Initial provisions commenced
The Act’s commencement notification brought establishment, definitions, and Board-related provisions into force.
DPDP readiness hub
13 May 2027. Be operating before the deadline.
Core operational provisions commence on 13 May 2027. Failure to take reasonable security safeguards can attract a penalty up to ₹250 crore under the Act’s Schedule.
13May2027core operational commencement
Operating control loop
Discover. Control. Exercise. Prove.
Turn privacy obligations into data actions your DPO, security team, and developers can operate together.
Operational deadline13 May 2027Build, test, and rehearse before commencement.
01DiscoverData + processors
02DefinePurpose + consent
03ProtectMinimize + gate
04OperateRights + erasure
05ProveEvidence + response
Every stage should leave usable operating evidence—not only policy documents.
Phased commencement
Three dates, one build program.
Engineering summary only; counsel should interpret applicability for your organization.
One-year provisions
The notification schedules specified Consent Manager and related Board provisions one year after publication.
Core operational provisions
Most processing, notice, consent, rights, fiduciary, children, breach, and penalty provisions commence eighteen months after publication.
Primary sources: MeitY commencement notification and DPDP Act penalty Schedule .
Know the data
Map systems, processors, purpose, retention, residency, and AI exposure.
Run the rights
Exercise access, correction, withdrawal, erasure, grievance, and breach response.
Keep the proof
Connect each request, decision, action, and outcome without logging plaintext.
Not legal advice
Securelay provides technical controls and engineering guidance. The DPDP Act, Rules, commencement notification, sector obligations, and your facts should be reviewed by qualified counsel. We do not claim that installing software alone creates compliance.