When does the Act actually take effect?

It is being brought into force in stages rather than all at once. The first stage took effect on 13 November 2025, covering the establishment of the Data Protection Board of India. The Consent Manager framework follows on 13 November 2026. The substantive obligations that most organisations must comply with, including consent requirements, notice, security safeguards and breach reporting, take effect on 13 May 2027. That staged timeline is deliberate: it gives organisations a defined runway to prepare rather than a single cliff edge.