# DPDP Rules 2025 commencement dates: when each rule applies

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/notification-and-phased-commencement/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Notification and phased commencement

- Notified by the **Ministry of Electronics and Information Technology (MeitY)** on
  **13 November 2025**, published **14 November 2025**.
- **23 Rules and 7 Schedules.**
- MeitY simultaneously notified commencement of the Act's provisions in three tranches, keyed to
  **14 November 2025**, **14 November 2026**, and **14 May 2027**.

| Tranche | Effective | What comes into force |
|---|---|---|
| Immediate | **14 November 2025** | Rules 1, 2, and 17 to 21. Definitions, plus the machinery to constitute and run the Data Protection Board (appointment of Chairperson and Members, salary and service terms, Board meetings, digital-office functioning, Board staff). |
| 12 months | **14 November 2026** | **Rule 4**, registration and obligations of Consent Managers. |
| 18 months | **14 May 2027** | **Rules 3, 5 to 16, and 22 to 23.** This is the tranche that carries essentially every substantive business obligation: notice, security safeguards, breach intimation, retention and erasure, contact-person publication, children's consent, SDF duties, Data Principal rights machinery, transfers, research exemption, appeals, and calling for information. |

**The practical consequence, and the thing to tell every client:** as of the 2026 tranche, the
operative compliance duties for ordinary Data Fiduciaries are **not yet enforceable**. The date
that matters for a build plan is **14 May 2027**. Do not describe Rules 3 or 5 to 16 as currently
binding. Do describe them as the fixed target the programme must hit.

Note the sequencing problem worth flagging in advice: Consent Manager registration bites at
14 November 2026, though the Board that registers them has to be constituted first.