On this page
- How G.S.R. 843(E) and G.S.R. 846(E) structure the rollout
- Phase 1 (13 November 2025): definitions, the Board and rule-making
- Phase 2 (13 November 2026): Consent Manager registration
- Phase 3 (13 May 2027): business duties, rights and penalties
- Our view: the vendor-neutral technical stack behind each section
- Sequencing your engineering rollout before 13 May 2027
- Common questions
- In the news
- Sources
On 13 November 2025, the Ministry of Electronics and Information Technology (MeitY) published Notification G.S.R. 843(E) in the Gazette of India under Section 1(2) of the Digital Personal Data Protection Act, 2023. On the same day, MeitY notified the Digital Personal Data Protection Rules, 2025 under Section 40 as G.S.R. 846(E), with 23 rules and seven Schedules. Together, they set three commencement dates: 13 November 2025, 13 November 2026 and 13 May 2027.
For Chief Information Security Officers, IT heads and Data Protection Officers, reading the statutory dates is only the first step. Each group of sections demands concrete technical controls before enforcement starts. The Act and Rules name no software vendor or brand; they set legal outcomes met through security architecture.
How G.S.R. 843(E) and G.S.R. 846(E) structure the rollout
Section 1(2) lets the Central Government set different dates for different provisions, where commencement means the date a provision comes into force. G.S.R. 843(E) sorts the Act into three clauses, and Rule 1(2), Rule 1(3) and Rule 1(4) apply the same intervals to the Rules.
| Enforcement phase | Act sections in G.S.R. 843(E) | DPDP Rules in G.S.R. 846(E) | Operational focus |
|---|---|---|---|
| Phase 1: 13 Nov 2025 Publication, Clause (a) | Section 1(2), Section 2, Sections 18 to 26, Section 35, Sections 38 to 43, Section 44(1) and Section 44(3). | Rules 1, 2 and 17 to 21 under Rule 1(2). | Definitions, Data Protection Board of India setup, digital office, rule-making, and TRAI Act and RTI Act amendments. |
| Phase 2: 13 Nov 2026 +1 year, Clause (b) | Section 6(9) and Section 27(1)(d). | Rule 4 and the First Schedule under Rule 1(3). | Consent Manager registration and Board inquiry powers over registration conditions. |
| Phase 3: 13 May 2027 +18 months, Clause (c) | Sections 3 to 5, Section 6(1) to 6(8) and Section 6(10), Sections 7 to 17, Section 27 except Section 27(1)(d), Sections 28 to 34, Section 36, Section 37 and Section 44(2). | Rules 3, 5 to 16, 22 and 23, plus the Second to Seventh Schedules under Rule 1(4). | Data Fiduciary duties, security safeguards, 72-hour breach reporting, Data Principal rights, 90-day grievance redressal, inquiries, appeals and penalties up to ₹250 crore. |
What the video shows
- MeitY Notification G.S.R. 843(E) dated 13 November 2025 sets three DPDP Act commencement phases: 13 November 2025, 13 November 2026 and 13 May 2027.
- Phase 1 (13 November 2025, Clause (a) and Rule 1(2)): Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) plus Rules 1, 2 and 17 to 21 bring definitions, the Data Protection Board digital office and rule-making into force.
- Phase 2 (13 November 2026, Clause (b) and Rule 1(3)): Section 6(9), Section 27(1)(d), Rule 4 and the First Schedule activate Consent Manager registration and interoperable Consent API Gateways.
- Phase 3 (13 May 2027, Clause (c) and Rule 1(4)): Sections 3 to 17, 27 to 34, 36, 37 and 44(2) plus Rules 3, 5 to 16, 22 and 23 start substantive business duties and penalties up to 250 crore rupees.
- Technical Stack Layers 1 to 4: Consent Management System (CMS), Interoperable Consent API Gateway, Attribute-Based Access Control (ABAC, RBAC and PAM), and Field-Level Encryption, Tokenisation and Key Management.
- Technical Stack Layers 5 to 8: Centralised SIEM with one-year immutable audit logs, internal or outsourced 24x7 Security Operations Centre (SOC) for 72-hour breach reporting, automated data discovery and erasure orchestration, and a 90-day rights and grievance portal.
Phase 1 (13 November 2025): definitions, the Board and rule-making
Clause (a) of G.S.R. 843(E) brought the institutional framework into force on publication. Section 2 activates the definitions of Data Fiduciary, Data Processor, Data Principal, Consent Manager and personal data breach. Sections 18 to 26 and Rules 17 to 21 cover the Data Protection Board of India, digital proceedings under Rule 20, and the six-month inquiry limit under Rule 19(9). Section 35 protects good-faith action, Sections 38 to 43 cover other laws (Section 38), civil court bar (Section 39) and rule-making (Section 40), while Section 44(1) and Section 44(3) amend the TRAI Act and the Right to Information Act.
