Discuss the rationale and challenges of the phased implementation of the Digital Personal Data Protection Act, 2023.

The DPDP Act, 2023 (Act No. 22 of 2023) [3] turns the privacy right recognised in Puttaswamy (2017) into a statute. The DPDP Rules, notified on 14 November 2025, bring it into force in phases over 18 months [2]. This sequencing is sound, but it creates gaps that need managing.

Nov 2025 ──► 13 Nov 2026 ──────────► 13 May 2027
DPBI set up   Consent Manager         Rights, Fiduciary duties,
(4 members,   registration            inquiry & penalties
digital)      (dpbi.gov.in)

Fig: Three-phase rollout [1][2]

Rationale

• Institutions before enforcement: a fully digital, 4-member Board came first, with appeals to TDSAT [2]. Penalties come only once the regulator exists [1].
• Compliance runway: the 18-month window [2] gives firms, especially start-ups and MSMEs, time to redesign their data systems.
• Building the consent ecosystem: Consent Managers register first. They must run interoperable platforms and are accountable to the Data Principal [1], in line with India's DPI approach.
• Proven entry bar: the ₹2 crore net-worth requirement [1] matches the RBI Account Aggregator floor of ₹2 crore net owned fund [5].

Challenges

• Rights deferred: citizens can enforce their rights only from 13 May 2027 [1], about 18 months after the Rules were notified.
• Enforcement gap: Consent Managers are licensed from November 2026, but the Board's penalty powers start six months later [1]. Fiduciaries have no duties yet either, so early demand will be thin.
• Capacity strain: the same four members handle registration and, from 2027, inquiries and penalties [1][2].
• Independence deficit: the Central Government constitutes the Board, and PRS flags broad State exemptions as a risk to privacy [4]. Phasing does nothing to cure either.
• Standards vacuum: the Act requires "interoperability" [1], but it may stay fragmented unless a common consent format is prescribed, as RBI does for Account Aggregators [5].
• Market access: the ₹2 crore floor and the Indian-incorporation rule [1] may keep out small innovators.

Phased rollout trades speed for readiness. To make that trade worthwhile, the Board should use the interim period to publish one consent standard, add members, secure longer tenures that are insulated from the executive, and run regulatory sandboxes. A well-staffed, independent Board at full rollout would give practical effect to Puttaswamy and to SDG 16.10 on protecting fundamental freedoms.