In simple words
This rule gives the Rules their name and start dates. Rules 1, 2 and 17 to 21 started on publication. Rule 4 starts one year later. Rules 3, 5 to 16, 22 and 23 start eighteen months later.
- What this means for you
- Most protections in the Rules apply from 13 May 2027.
- What this means for businesses
- Plan for Consent Manager rules from 13 November 2026 and most compliance duties from 13 May 2027.
- Everyday example
- Rule 7 on breach intimation applies from 13 May 2027, not from the day the Rules were published.
Who it applies to
Everyone reading the Rules.
Related sections and Schedules
Official textas notified
Source: MeitY copy of the Gazette, page 24. Printed dashes are shown as colons; the wording is unchanged.
(1) These rules may be called the Digital Personal Data Protection Rules, 2025.
(2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette.
(3) Rule 4 shall come into force one year after the date of publication of this Gazette.
(4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
Corrigendum. G.S.R. 892(E) dated 10 December 2025 corrects this text as notified:
- rule 1(3) and (4): for “of this Gazette” read “in the Official Gazette”