When do the DPDPA obligations commence?

DPDPA section 1(2) provides that different provisions come into force on the dates the Central Government appoints by notification. Check the commencement notifications and the DPDP Rules for the dates that apply to you; the Act does not state a single date for every obligation.

What obligations does the DPDPA set?

The Act sets consent and notice requirements (sections 5–6), reasonable security safeguards (section 8(5)), breach notification (section 8(6)), Data Principal rights and grievance redressal (sections 11–14), the section 9 requirements for children's data, and Significant Data Fiduciary duties (section 10).

Is the Data Protection Board enforcing the DPDPA?

Section 18 of the Act provides for the establishment of the Data Protection Board of India. Its enforcement activity is a matter of its published record. Check the Board's current published material for enforcement updates; this article does not assert a case history.

How does CERT-In reporting interact with DPDPA breach notification?

They are separate duties that can be triggered by the same incident. Direction (ii) of the CERT-In Directions dated 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, requires the covered entities to report the listed cyber incidents to CERT-In within six hours of noticing them, while DPDPA section 8(6) sets personal data breach notification to the Board and affected Data Principals. A single incident can start both workstreams.

DPDPA Deadlines and Commencement: What the Act and Rules Set

Q: How do Consent Managers fit into the DPDPA?

A Consent Manager is a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (DPDPA section 2(g)). Section 6(7) allows consent to be managed through a Consent Manager.

Where DPDPA dates actually come from

Under DPDPA section 1(2), different provisions of the Digital Personal Data Protection Act, 2023 come into force on the dates the Central Government appoints by notification, so the Act does not set all of its own commencement dates in the statute. The operative dates therefore live in the commencement notifications and the DPDP Rules, not in the Act's section text. Check the notified Rules and any commencement notification for the dates that apply to you; this article does not restate them.

What the Act does set is the obligation set. Those obligations are checkable against the sections cited below.

The obligations the Act sets

Consent and notice — consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (DPDPA section 6(1)); a notice must be given with or before the request for consent (DPDPA section 5(1)) and must be available in English or any language specified in the Eighth Schedule (section 5(3)).
Security safeguards — a Data Fiduciary must take reasonable security safeguards to protect personal data (DPDPA section 8(5)).
Breach notification — a personal data breach must be notified to the Data Protection Board and to affected Data Principals in the manner prescribed (DPDPA section 8(6)).
Data Principal rights — access, correction, completion, updating and erasure requests, and grievance redressal (DPDPA sections 11–14).
Children's data — verifiable parental consent and restrictions on behavioural advertising directed at children (DPDPA section 9).
Significant Data Fiduciary duties — where designated: a Data Protection Officer based in India, periodic Data Protection Impact Assessments and audit (DPDPA section 10).

Penalties in the Act

The DPDPA Schedule sets the monetary penalties for the categories it lists. For example, the Schedule provides a penalty of up to ₹250 crore for failure to take reasonable security safeguards. The Schedule is the authority for the amount and the category; confirm the current text before relying on a figure.

Consent Managers

DPDPA section 2(g) defines a Consent Manager as a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Section 6(7) allows a Data Principal to give, manage, review or withdraw consent through a Consent Manager.

One implementation consideration for a Data Fiduciary: consent and withdrawal signals can arrive from outside your own apps and websites, and the Act's consent requirements (DPDPA sections 5–6) apply to them.

Preparing without a fixed date

A sensible sequence:

Data mapping and ROPA first — begin with what personal data you hold and why.
Fix consent flows now — review collection, notice and withdrawal against DPDPA sections 5 and 6.
Decide the legacy-data position — for each historical dataset, identify the applicable basis and notice obligation — where consent was given before the Act commenced, section 5(2) requires a notice and permits continued processing until consent is withdrawn — and document the decision with your advisers.
Build the breach runbook — cover notification to the Board and to affected Data Principals under DPDPA section 8(6), and keep the separate CERT-In reporting duty as its own workstream: direction (ii) of the CERT-In Directions dated 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, requires the covered entities to report the listed cyber incidents to CERT-In within six hours of noticing them.
Stand up rights operations — intake, identity verification, routing and tracking for requests under DPDPA sections 11–14.
Prepare SDF deliverables if designated — DPO appointment, DPIA cycle and audit preparation under DPDPA section 10.

Common sequencing errors

Starting with documents instead of data. Hypothetical scenario: a team rewrites the privacy policy first, without a data inventory to check whether the policy describes reality. Map first, draft second.

Deferring consent. Consent and notice are express obligations in the Act (DPDPA sections 5–6); treat them as the first workstream, not the last.

Treating notice translation as a one-off. If your notice changes with processing purposes, the language versions need a maintained process with version control.

Where Compliance Enablers fits

DPDPA is one of the 30 standards Compliance Enablers runs as a guided programme, and the DPDPA framework record page on the new pattern is rolling out this month. The privacy, incident, document, training and audit modules are included in every plan. The obligations and penalties above are set by the Act, not the platform.

Next step

Read the DPDPA framework guide for the platform's DPDPA programme overview, or book a demo to map your current state against the Act.

This is general information, not legal advice.