When each part of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 takes effect, read from the Gazette notifications themselves.
A bank that processes the personal data of its customers in digital form is a data fiduciary under the Digital Personal Data Protection Act, 2023. The Act does not single banks out. What it asks of them depends on which of its provisions are in force, and that is settled by notifications published in the Gazette of India on 13 November 2025.
The Act received Presidential assent on 11 August 2023 and was published as Act No. 22 of 2023. Under Section 1(2), its provisions come into force on dates appointed by notification, and different dates may be appointed for different provisions.
Notification G.S.R. 843(E), dated 13 November 2025, appoints those dates. Section 2, Sections 18 to 26, Section 35 and Sections 38 to 43, among others, came into force on the date of publication. Section 6(9), on the registration of consent managers, and Section 27(1)(d) come into force one year from publication. Sections 3 to 5, the rest of Section 6, Sections 7 to 17, the rest of Section 27, Sections 28 to 34, Sections 36 and 37, and Section 44(2) come into force eighteen months from publication.
The Digital Personal Data Protection Rules, 2025 were notified the same day, as G.S.R. 846(E), and Rule 1 follows the same pattern. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4, on consent managers, comes into force one year after publication. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. A corrigendum, G.S.R. 892(E) of 10 December 2025, corrected the wording of the Rules without changing these dates.
Counting from the Gazette date of 13 November 2025, the second stage falls in November 2026 and the third in May 2027. The Gazette issues are dated 13 November 2025. The Press Information Bureau backgrounder of 17 November 2025 refers to the Rules as notified on 14 November 2025.
The obligations a customer would recognise are all in the eighteen-month group: the notice under Section 5, consent under Section 6, the general obligations of a data fiduciary under Section 8, the additional obligations of a Significant Data Fiduciary under Section 10, and the rights of the data principal in Sections 11 to 14. Until that date they are not in force, and it is not correct to describe a bank as in breach of them. The months before it are the implementation window the notifications allow.
Notification G.S.R. 844(E), issued under Section 18 of the Act, establishes the Data Protection Board of India with effect from 13 November 2025, with its head office in the National Capital Region. Notification G.S.R. 845(E), issued under Section 19(1), fixes its strength at four members.
On 6 May 2026 the Ministry of Electronics and Information Technology, by circular F. No. 2(1)/2026-Pers.I, invited applications for the posts of Chairperson and Members, to prepare a panel for a Search-cum-Selection Committee. As at the date this entry was compiled, the Forum has not found a published notification of appointments. Section 33, which provides for penalties, is itself in the eighteen-month group.
Compiled 25 September 2026. This entry records published documents. It is not an assessment of any organisation and carries no regulatory force. To report an error or ask for a reply to be recorded, see how the Casebook is compiled.
Back to the Casebook, or read the notes on the Act in the Bulletin.