DPDP Rules Notification Status: What Is in Force and What Is Pending

Regulatory status questions deserve a status page, not a news archive. This page states what is notified, what is in force, and what remains pending under the DPDP Act 2023 and the DPDP Rules 2025.

Status as of September 2026. For deadline planning and the full date-by-date roadmap, see the DPDP compliance timeline.

The Status Table

Instrument	Status	Date
DPDP Act 2023	Enacted. Presidential assent and Gazette publication	11 August 2023
Act commencement notification, G.S.R. 843(E)	Published. Gazette of India Extraordinary, Part II, Section 3(i)	13 November 2025
Act: definitions, Board provisions, rule-making powers	Commenced	13 November 2025
Act: Section 6(9), Consent Managers	Pending commencement	13 November 2026
Act: obligations of Data Fiduciaries and rights of Data Principals, Sections 3 to 5, 6(1) to (8) and (10), 7 to 17	Pending commencement	13 May 2027
Act: penalty provisions, Sections 28 to 34	Pending commencement	13 May 2027
Draft DPDP Rules	Superseded by the final Rules	Published 3 January 2025
DPDP Rules 2025	Notified. Commencing in stages	13 November 2025
Corrigenda to the DPDP Rules 2025, G.S.R. 892(E)	Published. Seven clerical corrections, no date changed	10 December 2025
Rules 1, 2 and 17 to 21	In force	13 November 2025
Data Protection Board of India	Established in law. No Chairperson or Members appointed	From 13 November 2025
Rule 4, Consent Manager registration	Pending	13 November 2026
SDF window compression	Proposed by MeitY, not gazetted	Proposal circulated January 2026
Rules 3, 5 to 16, 22 and 23	Pending	13 May 2027

Each row is expanded below.

What Is in Force Today

Part of the Act. The DPDP Act received Presidential assent on 11 August 2023, but its sections come into force only on dates appointed under Section 1(2). The commencement notification of 13 November 2025 brought three groups into force: Section 2 (definitions), Sections 18 to 26 (the Data Protection Board), and the rule-making powers. The obligations on Data Fiduciaries were not in that group. Notice under Section 5, consent under Section 6, security safeguards under Section 8, children’s data under Section 9 and Data Principal rights under Sections 11 to 14 take effect on 13 May 2027.

Part of the Rules. The Digital Personal Data Protection Rules were notified on 13 November 2025, following the draft published on 3 January 2025. Rule 1, Rule 2 and Rules 17 to 21 commenced on publication. The rest wait: Rule 4 from 13 November 2026, and Rules 3, 5 to 16, 22 and 23 from 13 May 2027. Notification fixed the text. It did not start the clock on every rule.

The Board, on paper. The 13 November 2025 commencement established the Data Protection Board of India in law. It is the adjudicatory authority that will hear complaints and impose penalties once the penalty provisions commence. As of September 2026 it has no Chairperson and no Members appointed.

The regime that does bind you today. Section 43A of the IT Act and the SPDI Rules remain the operative law on personal data until Section 44(2) of the DPDP Act commences on 13 May 2027. Sectoral obligations are separate and are in force under their own authority: the CERT-In six-hour incident reporting direction, the RBI Directions, and the IRDAI guidelines.

The draft-to-final delta was procedural, not structural. An organisation that built against the January 2025 draft lost no work.

What Changes on 13 November 2026

Consent Manager registration becomes mandatory. Rule 4 applies from 13 November 2026, when registration becomes mandatory for anyone operating as a Consent Manager. Any entity acting as a Consent Manager, the registered intermediary defined in Section 2(g), must hold Data Protection Board registration under Section 6(9) from this date. The Rule 4 conditions, including Indian incorporation and the Rs 2 crore net worth test, take months to clear. The registration procedure sets out the sequence.

Most businesses have no registration obligation. A company managing consent for its own customers is a Data Fiduciary, not a Consent Manager. The distinction between the two determines which obligations apply.

The SDF question, still open. MeitY circulated a proposal in January 2026 to compress the Significant Data Fiduciary compliance window from 18 months to 12. If gazetted, SDF obligations under Section 10 would bind from November 2026 instead of May 2027. As of this page’s status date the compression has not been gazetted. Organisations likely to be classified as SDFs should plan for November 2026 anyway. A proposal from the ministry that drafted the Rules signals intent.

What Takes Effect on 13 May 2027

The 18-month window runs from the 13 November 2025 notification to 13 May 2027. On that day the obligations on Data Fiduciaries commence, together with Rules 3, 5 to 16, 22 and 23 and the penalty provisions in Sections 28 to 34.

Obligation and consequence arrive together. From that date the penalty tiers fixed in the Act’s Schedule apply:

Up to ₹250 crore for failure to take reasonable security safeguards under Section 8(5). ₹200 crore for failure to notify a breach under Section 8(6), and the same tier for violations of children’s data obligations under Section 9. ₹150 crore for breach of Significant Data Fiduciary obligations under Section 10. Consent violations under Section 6 fall in the residual tier, which may extend to ₹50 crore. Each amount is a ceiling for the obligation breached.

A single incident can breach multiple obligations, and the tiers stack. The penalties guide covers how exposure compounds.

How to Read the Phases

The DPDP regime commences in stages, and each stage is triggered by government notification rather than by a date written into the Act. That design has two consequences.

First, the two forward dates are not guesses. Rule 1(3) and 1(4) put Rule 4 at 13 November 2026 and Rules 3, 5 to 16, 22 and 23 at 13 May 2027, and the Act’s own sections were notified to match. Both dates are printed in the Gazette.

Second, what remains genuinely uncertain is the enforcement apparatus, not the deadline. As of September 2026 the Data Protection Board has no Chairperson and no Members appointed. An organisation that reads that as slack is planning against the wrong variable: the date does not move because the Board is understaffed, and notices, consent records and rights handling take months to build.

What This Means For You

Check three boxes against this page. If you operate or plan to operate a consent intermediary, your date is 13 November 2026 and your work starts with Rule 4 eligibility. If you could plausibly be classified an SDF, plan to November 2026 and let the gazette decide whether you needed the margin. If you are any other Data Fiduciary, your date is 13 May 2027 and the build starts well before it. Notice, consent capture, withdrawal and erasure propagation, breach procedure and rights handling are multi-month projects, which puts the practical readiness point in 2026, not in 2027. Run the Gap Assessment to find out where you stand against the obligations that take effect on 13 May 2027.