India · Technology
India's digital privacy rules have three commencement phases
The Digital Personal Data Protection Rules, 2025 use three triggers measured from their Gazette publication. Board-related rules start at publication, Consent Manager registration follows after one year, and most other obligations follow after 18 months.
Sources checked
- At publication1 and 2
Title, commencement and definitions Source 1
- At publication17 to 21
Board appointments, administration and operation Source 1
- One year after publication4
Registration and obligations of Consent Managers Source 1
- 18 months after publication3
Notices by Data Fiduciaries Source 1
- 18 months after publication5 to 16
Other operational rules including safeguards and breach intimation Source 1
- 18 months after publication22 and 23
Government information requests and certain other administrative provisions Source 1
Rules within the 18-month group cover different duties, including notices, safeguards and reporting breaches.
The Gazette groups rules by their commencement
Rule 1 identifies the rules that start at publication, one year later and 18 months later. The immediate group includes definitions and the procedures for setting up and operating the Board. Rule 20 describes the Board as a digital office. Source 1
Consent Managers have a separate one-year trigger
Rule 4 provides a registration process with the Data Protection Board and points to the conditions and duties in the First Schedule. The schedule describes a platform that people can use to give or withdraw consent and access their consent records. Source 1
Notices and operational duties follow at 18 months
Rule 3 covers clear information about the data and the specified purpose of processing. Rules 6 and 7 cover security safeguards and what a Data Fiduciary must tell affected people and the Board after becoming aware of a breach. Those rules sit in the later commencement group. Source 1 Source 2
The publication date matters for the schedule
The rules express the triggers as intervals from publication in the Official Gazette. The date printed in the notification and the date of the ministry's public summary are recorded separately. The table uses the Gazette wording and describes the rules' phase-in rather than a deadline for a particular organisation. Source 1 Source 2