The Digital Personal Data Protection Act, 2023 (DPDP Act) is being phased in under Rules notified in November 2025, with a Consent Manager registration deadline around November 2026 and full enforcement, including penalties of up to Rs. 250 crore for a data breach, expected from around May 2027 -- giving organizations an extended runway to come into compliance.
Phased implementation timeline
The DPDP Act received Presidential assent in August 2023, but most of its operative provisions required
Rules and a phased commencement schedule to actually take effect. The Digital Personal Data Protection Rules,
2025 were notified in November 2025, setting out an implementation glide path -- with a Consent Manager
registration deadline around November 2026, and full enforcement, including the Act’s significant
financial penalties, expected to apply from around May 2027. Because these are the kind of specific dates that
move with each new notification, the current compliance calendar should be checked against the Ministry of
Electronics and Information Technology’s official notifications before relying on a specific date for a
filing or compliance deadline.
Core concepts -- Data Fiduciary, Data Principal, and consent
The Act uses “Data Fiduciary” for the entity that determines the purpose and means of
processing personal data, and “Data Principal” for the individual the data relates to. Consent
under Section 6 must be free, specific, informed, unconditional, and unambiguous, given through a clear
affirmative action, and withdrawing consent must be as easy as giving it. A “Consent Manager” is a
registered entity through which a Data Principal can give, review, and withdraw consent across multiple Data
Fiduciaries via a single interoperable platform.
The Data Protection Board, cross-border transfers, and children’s data
The Data Protection Board of India adjudicates complaints and breaches, with its orders appealable to the
Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Significant Data Fiduciaries -- notified based on
factors like the volume and sensitivity of data processed -- face enhanced obligations including an
India-based Data Protection Officer and periodic Data Protection Impact Assessments. Cross-border data
transfer is permitted by default except to countries specifically restricted by the Central Government -- a
“negative list” approach rather than the stricter data-localization mandates some earlier draft
versions of the law had proposed. Processing a child’s (under-18) personal data requires verifiable
parental consent, and targeted advertising directed at children is generally barred.
Is the DPDP Act already being enforced with penalties as of now?
The Act and its 2025 Rules are being rolled out on a phased timeline -- specific compliance milestones like
Consent Manager registration fall due before the Act’s full enforcement (including its significant
financial penalties) takes effect, so the exact current phase of enforcement should be checked against the
latest MeitY notification rather than assumed to already be in full force.
Does the DPDP Act require companies to store Indian users' data only in India?
Not as a blanket rule -- the Act takes a “negative list” approach to cross-border data transfer,
permitting transfers by default except to specific countries the Central Government restricts by notification,
rather than imposing broad data-localization requirements as some earlier proposed versions of the law would
have.
What extra obligations apply to a company handling a large volume of sensitive personal data?
If notified as a Significant Data Fiduciary based on factors like data volume and sensitivity, a company
faces enhanced obligations including appointing an India-based Data Protection Officer, appointing an
independent data auditor, and conducting periodic Data Protection Impact Assessments and audits.
