Commencement
The date on which a law or part of it begins to apply.
Commencement is the date from which a law, or a particular part of it, starts to apply. Under the DPDP framework, different parts start on different dates.
Meaning of Commencement
The Act comes into force on dates the Central Government notifies. The Rules are phased: the provisions about the Board and definitions started first, the Consent Manager framework follows after 12 months, and most of the duties of Data Fiduciaries apply from 13 May 2027, 18 months after notification.
In Indian law, an Act becomes law when the President gives assent, but it takes effect only when its commencement provision says so. Section 1(2) of the DPDP Act provides that the Act comes into force on the date or dates the Central Government appoints by notification in the Official Gazette, and different dates may be appointed for different provisions. This is why an Act assented to in August 2023 did not impose duties on anybody for more than two years.
The Rules then set their own timetable. Under Rule 1, Rules 1, 2 and 17 to 21 apply from 13 November 2025, the date of publication; these set up the Board and define terms. Rule 4 on Consent Manager registration applies from 13 November 2026. Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027, eighteen months after publication. That last date is the one that matters to nearly every organisation, because notice, consent, security, breach reporting, retention and the rights process fall within it.
It helps to separate three things that are often confused. The Act's commencement notification decides which sections of the Act are in force. Rule 1 decides when each rule applies. And a Significant Data Fiduciary's own duties begin only when it is notified as such. A section can be in force while the rule that operationalises it is not yet in force, and in that gap an organisation is expected to prepare, although penalty exposure for the substantive duties follows the dates when those provisions bite.
Commencement also interacts with data collected before the date. Section 5(2), for instance, deals with consent obtained before the Act applied: the fiduciary should send a notice as soon as reasonably practicable and may continue processing until the Data Principal withdraws consent. So commencement does not wipe the slate clean; it sets the date from which existing data holdings must be brought into line.
Examples of Commencement
A start-up plans its consent and retention changes to be ready by 13 May 2027.
A subscription start-up plans a two-phase project: first a data map and vendor review through 2026, then consent and retention changes in the first quarter of 2027, leaving a buffer before 13 May 2027. It treats the buffer as the time for testing, not for new work.
A fintech company wants to become a registered Consent Manager. Since Rule 4 applies from 13 November 2026, it prepares its net worth evidence and technical documentation for that date rather than waiting for the 2027 batch.
An insurer holds millions of policyholder records collected years ago. It plans a retrospective notice campaign under Section 5(2) timed for the months before 13 May 2027, and asks its call-centre vendor to update scripts at the same time.
Why Commencement matters
Getting commencement wrong has two opposite costs. If a company assumes the duties already apply, it may spend heavily before the date, or announce changes to customers prematurely. If it assumes the deadline is far away, it will find that consent re-papering, vendor renegotiation, breach tooling and retention clean-up cannot be completed in the last quarter. Eighteen months sounds long, but it is short for a company with many systems and vendors.
For individuals, commencement dates determine when rights such as access, correction, erasure and grievance redressal can be enforced in practice. Until the relevant provisions apply, a complaint to the Board on those provisions will not succeed, so it is worth knowing which dates apply to your situation.
How it works in practice
- 1Put the three Rule 1 dates (13 November 2025, 13 November 2026, 13 May 2027) on the programme calendar and work backwards from 13 May 2027 with milestones for each workstream.
- 2Assign the workstreams that need the longest lead time first: data inventory, vendor contracts with processors, consent capture redesign and retention tooling.
- 3Decide how you will treat existing data. Plan the Section 5(2) notice to current users and a way to record whether any of them withdraw consent after the notice.
- 4Check for later notifications each quarter. Significant Data Fiduciary designation, restrictions under Section 16 and any exemption for notified classes can all start on separate dates.
- 5Record the commencement basis in your compliance register (for example, "Rule 7, applies from 13 May 2027") so a later reader can see why a control was or was not required at a given time.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the date of assent as the date of commencement. Assent in August 2023 started no compliance duties.
Assuming one date for everything. Board provisions, Consent Manager registration and the main duties start on three different dates under Rule 1.
Assuming old data is outside the Act. Data collected earlier is covered from the commencement date, subject to Section 5(2) on earlier consent.
Ignoring later notifications. Commencement for some provisions, such as Significant Data Fiduciary classes, can be fixed by later notices.
Compliance tips
Keep a one-page timeline for management that shows what has started, what starts next and what is not yet notified.
Ask vendors for their own readiness plan with dates, because a processor that is late becomes your risk under Section 8(1).
Do not publish customer-facing statements such as "we are DPDP compliant" before the substantive duties have started and your controls are tested.
Re-confirm the dates from the Gazette copy before sending any board paper.
Common questions about Commencement
When does the DPDP Act come into force?
In stages, by notification under Section 1(2). Board and definition provisions started in November 2025 and the substantive Rules on notice, consent, security and breach apply from 13 May 2027. Consent Manager registration under Rule 4 begins in November 2026.
Why 13 May 2027?
Rule 1 gives eighteen months after the publication date of 13 November 2025 for the main operational rules. The period is meant to let organisations build systems before the duties and penalties apply.
Do I have to comply with the DPDP Act before 13 May 2027?
The main duties on notice, consent, security and breach apply from that date, but preparation should start now. Some Board-related provisions are already in force, and the work needed to comply takes months.