Somewhere in India today, a company lawyer is telling a boardroom: "The DPDP Act isn't really in force yet — we have time." Somewhere else, a consultant is telling a different boardroom: "You're already violating a live statute." Both are pointing at the same Gazette notifications, both are half-right, and each half-truth is dangerous alone.

This episode decodes the phased commencement precisely. Why an Act passed in August 2023 stayed dormant for over two years, and what actually happened in November 2025. Wave one, live today: the definitions, the Data Protection Board, its digital-office design and the appeal architecture to TDSAT. Wave two, this November: the Consent Manager registration framework activates. Wave three, 13 May 2027: everything else — notices, consent, security safeguards, breach reporting clocks, retention, children's data, rights and grievance machinery.

Then what the calendar actually means for behaviour. Why "largely not enforceable yet" comes with three corrections: the IT Act ecosystem, CERT-In directions and sectoral regulators never paused; enterprise contracts are already writing DPDP-readiness into vendor agreements, making the standard commercially binding regardless of the Gazette; and every unmapped database you accumulate now is remediation work bought at tomorrow's prices. Why the eighteen-month runway is a preparation period, not a grace period — and why "we started in April" will be an aggravating fact before the Board, not a defence. The three myths, named and dismantled. Per-audience quarterly actions for enterprises and SMEs, including the contract-clause check I'll wager at least one of your three largest customer agreements fails. And the four-channel regulatory watch that hears the next wave before your competitors do.

DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon.

I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality.

Keywords: DPDP timeline, DPDP enforcement date, May 2027 deadline, DPDP Rules commencement, phased implementation, Consent Manager November 2026, Data Protection Board, CERT-In, DPDP compliance deadline, data protection India.

Connect with me:
💼 LinkedIn: https://www.linkedin.com/in/hskapoor/
📄 Facebook: https://www.facebook.com/satarkintelligence
▶️ YouTube: https://www.youtube.com/@DPDPdaily
🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111
𝕏 X: https://x.com/TheOtherKapoor

One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon.

This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.