Rule 1: Short title and commencement

This rule establishes the official title of the regulations as the Digital Personal Data Protection Rules, 2025. It also provides a specific, staggered timeline for when the various rules actually become legally enforceable. Instead of starting all at once, the rules are divided into three different starting dates based on when they are published in the Official Gazette.\n\nThe first group of rules takes effect immediately on the date of publication. This immediate group includes Rules 1 and 2, along with Rules 17 through 21.\n\nThe remaining rules give affected parties more time to prepare before they come into force. Rule 4 will take effect exactly one year after the date the rules are published in the Gazette. Finally, the largest group of rules, which includes Rule 3, Rules 5 through 16, Rule 22, and Rule 23, will take effect eighteen months after the publication date.

Key points

• The official name of the rules is the Digital Personal Data Protection Rules, 2025 (1).
• Rules 1, 2, and 17 through 21 take effect immediately upon their publication in the Official Gazette (2).
• Rule 4 takes effect exactly one year after the publication date (3).
• Rules 3, 5 through 16, 22, and 23 take effect eighteen months after the publication date (4).

Common misreadings

• Readers might assume all rules take effect immediately upon publication, but the text clearly staggers the effective dates over an eighteen-month period.