Rule 1: Short Title and Commencement
Rule 1 doesn't create any compliance obligation of its own — it names the Rules and sets the exact dates on which every other rule comes into force. It's the single most important rule for building a realistic compliance timeline.
Quick summary
What Rule 1 says
- Sub-rule (1) — gives these rules their short title: the Digital Personal Data Protection Rules, 2025.
- Sub-rule (2) — Rules 1, 2 and 17 to 21 come into force on the date the Rules were published in the Official Gazette: 13 November 2025.
- Sub-rule (3) — Rule 4 comes into force one year after that publication date: 13 November 2026.
- Sub-rule (4) — Rules 3, 5 to 16, 22 and 23 come into force eighteen months after that publication date: 13 May 2027.
Breaking it down
Think of Rule 1 as a light switch with three separate timers, each turning on a different group of rules.
Phase 1 — setting up the regulator, not regulating you. On 13 November 2025, the Data Protection Board of India came into existence as a functioning body — its Chairperson and Members can be appointed, it can hold meetings, and it can operate as a digital office. None of this creates work for an ordinary business. It's the government building the referee before the match starts.
Phase 2 — a narrow, optional date. 13 November 2026 only matters if your organisation actually wants to become a Consent Manager — a registered intermediary platform that lets individuals manage their consent across multiple companies from one place. If that's not your business model, this date has no effect on you at all.
Phase 3 — the real deadline. 13 May 2027 is the date that matters to almost every organisation that collects or processes personal data of individuals in India. This is when the substantive obligations — notice, consent, security, breach reporting, and the rest — actually start applying.
Why this rule matters
It's tempting to skip past Rule 1 as legal housekeeping. But it's arguably the most operationally useful rule in the set: it's the only one that tells you when you need to be ready, letting a compliance team prioritise instead of trying to do everything on day one.
Real-world example
- 13 November 2025: Nothing changes operationally for Chotu Mart. The Data Protection Board was simply being constituted in the background.
- 13 November 2026: If Chotu Mart were separately planning to launch a consent-management product for other apps, this is the date it could apply for registration as a Consent Manager. As a grocery app, this date passes with no action needed.
- 13 May 2027: This is the date that matters. Chotu Mart's signup-form notice, consent flow, breach-response plan and rights-request process all need to be compliant by this date.
Who needs to care about this rule
- Compliance and legal teams — for building a realistic project timeline.
- Organisations considering becoming a Consent Manager — need to track 13 November 2026 specifically; see Rule 4.
- Anyone dealing with the Data Protection Board — it has been a functioning, contactable body since 13 November 2025.
Common questions
Does Rule 1 mean the DPDP Act itself isn't in force yet?
If most obligations don't apply until 13 May 2027, why start compliance work now?
Is 13 May 2027 a fixed date, or could it change?
Related rules
Rule 2 — Definitions
Continue to the next rule in sequence.
Read Rule 2Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rulesDPDP Updates
The fuller timeline, including how the Rules' commencement connects to the Act's own enactment.
See the timeline