Short title and commencement
Official name of the Rules and when each rule comes into forceThese are formally called the Digital Personal Data Protection Rules, 2025.
Download full Rules (PDF)In plain English
These are formally called the Digital Personal Data Protection Rules, 2025. Rules 1, 2, and 17-21 take effect immediately on publication. Rule 4 (Consent Managers) starts one year later. Rules 3, 5-16, 22, and 23 start eighteen months after publication - giving organisations time to prepare.
Key points
- Rules 1, 2, 17-21: effective on publication (13 Nov 2025)
- Rule 4 (Consent Managers): effective 13 Nov 2026
- Rules 3, 5-16, 22, 23: effective 13 May 2027
This rule gives effect to Section 40 of the Digital Personal Data Protection Act, 2023.
Read the parent sectionOfficial rule text
Reproduced from the Gazette notification (G.S.R. 846(E), 13 November 2025).
1. Short title and commencement. - (1) These rules may be called the Digital Personal Data Protection Rules, 2025. (2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette. (3) Rule 4 shall come into force one year after the date of publication of this Gazette. (4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.