Gazette
DPDP Rules notification: what changed
The instruments behind the DPDP Rules, the three start dates, and where to read each rule in depth.
Short answer
The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025, with the commencement notification G.S.R. 843(E), and the Press Information Bureau announced them on 14 November 2025. Rule 1 starts the Rules in three groups: on publication, on 13 November 2026 (Rule 4) and on 13 May 2027 (Rules 3, 5 to 16, 22 and 23). A corrigendum, G.S.R. 892(E) of December 2025, corrects the English text of the Rules.
The instruments, in order
| Instrument | Number | Date | What it does |
|---|---|---|---|
| Digital Personal Data Protection Act, 2023 | Act No. 22 of 2023 | 11 August 2023 | The Act |
| Commencement notification | G.S.R. 843(E) | 13 November 2025 | Brings the Act's provisions into force in three groups (s.1(2)) |
| Digital Personal Data Protection Rules, 2025 | G.S.R. 846(E) | 13 November 2025 | The Rules: 23 rules and seven Schedules |
| Press Information Bureau release | None | 14 November 2025 | The Government's announcement of the Rules |
| Corrigendum | G.S.R. 892(E) | December 2025 | Corrects the English text of the Rules |
| Removal of Difficulties Order, 2026 | S.O. 5458(E) | 6 October 2026 | Two editorial changes to the Act |
846(E) is the Rules; 843(E) is the commencement notification
Both carry the date 13 November 2025, so they are easy to mix up. G.S.R. 846(E) is the text of the DPDP Rules, 2025. G.S.R. 843(E) brings provisions of the Act into force.
Cite G.S.R. 846(E) when you quote a rule. Check G.S.R. 843(E) when you need to know whether a section of the Act is in force. For example, s.44(2), which omits section 43A of the IT Act, was not in the group that commenced on 13 November 2025, so the SPDI regime continues until s.44(2) commences.
Three start dates under Rule 1
| Date | Rules in force | What they cover |
|---|---|---|
| 13 November 2025, on publication | Rules 1, 2 and 17 to 21 | Definitions and the Data Protection Board's set-up |
| 13 November 2026, one year later | Rule 4 | Consent Manager registration |
| 13 May 2027, eighteen months later | Rules 3, 5 to 16, 22 and 23 | Notice, consent, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances |
The Board's set-up rules have been in force since 13 November 2025, but as of 4 November 2026 no Board members have been appointed. The Rule 4 application form is not published yet.
The corrigendum of December 2025
G.S.R. 892(E), published in December 2025, corrects the English text of the Rules. Read the Rules together with the corrigendum so that you quote the corrected text. When a policy, notice or contract quotes a rule, cite G.S.R. 846(E) and check the corrigendum.
How the Rules shape your 2026 to 2027 programme
- Until 13 November 2026: if you plan to be a Consent Manager, read Rule 4 and the First Schedule and watch for the application form.
- Until 13 May 2027: prepare for Rules 3 and 5 to 16: notice, security safeguards, breach intimation, retention, children's data, SDF duties, rights and grievances. Our May 2027 post has a month-by-month plan.
- From 13 May 2027: appeals go to the Appellate Tribunal, the Telecom Disputes Settlement and Appellate Tribunal (Rule 22, s.29), and Rule 23 covers calling for information from a Data Fiduciary or intermediary.
Map to the Rule explainers
All 23 rules and the Schedules in one place.
Rule 4Consent Manager registrationRegistration, the First Schedule and the 13 November 2026 start.
Rule 7Breach intimationWithout delay to both audiences, then a 72-hour detailed report.
Rule 11Persons with disabilityVerifying a lawful guardian before accepting consent.
Rule 12Children's data exemptionsThe Fourth Schedule classes and purposes, within their conditions.
Rule 13Significant Data FiduciariesYearly DPIA and audit, algorithmic due diligence, data kept in India.
Rule 14Rights of Data PrincipalsPublishing how to make requests, and the 90-day grievance cap.
How TruePrivacy helps
TruePrivacy has a module for each main duty in these rules: notices for Rule 3, breach management for Rule 7, retention for Rule 8, children's data for Rule 10, the SDF workspace for Rule 13 and rights requests for Rule 14.
Audit, access and consent logs are kept for at least one year (Rule 6, Rule 8(3)), and the DPDP checklist gives a readiness view of each control.
Is G.S.R. 843(E) the DPDP Rules?
No. The DPDP Rules, 2025 are G.S.R. 846(E). G.S.R. 843(E) is the commencement notification for the Act, issued the same day.
When were the DPDP Rules notified?
On 13 November 2025, as G.S.R. 846(E). The Press Information Bureau announced them on 14 November 2025.
What does the corrigendum G.S.R. 892(E) do?
It corrects the English text of the Rules. It was published in December 2025.
When do the core rules start?
On 13 May 2027, when Rules 3, 5 to 16, 22 and 23 come into force (Rule 1).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin