Separate notification from commencement
The DPDP framework has phased commencement. G.S.R. 843(E) brings specified institutional and other provisions of the Digital Personal Data Protection Act, 2023 into force on publication, a further group after one year, and the principal processing duties and individual-rights provisions after eighteen months. As at 3 November 2026, the later groups remain future requirements under that notification. It would be inaccurate to describe all substantive duties as already in force. Source: G.S.R. 843(E), commencement notification.
Read the Rules alongside the Act
Rule 1 of the Digital Personal Data Protection Rules, 2025 also separates immediate, one-year and eighteen-month commencement. The later provisions address matters including notices, safeguards and breach reporting. Rule 3 describes a notice that can be understood independently and explains the data and purposes involved. These provisions are relevant to preparation, but their future commencement must remain clear. Source: G.S.R. 846(E), rules 1, 3, 6 and 7.
Prepare from the actual data flows
A useful business review starts with what happens in practice. List the forms, customer systems, staff processes and vendors through which personal data moves. Record why each field is collected, who receives it and who can answer a query about it. This is a proposed preparation exercise, not a statement that every business has identical obligations.
Then compare the website notice and vendor agreements with that record. A notice cannot accurately describe a form if it omits the third-party service receiving submissions. Equally, a contractual promise should not describe a security measure the business has not checked.
Illustrative example
A business introduces a contact form using an external delivery provider. Before drafting its notice, it should identify the fields, destination mailbox, provider and browser storage actually used. It can then explain that flow in plain language and decide whether each optional field is necessary. This hypothetical example is not a completed client matter or a compliance certification.
Keep the implementation plan under review
Assign responsibility for confirming commencement, assessing applicability and updating documentation as the business changes. A readiness plan should label future requirements separately from present duties, including duties under other applicable laws and contracts. This note does not conclude that a business is compliant or exempt, and it does not replace advice on the particular data processing.