DPDP Act vs DPDP Rules: What Founders Must Understand First
A founder-focused guide to the DPDP Act, the 2025 Rules, phased commencement and the operational work that should begin before the main duties commence.
The Act creates the legal framework; the Rules supply operational detail; the commencement notification decides when each provision is enforceable.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
The Act covers digital personal data processed in India and can extend to processing outside India connected with offering goods or services to individuals in India, subject to scope and exemptions.
A business may be a Data Fiduciary for purposes it determines and use Data Processors for work performed on its behalf; outsourcing does not remove governance responsibility.
The Data Protection Board of India was established by Gazette notification, while appointment and operating processes are separate implementation steps.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- The Act covers digital personal data processed in India and can extend to processing outside India connected with offering goods or services to individuals in India, subject to scope and exemptions.
- A business may be a Data Fiduciary for purposes it determines and use Data Processors for work performed on its behalf; outsourcing does not remove governance responsibility.
- The Data Protection Board of India was established by Gazette notification, while appointment and operating processes are separate implementation steps.
- Readiness should connect lawful purpose, notice, consent or legitimate use, security, processor contracts, rights, retention and breach response.
The five-point review
| Check | What to examine |
|---|---|
| Scope | Entities, products, people and digital personal data. |
| Role | Data Fiduciary, Processor, Principal or Consent Manager. |
| Legal route | Consent or specified legitimate use. |
| Timing | Provision-specific commencement date. |
| Control | Owner, system, evidence and workflow. |
Practical example
A startup states in June 2026 that every DPDP right and breach rule is already legally operative. A safer position is to state the phased commencement accurately, comply with current IT and sector rules, and build the scheduled DPDP processes before their effective dates.
How to apply the framework
Create a provision-to-process matrix showing effective date, owner, affected systems, existing control, gap and target. This prevents both premature legal claims and last-minute implementation.
Separate the privacy programme from general cybersecurity. Security overlaps with privacy, but notices, purpose, consent, rights and retention require business ownership.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review scope, role and legal route together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Map the commencement notification.
- Identify fiduciary activities.
- Inventory processors.
- Build notice and rights roadmap.
- Design breach controls.
- Report readiness to management.
Evidence to keep
- Act, Rules and commencement matrix
- Entity and role map
- Data inventory
- Processor register
- Implementation plan
Warning signs
- All provisions described as already effective
- Project limited to a privacy-policy rewrite
- No processor oversight
- No business owner
- Launch without data-flow review
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.