India’s DPDP Framework: Why Enacted, Notified and Effective Are Different Dates

Build a timeline, not a single headline

India enacted the DPDP Act in August 2023. Official Ministry of Electronics and Information Technology resources published the DPDP Rules and enforcement timetable in November 2025, with different provisions commencing at different times. As of 25 October 2026, treating every requirement as if it began simultaneously in 2023 or 2025 would be inaccurate.

Identify the relevant processing

Determine what personal data the service uses, how it was obtained, who decides the purposes, which processors receive it, and whether deployment, inference, retraining and marketing involve different processing. An AI model’s presence does not remove the need to examine applicable data protection duties. The current statute and rules, not commentary headlines, determine exact conditions.

Ask the practical questions

Does the product need raw identifiers? What disclosures are provided? Are training use, retention and overseas recipients documented? Can people make an applicable correction or grievance request? Are children’s data and sensitive contexts handled with appropriate safeguards? A reusable control inventory can capture the answers, but legal review is needed for precise obligations.

Example: document summarizer

An enterprise team uses AI to condense customer support tickets. It can de-identify before submission, keep access permissions aligned with employee roles and use versioned supplier terms. It should still map statutory obligations to the specific effective dates and purposes rather than assume de-identification is legally sufficient in all cases.

Important limits

This article is an editorial orientation; it does not attempt to restate every notified phase or subsequent amendment. Legal consequences and deadlines require a clause-by-clause check of the official current Gazette and guidance for the specific controller and date.

QA disposition

Review: an authoritative timeline exists, but a publish-ready detailed clause map and effective-date reconciliation is not yet complete. The article is retained as a full draft, not marked ready.

Editorial verification pending: Legal applicability needs additional source-level review before this draft can be released.

Dated first-party verification and limits

The Government of India’s G.S.R. 843(E), dated 13 November 2025, phases the Act itself. Listed institutional and enabling provisions began on publication; section 6(9) and section 27(1)(d) are scheduled one year later (13 November 2026); many core processing, rights and enforcement provisions are scheduled eighteen months later (13 May 2027). On 25 October 2026, the later phases were still future dates. The statutory schedule should not be confused with the separate Rules commencement notification.

The related G.S.R. 846(E) governs the Rules: Rules 1, 2 and 17–21 commenced on Gazette publication, Rule 4 is scheduled one year later and Rules 3, 5–16, 22 and 23 eighteen months later. Organizations should map an obligation to its particular Act section and rule; the existence of a published Rule is not evidence that it was operative on 25 October 2026.

Guidance varies by jurisdiction and application. This is general education, not legal, medical or other professional advice.