The DPDP Act became law in 2023, and the government notified the detailed Rules in November 2025. The rollout is staggered. The provisions that set up the Data Protection Board took effect straight away, while the core obligations for businesses come into force after an 18-month transition, which ends on 13 May 2027. Until then, the older SPDI Rules of 2011 continue to apply, so there is no gap in the law.
DPDP Act Compliance Roadmap: What Indian Businesses Must Do Before 13 May 2027