Phase 2 (13 November 2026): Consent Manager registration
One year after publication, clause (b) activates Section 6(9) and Section 27(1)(d), with Rule 4 under Rule 1(3). A Consent Manager under Section 2(g) is a Board-registered interoperable platform where a Data Principal gives, manages, reviews and withdraws consent. Part A of the First Schedule requires incorporation in India, at least two crore rupees net worth, and certified systems. Section 27(1)(d) covers inquiries into registration breaches.
Phase 3 (13 May 2027): business duties, rights and penalties
Eighteen months after publication, clause (c) switches on every obligation for organisations that fall within Section 3. Lawful processing (Section 4), itemised notices (Section 5, Rule 3), consent (Section 6(1) to 6(8), Section 6(10)), and legitimate uses (Section 7, Rule 5) start alongside Section 8 duties: security safeguards (Section 8(5), Rule 6), breach intimation (Section 8(6), Rule 7), and erasure (Section 8(7), Rule 8). Children’s data (Section 9, Rules 10 to 12), Significant Data Fiduciary duties (Section 10, Rule 13), Data Principal rights and the 90-day grievance limit (Sections 11 to 14, Rule 14), cross-border rules (Section 16, Rule 15), exemptions (Section 17, Rule 16), Board inquiries and penalties (Sections 27 to 34), blocking powers (Sections 36 and 37), and the omission of IT Act section 43A (Section 44(2)) all start on 13 May 2027.
Our view: the vendor-neutral technical stack behind each section
The statute defines legal outcomes rather than software brands. Eight vendor-neutral technology categories satisfy these sections cleanly.
| Statutory provisions | Technology category | Required engineering capability |
|---|---|---|
| Section 5, Section 6(1) to 6(8), Section 6(10), Rule 3 | Consent Management System (CMS) | Serves itemised notices in English and Eighth Schedule languages (Section 5(3)), stores immutable consent logs for Section 6(10) proof, and triggers revocation webhooks so Data Processors cease processing under Section 6(6). |
| Section 6(9), Section 27(1)(d), Rule 4 | Consent Manager API Gateway | Exposes standard APIs to accept, verify and revoke consent tokens from registered Consent Managers from 13 November 2026. |
| Section 8(4), Section 8(5), Rule 6(1)(b) | Attribute-Based Access Control (ABAC), RBAC and PAM | Enforces least-privilege access bound to role, purpose and consent state, with Multi-Factor Authentication and Privileged Access Management. |
| Section 8(5), Rule 6(1)(a) | Encryption, Tokenisation, Masking and KMS / HSM | Applies field-level encryption at rest, TLS in transit, tokenisation or masking in non-production tiers, and managed key rotation. |
| Section 8(5), Rule 6(1)(c), Rule 6(1)(e), Rule 8(3) | Centralised SIEM and 1-Year Audit Log Vault | Streams database, API and admin logs into immutable storage kept for at least one year under Rule 6(1)(e) and Rule 8(3) (and the Seventh Schedule) to detect unauthorised access. |
| Section 8(5), Section 8(6), Rule 6(1)(d), Rule 7(1), Rule 7(2) | 24x7 Security Operations Centre (Internal or Outsourced SOC), EDR and SOAR | Provides continuous monitoring (at minimum an outsourced Managed SOC), containment playbooks, backups under Rule 6(1)(d), immediate Data Principal alerts under Rule 7(1), and the 72-hour Board filing under Rule 7(2)(b). |
| Section 8(7), Section 8(8), Rule 8(1), Rule 8(2), Third Schedule | Data Discovery, RoPA and Erasure Orchestrator | Maps personal data across stores, sends the 48-hour pre-erasure notice under Rule 8(2), and runs cascading deletion across primary and processor systems when consent is withdrawn or purpose expires. |
| Section 9, Sections 11 to 14, Rule 9, Rule 10, Rule 14 | Rights & Grievance Portal and Verifiable Age Gate | Verifies parental or guardian tokens under Rule 10 and Rule 11, blocks behavioural tracking and targeted ads for children under Section 9(3), and tracks access, erasure, nomination and grievance tickets within the 90-day limit under Rule 14(3). |
Sequencing your engineering rollout before 13 May 2027
Technical controls must be live before 13 May 2027. Start with How-to 03 (Data Inventory) and How-to 02 (Timeline) to map stores and processors, then deploy ABAC, encryption and one-year SIEM logs (How-to 04), CMS notices (How-to 05), 90-day rights tracking (How-to 07), and 72-hour SOC breach playbooks (How-to 11). See how our documents work.
