The Three Tranches Timeline & Legal Clocks

Section 1(2) of the Act enables staged commencement. On 13 November 2025, the Central Government published GSR 843(E), dividing statutory enforcement into three binding dates.

Tranche 2 · 13 Nov 20261 Year Window

Consent Manager Registration

Mandatory registration of statutory Consent Managers under Section 6(9) and Rule 4.

Days

Hours

Mins

Secs

Tranche 3 · 13 May 2027Core Operating Cliff

General Fiduciary Obligations & Penalties

All core duties live: notice (s.5), consent (s.6), safeguards (s.8(5)), breach (s.8(6)), erasure (s.8(7)), rights & ₹250 cr penalties.

238

Days

Hours

Mins

Secs

Tranche 1 (Immediate) — 13 November 2025

In Force Today

Institutional, interpretive, and rule-making powers are commenced.

Enacted Provisions: Section 1(2), Section 2 (Definitions), Sections 18 to 26 (Data Protection Board), Section 35, Sections 38 to 43, Section 44(1), (3); Rules 1, 2, 17 to 21.

Operating Reality: The Board is legally established (GSR 844(E)), but this does not activate deferred inquiry or penalty powers for general fiduciary non-compliance until Tranche 3.

Tranche 2 (One Year) — 13 November 2026

1-Year Staging

Consent Manager ecosystem registration and governance go live.

Enacted Provisions: Section 6(9), Section 27(1)(d), Rule 4.

Operating Reality: Every person acting as a Consent Manager must be registered with the Board. Section 27(1)(d) addresses breach of Consent Manager registration conditions.

Tranche 3 (18 Months) — 13 May 2027

Core Operating Cliff

The entire substantive compliance framework becomes enforceable. The cliff has no bedding-in period.

Enacted Provisions: Sections 3 to 5, Section 6(1) to (8), (10), Sections 7 to 10, Sections 11 to 17, Sections 28 to 34, 36, 37; Rules 3, 5 to 16, 22 to 23.

What Becomes Live: Applicability, Notice (Section 5 / Rule 3), Affirmative Consent (Section 6), Legitimate Uses (Section 7), Reasonable Safeguards (Section 8(5)), Breach Intimation (Section 8(6)), Purpose-completion erasure (Section 8(7)), Children's prohibitions (Section 9), Significant Data Fiduciary duties (Section 10), Data Principal Rights (Sections 11 to 14), and Penalties up to ₹250 Crore (Section 33 + Schedule).

The Precommencement Planning Principle

The decisions that matter are precommencement decisions. An enterprise must design, build, test, and audit its Tranche 3 controls before 13 May 2027 so that on day one it is demonstrably operating them rather than scrambling to catch up.

Read Chapter 2: Act, Rules & Commencement Register