The DPDP Rules use phased commencement, not one start date

The Digital Personal Data Protection Rules, 2025 were published in the Gazette on 13 November 2025. The notification says Rules 1, 2 and 17 to 21 commence on publication; Rule 4 begins one year after publication; and Rules 3, 5 to 16, 22 and 23 begin eighteen months after publication. [Source: MeitY Gazette G.S.R. 846(E), 13 November 2025.] The Press Information Bureau announced the notified rules on 14 November 2025. [Source: PIB, 14 November 2025.]

That timetable should be quoted as published; this insight does not interpret how a provision applies to a specific organisation.

Avoid saying “DPDP is live” as though every provision began together. When a buyer raises privacy obligations, state the dated source, describe only what your service actually does, and route legal applicability to the authorised owner.

Relevant programme: Strengthen evidence-led privacy and security conversations with the ASTRA Cybersecurity Sales Specialist programme: https://www.astraready.com/programmes/