Rule 1 — Short Title and Commencement

Rule 1(1) names the Rules — the Digital Personal Data Protection Rules, 2025. Everything that matters is in sub-rules (2) to (4), which don't switch the Rules on all at once. They stagger commencement into three tiers, tied to the date the Rules were published in the Official Gazette: 13 November 2025. Treating the DPDP Rules as a single compliance deadline misses that most of the substantive obligations aren't due yet — and misses which handful of provisions already are.

Tier one — live from day one: Rule 1(2)

Rules 1, 2 and 17 to 21 came into force on 13 November 2025, the date of publication itself. That set covers this rule and Rule 2's definitions, plus the machinery for standing up the Data Protection Board — appointing its Chairperson and Members, the Board's meeting procedure, its functioning as a digital office, and staffing terms for its officers and employees. None of this touches how a Data Fiduciary handles personal data day to day; it's institution-building, done first so the Board exists before it has anything to enforce.

Tier two — twelve months later: Rule 1(3)

Rule 4, on registration and obligations of Consent Managers, comes into force one year after publication — around 13 November 2026. Until that date arrives, there's no mechanism by which the Board can actually register anyone as a Consent Manager, regardless of how ready an applicant's platform is. Rule 4 itself walks through what that registration process requires once it does switch on.

Tier three — eighteen months later: Rule 1(4)

Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication — around 13 May 2027. This is where almost everything an organisation associates with "DPDP compliance" actually lands: notice content under Rule 3, government processing without consent under Rule 5, security safeguards under Rule 6, breach intimation under Rule 7, retention and erasure timing under Rule 8, the published contact point under Rule 9, verifiable consent for children and persons with disability under Rules 10 and 11, child-data exemptions and Significant Data Fiduciary duties under Rules 12 and 13, Data Principal rights under Rule 14, and cross-border transfer conditions under Rule 15. May 2027 is the date that actually matters for most compliance programmes — not November 2025.

Why this matters in practice

The practical risk in Rule 1 isn't misreading any single date — it's collapsing three different deadlines into one and either over-reacting to what's live now or under-reacting to what's coming. An organisation that reads "the DPDP Rules are notified" and assumes Rule 3's notice requirements are already binding is running ahead of the law; one that reads the same headline and assumes it has until some vague future date to think about Rule 6's security safeguards is running behind it — the eighteen-month clock is already ticking, and building the safeguards Rule 6 requires takes longer than most organisations expect. There's a related timing point worth knowing: Section 44(2)(a) of the Act repeals Section 43A of the IT Act, 2000 — the provision the existing SPDI Rules sit under — but that repeal only takes effect on this same eighteen-month schedule. Until May 2027, the SPDI Rules keep operating in parallel with whatever DPDPA provisions are already live.

Illustration: a mid-sized fintech reviewing its DPDP readiness in early 2026 finds that its Board-facing governance obligations aren't live yet, that it can't register as or rely on a licensed Consent Manager until November 2026, and that its actual compliance deadline for notice, consent, security and rights obligations is May 2027 — roughly eighteen months of runway from publication, not zero.

How Rule 1 connects to the rest of the Rules

Rule 1 doesn't impose any obligation of its own — it's the schedule that tells you when every other rule starts to bind. Rule 2's definitions are live alongside it because later rules need the vocabulary in place first. Rule 4's Consent Manager registration sits on its own middle timeline because the Board needs a working registration process before any applicant can be assessed against it. And the eighteen-month tier is where the bulk of an organisation's actual work sits — which is also why it's the tier worth starting on now, well before the deadline arrives.