DPDP Rules 2025: Commencement and Engineering Work
Map the notified DPDP Rules to their commencement groups. Separate Consent Manager requirements from application consent, rights, and breach workflows.
Map DPDP implementation work to the commencement provision that applies to each duty. Rule 4 concerns Consent Managers. It does not make every application's general consent workflow effective on the same date.
The notified Rules use immediate, one-year and eighteen-month groups. Review the Act's commencement notifications separately and check for later changes. Build a duty register rather than treating one headline date as the entire compliance plan.
Read the rule-specific schedule
| Rule group | Timing under Rule 1 | Planning implication |
|---|---|---|
| Rules 1, 2 and 17–21 | Gazette publication | Establish the applicable procedural framework |
| Rule 4 | One year after publication | Review Consent Manager registration and obligations |
| Rules 3, 5–16, 22 and 23 | Eighteen months after publication | Prepare the relevant notice, safeguards, breach and other workflows |
Use the Gazette text for the exact groups and legal schedule. A general statement that “consent starts in November 2026” can confuse Consent Manager rules with application duties. Final DPDP Rules, Rule 1.
The government's backgrounder describes phased implementation. Use it for context while keeping the actual notification as the authority for a specific provision. Official DPDP backgrounder.
Build a duty and evidence register
For each relevant provision, record its source, commencement basis, applicability decision, implementation owner and evidence. Separate an organization's legal decision from a software control.
| Workstream | Evidence the team can prepare |
|---|---|
| Processing map | Data categories, purposes, recipients and responsible entities |
| Notice and consent | Versioned text, recorded choices and withdrawal behavior |
| Security | Reviewed access controls, monitoring and recovery tests |
| Rights requests | Intake, identity checks, routing and completion evidence |
| Retention | Data-specific rules and tested cleanup paths |
| Incident response | Owners, timestamps, notification drafts and an exercise record |
Choose evidence that explains the real system. A framework checklist cannot establish that a control works.
Distinguish consent mechanisms
An application privacy choice, a DigiLocker document grant and a registered DPDP Consent Manager have different roles. A token scope or approved provider relationship does not establish the entire privacy process.
Use the Consent Manager guide to separate those actors. Use the DigiLocker consent guide for its requester flow.
Test completion across systems
An account marked deleted may still have personal data in application databases, processors or backups. Map the actual request and retention rules to those locations. Record what remains and why.
Similarly, an authentication event may show who signed in without showing what business record they opened. Build the missing application evidence where required. Rights-request engineering, audit boundaries.
For a breach exercise, use the two notification tracks. Check the applicable commencement and any other duties before applying a deadline to a real incident.
Review the identity work with NamoID
NamoID engineers can help review authentication, session management and available identity-layer evidence. Your organization owns applicability decisions and the complete privacy workflow.
Share your stack and one synthetic consent, deletion or incident journey in Slack for an early response. Contact the NamoID team