Prepared on 26 October 2026. This article provides general information, not advice on a particular case. Check subsequent amendments, notifications and the facts of your matter before acting.
Payroll spreadsheets, customer contact details and vendor records can contain personal data. India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 make it necessary to understand both the data being handled and when the relevant provisions commence.
The framework is not all in force at once
The commencement notification dated 13 November 2025 provides separate stages. The institutional and specified enabling provisions begin on publication; the Consent Manager-related tranche follows one year after publication; and the principal processing obligations and rights fall in the eighteen-month tranche. The Rules also specify immediate, one-year and eighteen-month commencement groups.
Accordingly, as at 26 October 2026, it would be incorrect to describe every operational DPDP obligation as already effective. Equally, a transition period should not be treated as a reason to disregard existing confidentiality, contractual, information-security or other applicable legal duties. Always check later notifications before relying on a commencement calendar.
Start with the actual flow of personal data
Assess whether the proposed processing falls within the Act’s scope and whether an exemption or a particular lawful basis applies. Consent is not the only basis contemplated by the Act: it also provides for specified legitimate uses. The correct analysis depends on the purpose and circumstances, including the handling of employee information.
A suggested preparation plan
- Inventory: record what personal data is collected, its purpose, storage location, users and recipients.
- Access: review shared drives, email forwarding, payroll exports and permissions when staff leave.
- Vendors: identify processors and review responsibilities for security, incidents, return and deletion of records.
- Notices and requests: prepare understandable information and a workable route for relevant requests and grievances.
- Retention: distinguish necessary tax, employment and professional records from avoidable copies; do not erase records that another applicable law requires you to retain.
- Incident response: assign responsibility, preserve evidence and test an escalation process.
This list is a preparation aid, not a certification of compliance. The Act, notified Rules, commencement provisions and applicable sector requirements must be considered together.
Related resource: DPDP Ready
DPDP Ready at dpdp.me is a related website operated by CA Aanand P, with a readiness self-check, resources and sample deliverables. It is a private resource, not a government portal or a substitute for the official texts.
Official references
- Digital Personal Data Protection Act, 2023
- G.S.R. 843(E): commencement notification
- Digital Personal Data Protection Rules, 2025, including commencement provisions
© 2026 Aanand & Co. Original commentary; rights in official publications and other third-party material remain with their respective owners.
