India’s DPDP implementation is a set of linked legal instruments, not one date. This tracker separates the Act’s commencement, the final Rules, Board composition and evidence of actual administrative action. Official sources were checked on 9 September 2026. Use the text and any amendments for a legal deadline; use this page to organise that review.
What the notifications establish
G.S.R. 843(E), dated 13 November 2025, stages commencement of the Act. The DPDP Rules, 2025 contain their own commencement provision. G.S.R. 845(E) addresses Board composition. These documents perform different functions. A statement that the Rules were notified does not mean every substantive duty became immediately enforceable.
| Source | Use it to establish | Do not infer |
|---|---|---|
| G.S.R. 843(E) | The Act provisions allocated to each commencement phase | The operational status of a complaints forum |
| G.S.R. 845(E) | The notified Board composition | That every position has been filled or that a penalty was imposed |
| Rules 2025, including Rule 1 | The Rules’ text and staged commencement | That the draft consultation text is the operative version |
The phased timeline
| Phase in the official text | Planning window | Scope to check |
|---|---|---|
| On publication | November 2025 | Specified definitions, institutional and miscellaneous Act provisions; the initial Rules provisions. |
| One year after publication | November 2026 | Act section 6(9), section 27(1)(d) and Rule 4 concerning consent managers. |
| Eighteen months after publication | May 2027 | Most substantive Act obligations and the later Rules provisions, including the notice and operational requirements identified in the text. |
Keep the instrument’s signature date, Gazette publication date and website upload date in different fields. Calculate the deadline from the trigger in the legal text and check for later amendments. A month-level planning summary should not be copied into a final compliance calendar as an exact day without that review.
Board establishment is distinct from appointments and activity
Maintain separate records for the establishment notification, composition notification, appointment notifications and published decisions. A recruitment notice proves an application process, not an appointment. A statutory power proves a power exists, not that it has been exercised in a particular case.
Current appointment and enforcement status require their own official evidence. If that evidence is not in the matter file, report it as unverified rather than converting an old snapshot into a present-tense assertion about membership, complaints or penalties.
How to record potential penalty exposure
Read the relevant obligation, commencement provision and the Act’s Schedule together. Record the conduct, affected provision, applicable phase and any published decision. A statutory maximum is not an automatic fine, and a prospective obligation should not be described as a penalty already imposed on an organisation.
Keep sector-specific, contractual and other legal requirements separate. A DPDP transition period does not establish that an organisation has no present privacy, security or reporting duties under other applicable frameworks.
Track the consent-manager phase separately
The one-year phase concerns specified consent-manager provisions. It does not make every organisation a registered consent manager. Record the organisation’s actual role and verify any registration claim against official evidence. For procurement, distinguish consent-management functionality in a product from statutory registration as a Consent Manager.
Track amendments and litigation without overstating their effect
If reviewing the Act’s consequential amendments, including the RTI-related provision, identify the exact text, its commencement and any relevant court order. A pending challenge, a petition and an operative stay have different effects. Preserve the order and scope before changing a compliance conclusion. This tracker does not infer a stay or legal outcome from a news headline.
Separate DPDP from GDPR workstreams
An international legal team can reuse an inventory of data, vendors and access arrangements, but must assess each legal framework independently. Keep an India requirements column and a separate EU or UK column. Do not carry over a GDPR conclusion, terminology or legal basis without checking its relevance to the Indian text.
A practical evidence register
| Field | Illustrative entry |
|---|---|
| Question | Which provision governs this proposed processing activity? |
| Primary source | Instrument, section or rule, official URL and saved version |
| Timing | Publication trigger, phase, amendment check and reviewer-approved date |
| Implementation evidence | Notice text, vendor terms, system owner and outstanding action |
| Decision | Responsible lawyer, review date and unresolved assumptions |
For a fictional vendor review, the team has a privacy notice and processing agreement but no retention schedule. Mark retention evidence missing, assign an owner and retain the exact source passages supporting the legal question. Do not have AI fill the gap with a generic declaration of compliance.
Review Matrix can organise document-level answers, while Legal Research helps locate sources for review. The DPDP compliance guide and India coverage page connect the source register to a broader workflow.
Sources and update method
Start with MeitY’s Rules collection, which lists the Rules, corrigendum and enforcement timeline. Use the individual Gazette documents linked above for the proposition each establishes. Keep a dated change log when an amendment, appointment or decision changes the assessment. This is an editorial tracking method for legal professionals, not legal advice or a live government enforcement feed.