India’s DPDP framework: scope, timing and practical preparation

What to establish first

Describe the activity and responsible parties, then review applicability and conditional concerns such as children’s data or a formal SDF notification. A self-assessment records your account; it does not determine the legal position.

MeitY: Digital Personal Data Protection Act, 2023

Commencement is phased

The 13 November 2025 notification starts specified provisions on publication, the section 6(9) Consent Manager registration provision one year later, and the main duties and rights tranche eighteen months later. This is the timing basis reviewed on 18 September 2026; check the official instruments for the particular provision.

Gazette: DPDP Act commencement notification, 13 November 2025 · MeitY: Digital Personal Data Protection Rules, 2025 · MeitY: DPDP Rules corrigendum, December 2025

Translate preparation into work

Build an activity map and assign ownership. Review grounds and notices, relevant choices, request handling, safeguards, incidents, providers and retention. Keep evidence of what has been decided, implemented and tested.

• Treat absent, partial and unknown arrangements separately.
• Review child-related controls and claimed exemptions on their facts.
• Use project dates as planning dates, not replacements for legal timing.

What a service discussion can cover

A bounded applicability review, evidence review or implementation programme can address defined questions. Certification, a legal clearance and formal DPO appointment are not automatic outcomes.