Common questions
What are the three enforcement dates in Notification G.S.R. 843(E)?
The notification sets three phases counted from its publication on 13 November 2025: definitions and the Data Protection Board on 13 November 2025, Consent Manager registration on 13 November 2026, and business duties, rights and penalty powers on 13 May 2027.
Does the DPDP Act or Rules name any specific software vendor or security product?
No. Neither the Act nor the notified Rules names any software brand, vendor or certification. They state legal and technical outcomes such as encryption, masking, access control, one-year processing logs, backups and 72-hour breach reporting.
Why do engineering teams need at least an outsourced 24x7 SOC and centralised SIEM?
Businesses must detect unauthorised access, keep processing and access logs for at least one year, notify affected individuals without delay after any personal data breach, and file full breach details with the Board within 72 hours.
How does Attribute-Based Access Control help meet the security safeguard duty?
The security safeguard rule requires appropriate access control to computer resources used by a Data Fiduciary or Data Processor. Attribute-Based Access Control restricts queries by role, department, purpose and active consent status.
What technical capabilities must a Consent Management System and rights portal have by 13 May 2027?
They must present standalone itemised notices in English and the twenty-two constitutional languages, log timestamped proof of consent, propagate withdrawals to processors, and resolve grievances within 90 days.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 04: Set the rules, in the toolkit
- How-to 02: Plan the work, in the toolkit
- How-to 05: Ask properly, in the toolkit
- How-to 11: When something goes wrong, in the toolkit
- The free duties list, every duty in plain words
In the news
eMudhra private key breach limited to global TLS operations, MeitY says
Ministry of Electronics and Information Technology clarifies that the compromise of private keys linked to eight eMudhra digital certificates was confined to foreign TLS operations and did not affect domestic e-sign infrastructure.
DPDP Act & Rules takeaway: Directly relates to CERT-In cybersecurity advisories and cryptographic key management standards under DPDP Section 8(5), reinforcing enterprise obligations to protect digital certificate chains.
View statutory briefing illustration
Source & Courtesy Reference: Deccan Herald (original report)PHP security alert: Why CERT-In, FBI, Google and OpenAI are warning users and how to fix it
CERT-In, the FBI, Google, and OpenAI warned against critical remote code execution vulnerabilities in PHP stacks powering web applications, urging immediate patch deployment.
DPDP Act & Rules takeaway: Illustrates the mandatory production hardening stack under G.S.R. 843(E) and Section 8(5), where unpatched application runtimes expose customer records to arbitrary takeover and statutory breach penalties.
View statutory briefing illustration
Source & Courtesy Reference: Digit (original report)A private key with the value 4: IFF writes to eMudhra, CERT-In and MeitY on the compromise of eMudhra’s certificate authority keys
DPDP Act & Rules takeaway: Examines cryptographic key management and TLS certificate trust under Rule 6 encryption and security safeguard standards.
View statutory briefing illustration
Source & Courtesy Reference: Internet Freedom Foundation (original report)Govt forms special team to investigate eMudhra digital certificate leak
DPDP Act & Rules takeaway: Reports MeitY and CERT-In forming a joint technical team to investigate the compromise of eMudhra certificate authority keys.
View statutory briefing illustration
Source & Courtesy Reference: Business Standard (original report)MeitY Issued a Notification Regarding the Commencement of the DPDP Act (G.S.R. 843(E))
DPDP Act & Rules takeaway: Regulatory compliance summary of the three commencement windows in G.S.R. 843(E).
View statutory briefing illustration
Source & Courtesy Reference: TeamLease RegTech (original report)DPDP Rules 2025: Fiduciary Duties Phase In Over 18 Months
DPDP Act & Rules takeaway: Walks through the 18-month rollout of Data Fiduciary obligations under G.S.R. 846(E).
View statutory briefing illustration
Source & Courtesy Reference: MediaNama (original report)Gazette Notification G.S.R. 843(E): Phased Commencement of the Digital Personal Data Protection Act, 2023
DPDP Act & Rules takeaway: Official bilingual Gazette notification setting the 13 November 2025, 13 November 2026 and 13 May 2027 commencement dates under Section 1(2).
