The Digital Personal Data Protection Rules, 2025 were published in the Gazette dated 13 November 2025 and commence in three steps. Rules 1, 2 and 17 to 21 applied on publication. Rule 4 applies one year after. Rules 3, 5 to 16, 22 and 23 apply eighteen months after, which includes security safeguards and breach notice.
The three stages in the text
Rule 1 sets the commencement:
- Rules 1, 2 and 17 to 21: on the date of publication in the Official Gazette. These cover the short title, definitions and the Board's own set up, such as pay, meetings and digital office rules.
- Rule 4: one year after publication. This is the rule on Consent Managers.
- Rules 3, 5 to 16, 22 and 23: eighteen months after publication.
Counting from 13 November 2025, one year lands in November 2026 and eighteen months lands in mid May 2027. Treat those as approximate and confirm the exact dates against official notices, since the text counts from the publication date.
What is in the eighteen month group
Most of the duties that touch engineering sit here:
- Rule 3: the notice a Data Fiduciary gives to Data Principals.
- Rule 6: reasonable security safeguards.
- Rule 7: intimation of a personal data breach.
- Rule 8: time period for erasure, plus the one year log retention.
- Rules 10 to 12: verifiable consent for children and persons with disabilities.
- Rule 5: processing for State subsidies, benefits and services.
- Rules 22 and 23: appeals to the Appellate Tribunal and the Central Government's power to call for information.
- Rule 13: extra duties for Significant Data Fiduciaries.
- Rule 14: rights of Data Principals.
- Rule 15: transfer outside India.
What to do with the lead time
Your first task is to find what you hold. Build an inventory of systems that process personal data, who processes it on your behalf and where logs go. Then work through the engineering rules in order of effort:
- Logging and retention changes, because they touch infrastructure and cost.
- Access control and encryption gaps from the rule 6 list.
- A breach runbook that can produce the rule 7 notices.
- Deletion flows that honour rule 8 timing.
- Processor contracts that carry the safeguards down.
What this post does not settle
The Act itself commences on dates the government notifies by notification, and I have not confirmed those dates here. Check the current MeitY notices before you plan against a specific day. Whether you are a Significant Data Fiduciary is a notified status, not something you declare.
Quick check
Do all the rules start at the same time?
No. The Rules have three commencement groups: on publication, one year after, and eighteen months after.
Is security safeguards rule 6 already in force?
Under rule 1(4), rule 6 sits in the eighteen month group. The Act's own duty in section 8(5) is separate, so check its commencement notice too.
Sources
- Digital Personal Data Protection Rules, 2025 (MeitY)
- Digital Personal Data Protection Act, 2023 (MeitY)
Last reviewed: 19 October 2026.
