Current Implementation Status

The DPDP Rules, 2025 were notified on November 13, 2025 via Gazette Notification G.S.R. 846(E). The Rules contain 23 provisions that operationalise the DPDPA through a staggered enforcement approach. This notification marked a critical milestone in India's data protection journey, providing the procedural framework necessary for the Act's implementation.

Rules 1-2 (preliminary provisions) and Rules 17-21 (Board establishment, composition, powers, and procedures) came into force immediately upon notification. This means the Data Protection Board's institutional framework is already operative. The Board can begin receiving complaints, establishing procedures, and building institutional capacity during the transition period before operational provisions take effect.

Rule 4 (Consent Manager registration): Comes into force 1 year after notification (~November 14, 2026). This gives potential Consent Managers time to prepare registration applications. Rules 3, 5-16, 22-23 (all operational provisions): Come into force 18 months after notification (~May 14, 2027). This includes consent notice requirements, security safeguards, breach notification, data retention, children's data protections, SDF obligations, grievance redressal, cross-border restrictions, and research exemption. See the compliance timelines for a detailed breakdown.

Organisations should use the transition period to: (a) conduct data mapping and gap analysis; (b) update consent mechanisms and privacy notices; (c) implement security safeguards; (d) establish breach notification procedures; (e) review data retention practices; (f) assess SDF designation criteria; (g) set up grievance redressal mechanisms; and (h) train staff on DPDPA obligations. Proactive compliance preparation is strongly recommended given the defined enforcement timelines.