When did the DPDP Act come into force?
The Digital Personal Data Protection Act was passed in 2023, but it did not take effect all at once. Commencement was notified subsequently and its provisions come into force in phases, with the Digital Personal Data Protection Rules supplying the operational detail. The practical consequence is that different obligations become enforceable at different times rather than on a single switch-on date.
Because the phasing is staged, the useful question is not "is the Act in force" but "which of our obligations are live now, and which arrive next". Check the current commencement position for the provisions that bear on you before relying on any date you read second-hand, including this page.
The work that takes longest — discovery, establishing lawful basis, making deletion and consent withdrawal propagate — is also the work that has to be done regardless of the exact date. Organisations that wait for a deadline discover the engineering was the long pole.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Jupinder Bedi — Jupinder writes on data protection practice at ProtectComply, with a focus on how obligations translate into system behaviour.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →