India’s DPDP Act: what commences when

Key facts at a glance

Commencement timeline

One live caveat. The government has been reported as considering a shorter compliance timeline than the eighteen months notified. Nothing has been formally amended. Plan against May 2027 and treat an earlier date as a risk rather than a certainty.

Who is in scope?

Scope follows the role you play and whether the processing touches people in India. It does not follow company size, sector or place of incorporation. The law uses two terms that everything else is built on: the data fiduciary decides why and how personal data is used, and the data principal is the person the data is about.

What you actually have to do

Strip away the legal language and Phase 3 comes down to six things, plus a separate and non-negotiable rule on children.

Consent is not the only door in

Most explanations of this law read as though consent is the only lawful basis. It is not. The Act sets out specific legitimate uses that permit processing without asking each time: data a person voluntarily provided for a stated purpose and has not objected to, processing needed to deliver a state benefit or service, compliance with a court order or a legal obligation, and response to a medical emergency or a threat to public health.

These are narrow and enumerated, not a general route around consent. They matter for the ordinary case where a customer hands over a phone number to receive a delivery update, and they are worth knowing before you build a consent flow around every interaction you have.

If you process data for an overseas client

Worth knowing if you run BPO, ITeS, SaaS backend or any outsourced processing. Where an Indian business processes the personal data of people outside India under a contract with a company outside India, most of the Act’s obligations do not apply to that work. The notice, consent and rights machinery is exempted.

Two cautions. The exemption is scoped to that specific arrangement, so mixed operations serving both Indian customers and overseas clients need the boundary drawn carefully and documented. And your client’s own obligations under their law, usually GDPR, reach you through the contract whatever DPDP says.

It is not only customer data

Most conversations about this law start and stay with customers, because that is where the marketing team’s data sits. Two other places carry as much exposure and get almost none of the attention.

HR and payroll

Employees are data principals. The Act gives employers a specific shortcut: employment purposes, and safeguarding the employer from loss or liability, are a legitimate use that does not require consent. That covers most of what payroll, attendance and performance systems already do.

It is not a blanket exemption. Security safeguards, accuracy, deletion when the purpose ends and a published grievance contact all still apply. An HR system holding PAN numbers, bank details, biometric attendance or insurance records attracts the same 72-hour clock and the same penalty ceilings as a customer database. In practice it is often the least audited store in the company, precisely because everyone assumes the employment relationship puts it outside the law.

Vendor and supplier files

Most of a vendor file is company data. A GSTIN, a bank account, a registered address: none of that belongs to a natural person and none of it is in scope. But nearly every vendor file also carries the name, phone number and email of the person you actually deal with, and KYC documents for a proprietor or partner in a smaller firm. Legal and supply chain teams tend to treat the whole file as a business record and miss the slice inside it.

A freelancer or individual contractor paid with TDS deducted does not fit that pattern at all. There is no company wrapper, so the entire record is personal data rather than a slice of one. It is tempting to lean on the employment ground that covers payroll, but that ground is written for employees and whether it stretches to someone not on your payroll is genuinely unsettled rather than a safe default. Two other grounds hold up better: the freelancer voluntarily provided the PAN and bank details for the specific purpose of being paid, and retaining the records to meet TDS filing obligations is processing necessary to comply with a law in force. Retention resolves the same way, because the default duty to delete gives way where another law requires keeping.

Vendors who process data for you

A payroll bureau, a background verification firm, a recruitment platform, a logistics partner handling delivery data. That is not a vendor record question, it is a processor question. The Act makes you responsible for what happens to that data even though someone else’s system holds it, and it requires a real contract carrying security obligations equivalent to your own rather than a purchase order that is silent on data. A well-drafted MSA signed before this law existed usually says none of it, and renewal is the practical moment to fix that.

Where the data can sit

The most common question we get is whether personal data of Indian customers has to stay on Indian servers. It does not, as a general rule. Section 16 of the Act and Rule 15 of the Rules work as a negative list: data may be transferred to any country except those the Central Government restricts by notification. No restricted list has been published.

That is the opposite of an adequacy regime. Running your site, CRM or mail on infrastructure outside India is permitted, and most mid-market Indian companies do exactly that without a problem.

Three qualifications. The government may bar offshore transfer of specified categories for organisations designated as significant data fiduciaries, though no categories have been notified. Sectoral rules survive untouched, so RBI payment data localisation and the equivalent SEBI and IRDAI requirements still bite in those sectors. And this commences on 13 May 2027 with everything else.

The reason the confusion persists is that the 2019 and 2021 drafts of the Bill did propose mandatory localisation for sensitive data. It was dropped. A good deal of published commentary is still describing a version of the law that was never enacted. What you do owe your overseas providers is a processor arrangement that carries your obligations, which is a contract question rather than a hosting one.

What it costs to get wrong

The Schedule to the Act attaches ceilings to specific failures rather than to the law in the abstract. These are maximums and the Data Protection Board of India decides each case after an inquiry, but they establish the scale the government intends.

Three points that matter more than the headline number. The ceilings attach per failure, so a single incident handled badly can engage more than one line of the Schedule. Enforcement runs exclusively through that regulator, so your exposure is regulatory rather than litigation driven. And penalties are paid into the Consolidated Fund of India rather than to the person whose data was affected: the Act gives no compensation route through the Board. Civil and consumer claims remain available, but they run through the ordinary courts rather than through this law.

What is still unsettled

The Data Protection Board of India is established, with membership set at four, but it has not yet published decisions. Until it rules on cases, everyone is reading the text of the law rather than a body of precedent. That includes us. Where this page says what something is likely to mean in practice, that is a reading and not a settled answer.

Significant data fiduciary designation is made by government notification rather than against a published threshold, so no organisation can confirm its own status in advance. Most mid-market companies will not be designated. That is a judgement rather than a fact, and it is worth a straight conversation instead of an assumption.

Consent manager registration does not open until November 2026. Anyone offering you a registered DPDP consent manager today is offering something that cannot yet exist in that form.

What to do between now and May 2027

Eight months sounds like time. It is, if you start now. Most remediation plans fail because they begin with the privacy policy, which is the output rather than the input.

The starting point is the same in every case: work out what personal data you actually hold, where it lives, who touches it and which vendor operates the system it sits in. Everything else, from rewriting notices to answering a rights request inside ninety days, depends on having that list. Most companies find the gap is wider in the details than in the headline principles, which everyone already agrees with.

Where the fix reaches the data model and the integration layer rather than the policy alone, that is integration work, and it takes longer than a legal review.

Frequently asked questions