View statutory briefing illustration
Source & Courtesy Reference: Ministry of Electronics and Information Technology (MeitY) (original report)
Videos
Sources
Every section, rule and date above was checked against the official text on 21 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 1(2)Different dates for different provisions; commencement means the date that provision comes into force
- Section 2Definitions, including Data Fiduciary, Data Processor, Data Principal, Consent Manager (2(g)) and personal data breach, in force on 13 November 2025
- Section 3Scope and application of the Act, from 13 May 2027
- Section 4Lawful grounds for processing personal data, from 13 May 2027
- Section 5Itemised notice and language options (5(3)), from 13 May 2027
- Section 6(1) to (10)Consent conditions (6(1) to 6(8)), processor cessation on withdrawal (6(6)) and burden of proof (6(10)) from 13 May 2027; Consent Manager registration (6(9)) from 13 November 2026
- Section 7Certain legitimate uses, from 13 May 2027
- Section 8(1) to (10)General obligations of Data Fiduciary: organisational and technical measures (8(4)), reasonable security safeguards (8(5)), breach intimation (8(6)), and erasure (8(7), 8(8)), from 13 May 2027
- Section 9Processing of personal data of children and prohibition on tracking or targeted advertising (9(3)), from 13 May 2027
- Section 10Additional obligations of Significant Data Fiduciaries, from 13 May 2027
- Sections 11 to 14Data Principal rights to information, correction, erasure, grievance redressal and nomination, from 13 May 2027
- Section 16Processing of personal data outside India, from 13 May 2027
- Section 17Exemptions, from 13 May 2027
- Sections 18 to 26Establishment, composition, officers and proceedings of the Data Protection Board of India, in force on 13 November 2025
- Section 27Powers and functions of the Board: Consent Manager registration breaches (27(1)(d)) from 13 November 2026; all other clauses from 13 May 2027
- Sections 28 to 34Board inquiry procedure, appeals, mediation, voluntary undertakings and monetary penalties, from 13 May 2027
- Section 35Protection of action taken in good faith, in force on 13 November 2025
- Sections 36 and 37Power to call for information and power to issue blocking directions, from 13 May 2027
- Sections 38 to 43Consistency with other laws, bar of jurisdiction of civil courts (39) and power to make rules (40), in force on 13 November 2025
- Section 44(1), (2) and (3)Amendments to the TRAI Act (44(1)) and RTI Act (44(3)) on 13 November 2025; amendment to the IT Act omitting section 43A (44(2)) on 13 May 2027
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 1(2), (3) and (4)Staggered commencement of the DPDP Rules, 2025 on publication (1(2)), at one year (1(3)) and at eighteen months (1(4))
- Rule 3Notice given by Data Fiduciary to Data Principal
- Rule 4Registration and obligations of Consent Manager, with the First Schedule
- Rule 5Processing for subsidies, benefits, services, certificates, licences or permits by the State
- Rule 6(1)(a) to (e)Reasonable security safeguards: encryption, masking or tokenisation (6(1)(a)), access control (6(1)(b)), visibility and logs to detect unauthorised access (6(1)(c)), backups (6(1)(d)), one-year log retention (6(1)(e))
- Rule 7(1) and (2)Intimation of personal data breach to Data Principals without delay (7(1)) and to the Board within 72 hours (7(2)(b))
- Rule 8(1) to (3)Time period for specified purpose to be deemed no longer served (8(1)), 48-hour pre-erasure notice (8(2)), and minimum one-year retention of personal data and logs (8(3))
- Rule 9Contact information of Data Protection Officer or person able to answer questions
- Rules 10 to 12Verifiable consent for processing personal data of a child (10) and of a person with disability who has a lawful guardian (11)
- Rule 13Additional obligations of Significant Data Fiduciary
- Rule 14(1) to (5)Rights of Data Principals and grievance redressal system within a period not exceeding ninety days (14(3))
- Rule 15Transfer of personal data outside India
- Rule 16Exemption for research, archiving or statistical purposes
- Rules 17 to 21Board selection, terms, six-month inquiry completion limit (19(9)), digital office (20) and officers
- First Schedule, Part AConditions of registration of a Consent Manager, including incorporation in India and minimum two crore rupees net worth
- Third Schedule and Seventh ScheduleRetention timelines for large Data Fiduciaries (Third Schedule) and purposes for minimum one-year retention (Seventh Schedule)
Notifications
- G.S.R. 843(E), clauses (a), (b) and (c)Commencement notification for the DPDP Act, 2023 published on 13 November 2025
- G.S.R. 846(E)The Digital Personal Data Protection Rules, 2025 (23 rules and seven Schedules) published on 13 November 2025
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
