Notification and phased commencement

• Notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025, published 14 November 2025.
• 23 Rules and 7 Schedules.
• MeitY simultaneously notified commencement of the Act's provisions in three tranches, keyed to 14 November 2025, 14 November 2026, and 14 May 2027.

Tranche	Effective	What comes into force
Immediate	14 November 2025	Rules 1, 2, and 17 to 21. Definitions, plus the machinery to constitute and run the Data Protection Board (appointment of Chairperson and Members, salary and service terms, Board meetings, digital-office functioning, Board staff).
12 months	14 November 2026	Rule 4, registration and obligations of Consent Managers.
18 months	14 May 2027	Rules 3, 5 to 16, and 22 to 23. This is the tranche that carries essentially every substantive business obligation: notice, security safeguards, breach intimation, retention and erasure, contact-person publication, children's consent, SDF duties, Data Principal rights machinery, transfers, research exemption, appeals, and calling for information.

The practical consequence, and the thing to tell every client: as of the 2026 tranche, the operative compliance duties for ordinary Data Fiduciaries are not yet enforceable. The date that matters for a build plan is 14 May 2027. Do not describe Rules 3 or 5 to 16 as currently binding. Do describe them as the fixed target the programme must hit.

Note the sequencing problem worth flagging in advice: Consent Manager registration bites at 14 November 2026, though the Board that registers them has to be constituted first.