Understanding the phased commencement model
Rather than enforcing all provisions simultaneously overnight, the Central Government structured the DPDP framework through phased commencement windows. This deliberate sequencing ensures foundational administrative mechanisms are established before corporate enforcement begins.
The three operational phases
| Rollout Phase | Effective Window | Key Statutory Provisions Coming Into Force |
|---|---|---|
| Phase 1: Administrative Foundations | Immediate (upon publication) | Core statutory definitions, transitional provisions, establishment of the Data Protection Board of India (DPBI), appointment procedures, and administrative inquiry frameworks. |
| Phase 2: Consent Managers & Registration | 12 Months from notification | Registration requirements, technical interoperability standards, and oversight frameworks for registered Consent Managers under Section 6(7). |
| Phase 3: Substantive Fiduciary Obligations | 18 Months from notification | Full statutory enforcement for Data Fiduciaries: Section 5 itemised notices, Section 6 consent records, Section 8 general fiduciary safeguards, Section 12/13 Data Principal rights fulfillment, Section 8(7) retention limits, and Rule 7 mandatory 72-hour personal data breach reporting. |
Strategic recommendation for business leaders
While substantive enforcement operates on an 18-month timeline, waiting until the final months creates intense engineering debt and procurement bottlenecks. Re-architecting legacy database schemas for automated deletion, executing DPAs with hundreds of suppliers, and establishing audited rights workflows typically takes 6 to 9 months of active development.