The Act has been passed and the DPDP Rules, 2025 were notified in November 2025. The law is being switched on in phases:
- Immediately (November 2025): provisions on the Data Protection Board of India and definitions.
- 13 November 2026: Consent Manager provisions (Rule 4).
- 13 May 2027: the main obligations on organisations, such as notice, consent, security safeguards, breach reporting and data principal rights.
Organisations should use the time before May 2027 to prepare.