The DPDP compliance timeline
In short
Rule 1 of the DPDP Rules 2025 sets three commencement groups, expressed as periods from the date of publication of the notification rather than as calendar dates.
- On publication. Rules 1, 2 and 17 to 21.
- One year after publication. Rule 4.
- Eighteen months after publication. Rules 3, 5 to 16, 22 and 23.
The notification, G.S.R. 846(E), is dated 13 November 2025. The commencement notification for the Act, G.S.R. 843(E), carries the same date.
01What each group contains
| Group | Rules | Subject matter |
|---|---|---|
| On publication | 1, 2, 17 to 21 | Short title and commencement; definitions; appointment of the Chairperson and Members; salary and terms of service; procedure for meetings of the Board and authentication of its orders; functioning of the Board as a digital office; terms of service of officers and employees |
| One year | 4 | Registration and obligations of Consent Manager |
| Eighteen months | 3, 5 to 16, 22, 23 | Notice; State processing standards; reasonable security safeguards; intimation of personal data breach; erasure timelines; publication of contact information; verifiable consent for children and for persons with disability; children's data exemptions; Significant Data Fiduciary obligations; rights of Data Principals; transfer outside India; research, archiving and statistical exemption; appeal to the Appellate Tribunal; calling for information |
The first group is about constituting the regulator. The third group is where the compliance programme lives.
02How to describe the timeline without overstating it
Two habits are worth adopting in any document that a regulated buyer will read.
- Attribute the dates. The Rules express commencement as periods from publication. Deriving calendar dates from them is correct arithmetic, but the date belongs to the notification and should be presented that way rather than asserted flatly.
- Do not build urgency on an activation date. The CERT-In six hour obligation applies now, is uncontested, and is a stronger reason to test breach readiness than any future date. A contested date invites the reader to argue about the date instead of the obligation.
03Items that are proposals, not law
A stakeholder consultation reported in January 2026 proposed compressing the eighteen month period and accelerating the notification of Significant Data Fiduciaries. As at the last review date of this page, that is a proposal reported in commentary. It is not an amendment to the Rules, and it should not be cited as a deadline.
Two further items should be read against the gazette rather than against secondary summaries: a corrigendum to the Rules, reported as G.S.R. 892(E) dated 10 December 2025, and any subsequent amendment notification.
04Common questions
Is there a grace period?
None is provided in the Rules. The staged commencement is itself the transition period.
Has the compliance timeline been shortened?
A proposal to compress it was reported in early 2026. Verify against the current gazette position before treating any shortened date as operative.
Which rules can be relied on today?
Rules 1, 2 and 17 to 21, which came into force on publication.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.