Rule 1

Short title and commencement

Names the Rules and staggers them across three commencement dates rather than switching them on together.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1): These are the Digital Personal Data Protection Rules, 2025.
(2): Rules 1, 2 and 17 to 21 came into force on publication, 13 November 2025. These cover definitions, the constitution of the Board, appointments, and the functioning of its digital office.
(3): Rule 4, on Consent Manager registration and obligations, comes into force one year after publication, on 13 November 2026.
(4): Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication, on 13 May 2027. These carry the bulk of the substantive obligations: notice, security safeguards, breach intimation, retention and erasure, children’s consent, Significant Data Fiduciary duties, Data Principal rights and cross-border transfer.

In practice

This is the rule that sets the real deadline. The Board and its complaint mechanism are already live, but the obligations a business is judged against mostly arrive on 13 May 2027. Anyone counting down to a single DPDP date is counting to that one, with the Consent Manager regime landing six months earlier.

Rule 4Registration and obligations of Consent ManagerSets the route to registration as a Consent Manager, the Board’s power to reject, suspend or cancel it, and where the ongoing obligations live.Rule 6Reasonable security safeguardsTurns the Section 8(5) safeguards obligation into a minimum checklist: encryption, access control, logging, backups, one-year log retention and processor contract terms.Rule 7Intimation of personal data breachSets two clocks after a breach: immediate notice to affected principals and to the Board, then a detailed report to the Board within seventy-two hours.s.1Short title and commencementNames the Act and lets the Central Government bring different provisions into force on different dates.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Rule 1 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next