 13 November 2025. By our count that is 13 May 2027. There have been reports of a plan to shorten this window, so check the latest MeitY notification before relying on the date.
What happens in November 2026 under the DPDP Act?
One year after publication, which we count as 13 November 2026, Rule 4 and Section 6(9) start. They cover the registration and obligations of Consent Managers, companies that help people give, manage and withdraw consent through one platform. For most small businesses nothing changes on that date, unless the Government notifies a shorter overall timeline before then.
What is the maximum penalty under the DPDP Act?
The Schedule to the Act sets the highest penalty at up to two hundred and fifty crore rupees, for failing to take reasonable security safeguards to prevent a personal data breach. Failing to report a breach and breaking the duties for children’s data can each attract up to two hundred crore rupees. Other breaches can attract up to fifty crore rupees. The Board decides the actual amount.
Does the DPDP Act apply to small businesses?
Yes. The Act applies to anyone processing digital personal data in India and has no general exemption based on size. A clinic, school, gym or shop that collects names and phone numbers through a website, app or WhatsApp is a Data Fiduciary. The Government can notify exemptions from some sections for certain classes, including startups, so check the latest MeitY notification.
Can the Data Protection Board fine a business today?
The penalty provisions, Sections 28 to 34 and the Schedule, fall in the eighteen-month group of the commencement notification, so they are not in force until that date, which we count as 13 May 2027. The Board provisions themselves started on 13 November 2025. Other laws, such as the Information Technology Act, 2000, continue to apply in the meantime.
Where can I read the official DPDP Act and Rules?
MeitY publishes the Act, the DPDP Rules, 2025 (G.S.R. 846(E)) and the commencement notification (G.S.R. 843(E)) on meity.gov.in. The Act is also on indiacode.nic.in, and the Press Information Bureau release of 14 November 2025 summarises the Rules. Any change to these dates will appear as a new notification in the Gazette of India.
Related articles
Get your website ready before the deadline
We can add privacy notices, consent checkboxes and grievance contact details to your business website.