DPDP implementation phases

There is more than one commencement phase

The November 2025 notification brings specified institutional provisions into force on publication, another group after one year and the main processing-duty provisions after eighteen months. The exact provision, not a general reference to “DPDP”, determines the phase.

Act and Rules: provision-to-date map

The dates below are calculated from the Gazette’s printed publication date, 13 November 2025. The electronic identifiers contain 14 November; keep the operative publication record with your compliance calendar and check subsequent official clarifications. These are commencement milestones, not dates quoted verbatim in the delayed-phase clauses.

On a narrow screen, scroll each table sideways. Keyboard users can focus its region and use the arrow keys.

DPDP Act — G.S.R. 843(E)

Act commencement notification: immediate, one-year and eighteen-month phases.

DPDP Rules — G.S.R. 846(E), rule 1

Rules commencement provision separately allocates the following groups.

As at 2 October 2026, the first phase has commenced; the two later phases are preparation milestones. Applicability and exemptions still depend on the activity. Existing sectoral, contractual and other legal duties do not disappear while DPDP implementation work is under way.

Use a provision-to-process register

For each relevant requirement, record the section, linked rule, commencement basis, affected system and accountable team. Keep the Gazette publication reference with the calculation. Separate work you can prepare now from duties whose operative date is later.

• Map personal-data collections and purposes.
• Identify notices, consent journeys and processor contracts.
• Assign ownership for rights requests and incident coordination.
• Track retention and deletion capability in actual systems.

Avoid two common shortcuts

It is inaccurate to treat all obligations as immediately operative simply because the rules have been notified. It is also unhelpful to postpone every preparation task until the last phase. Build the inventory and design dependencies early, while describing the law’s operative status accurately.

Example: changing a sign-up flow

A product team can inventory collected fields, identify purposes and review its notice journey before an operational obligation commences. It should also record why each proposed control is being designed and which provision it is intended to address. Sectoral and other existing duties need separate consideration.

Connect the legal phase to the product work

A useful implementation map links a provision to a real collection point or operating process. The entries below are planning prompts, not a finding that every control is already legally required for every business.

Collection and purpose

Identify the form, app screen or offline process, the fields collected and the business purpose for each field.

Systems and recipients

Trace where the record goes, who uses it and which service providers receive it. Include exports and copies held outside the main application.

Control and dependency

Connect the proposed notice, request process or deletion capability to its legal basis, commencement phase and technical dependency.

Owner and evidence

Name the responsible business team and record how the change will be checked, including unresolved exceptions.

Walk through one complete data journey

Start with a customer enquiry. List the fields on the form, the destination inbox or CRM, the staff who use the record and any later export. Check whether the information shown to the visitor matches that actual journey.

Next, consider how the business would find the record again or apply an agreed retention decision across its copies. A revised notice cannot by itself change a disconnected spreadsheet or a vendor’s system. Record those dependencies before assigning a completion date to the project.

Keep the evidence of the walkthrough with the provision-to-process register. Read DPDP readiness assessment for the service scope and privacy notices and consent design for the customer-facing work.