Notes on the DPDP Act and Rules.
Each article gives the clause behind every legal statement, its sources and the date it was last checked. By Fohrkast Editorial. RSS ↗
- 13 Nov 2025 · in forceThe Board and the definitions. No duty on businesses.
- 8 Nov 2026 · today5 days to the next date.
- 13 Nov 2026 · in 5 daysConsent Managers must be registered.
- 13 May 2027 · in 186 daysNearly every duty starts, with the penalties.
All articles
5 of 5-
Breach
The 72 hour report to the Data Protection Board (Rule 7): the clock, the contents, the start time
After a personal data breach: tell each affected person and the Board without delay, then send the Board a detailed report within 72 hours (Rule 7).
s.8(6) · Rule 7 5 Nov 2026 · 7 min
-
Consent
Consent Managers under the DPDP Act: what they do and who needs one
A Consent Manager is a Board registered company that lets people give and withdraw consent in one place. Registration starts 13 Nov 2026. Who needs one.
s.2(g) · s.6(7) to (9) · Rule 4 3 Nov 2026 · 7 min
-
Scope
Who the DPDP Act applies to: Fiduciaries, Processors, exemptions
The DPDP Act covers anyone deciding why and how digital personal data is processed in India, whatever its size. Who is covered, who is not, and the exemptions.
s.3 · s.2(i) and (k) · s.17 29 Oct 2026 · 8 min
-
Security Updated 29 Oct 2026
Why customer data needs protecting, and what the DPDP Act asks
Each customer detail a business holds can now be joined by AI with details held elsewhere. From 13 May 2027 the DPDP Act makes guarding them a duty.
s.8(1) · s.8(5) · s.8(7) · Rule 7 28 Oct 2026 · 6 min
-
Dates Updated 29 Oct 2026
The DPDP dates: 13 Nov 2026 and 13 May 2027, and what applies on each
Consent Manager registration starts 13 Nov 2026; nearly every business duty and the penalties start 13 May 2027. What the Gazette says, and the 14th.
G.S.R. 843(E) · G.S.R. 846(E) · Rule 1 27 Oct 2026 · 8 min