Chapter 2 — Act, Rules, Commencement and Regulatory Change

1. Ideas: DPDP is a stack, not a single instrument

The central idea of this chapter — and the reason it is the spine of the whole book — is that DPDP is not one law you “comply with.” It is a stack of instruments that take effect on different dates, produced by different arms of the state, each with its own job:

DPDP Act 2023 (22 of 2023; ss.1–44 + the Schedule)
  + DPDP Rules 2025 (GSR 846(E): rules 1–23 + Schedules)
  + commencement notification (GSR 843(E): the Act staged in tranches)
  + corrigendum (GSR 892(E): operative text corrections to the Rules)
  + Board establishment (GSR 844(E)) and membership (GSR 845(E))
  + whatever the Central Government notifies next
  = ONE versioned obligations register

Each layer deserves a sentence on what it is, because the layers get confused constantly in practice:

The Act is the statute — Section 1 to Section 44 plus the penalty Schedule — passed by Parliament in August 2023 and published in the Gazette as 22 of 2023. It creates the obligations, the rights, the roles, the Board, and the penalty ceilings. But an Act of this kind sets important substantive conditions itself while delegating specified details through its “as may be prescribed” clauses. Rules fill those delegated subjects; they do not make every Act provision incapable of operating independently.

The Rules are those instruments: twenty-three rules plus their own Schedules (the First Schedule’s Consent Manager conditions, the Second Schedule’s State-processing standards), made by the Central Government under Section 40’s rule-making power. And the Rules have their own legislative history that matters for interpretation: a draft was published for comment as G.S.R. 02(E) on 3 January 2025, objections and suggestions were invited and considered, and the final text issued on 13 November 2025 as GSR 846(E). A practitioner reading a 2024-vintage analysis of “the draft Rules” is reading a document that predates the consideration of public comments — and changes between draft and final are worth tracking. A difference establishes changed wording, not the Government’s motive without further evidence.

The commencement notification (GSR 843(E), 13 November 2025) is the instrument that brings the Act itself into force — and it is staged, which is the single most planning- significant fact in the regime (§3 below).

The corrigendum (GSR 892(E)) corrects the operative text of the Rules. It is the smallest layer by volume and one of the largest by consequence: a control built on the pre-corrigendum wording of a rule is a control built on text that is no longer the law, and the register’s corrigendum row exists precisely so that no chapter of this book quietly cites superseded language.

The Board evidence must be split into separate records. GSR 844(E) establishes the Board with its head office in the NCR. GSR 845(E) says it shall consist of four members; Section 2(q) includes the Chairperson in “Member”, while the retained recruitment notice says Chairperson plus four other Members. None appoints named people. The inconsistent headcount and actual appointments remain QL-003; establishment does not prove a staffed portal or start deferred powers (ACT:100,595–610[3]; RECRUIT:19–24[9]). The establishment and composition passages are retained separately: EST:51–57[6]; MEMBERS:49–52[7].

A legal or engineering claim anywhere in this book is only usable if it can point to (a) the provision that creates the duty, (b) the instrument that makes it live, and (c) the date on which it becomes enforceable. This chapter builds the register that supplies all three — and the rest of the book refers back to it for every obligation it operationalises.

2. Tension: the Act is mostly NOT in force yet — but the Board already exists

This is the sharpest tension the practitioner must navigate, and it deserves to be held with both hands.

Most duties are not yet live. The tranche-(c) obligations — notice and consent, the general fiduciary duties, children, SDF obligations, the Data Principal’s rights, the breach intimation duty, and the entire penalty machinery — become enforceable only on 13 May 2027 under GSR 843(E). An enterprise reading “the Act commences” and planning from commencement day has actually planned itself into non-compliance: the duties arrive live, operational, and inspectable, with no bedding-in period the statute provides.

The institutional layer is in force, but operational facts need their own evidence. Sections 18–26 and the Board’s institutional Rules have commenced; Sections 38 to 43 are miscellaneous provisions, not an offences/prosecution block. Section 36 belongs to the Central Government and is in the deferred core tranche. The register distinguishes “provision in force”, “actor appointed”, “channel verified” and “duty applicable to this activity”; no one field substitutes for another (COMM:49–59[5]; ACT:854–945[3]).

The two facts sit awkwardly together, and each generates its own failure mode:

• The commencement-day fallacy. “Nothing matters until May 2027” — so the programme is scheduled to finish in April 2027, the tranche-(c) controls arrive untested on the very date they become inspectable, and the enterprise discovers that a Board inquiry (or an incident) has no grace-period concept. The Act’s own staged structure is an invitation to build early, not a licence to defer.
• The over-reaction. The mirror error: reading the live Board as live-everything, and treating the November-2025 tranche as if the full regime had armed. Voluntary protective notices and readiness preparation can still be appropriate, and another applicable law may require notice; the error is attributing them to an already commenced DPDP core duty.

The register resolves the tension mechanically, which is its job: the effective date is an explicit, per-provision attribute, so that no conversation in the programme can silently assume either fallacy. Every obligation row answers “is this live, when does it go live, and what is live around it while it waits?” — and the two clocks in the next section make the answer precise.

3. The two clocks, reconciled

3.1 The Act clock (GSR 843(E))

Section 1(2) of the Act permits different provisions to commence on different dates, and GSR 843(E) exercises that power in three tranches from publication on 13 November 2025:

3.2 The Rules clock (Rule 1(2)–(4))

The Rules stage themselves, independently of the Act — a fact the commencement-only reader misses entirely:

• Immediate (13 Nov 2025): Rules 1, 2, and 17–21 — the Rules’ own definitions and the Board’s operating machinery.
• One year (13 Nov 2026): Rule 4 — Consent Manager registration and obligations, arriving with the Act’s own one-year sliver.
• Eighteen months (13 May 2027): Rules 3, 5–16, 22, 23 — the operational detail: notice content, State processing, security safeguards, breach intimation, retention periods, verifiable consent, SDF obligations, rights mechanisms, transfer, research exemption, appeals.

3.3 The reconciliation a register row must perform

Because a duty often needs both an Act provision and a Rules rule, “when is this obligation live?” is a two-clock question. A worked reconciliation, of the kind every register row carries:

• Breach intimation (Control OBL-12): the duty is Section 8(6) — Act tranche (c), 13 May 2027. The form, manner, and window are Rule 7 — Rules tranche also 13 May 2027. Both clocks agree: scheduled 13 May 2027. On awareness, initial Board and affected-principal notices are without delay; the detailed Board update is due within seventy-two hours unless a longer period is allowed on written request (RULES:1112–1139[4]).
• Consent Manager obligations (Control OBL-47): the definition is Section 2(g) — live since 13 November 2025 (tranche (a)). The registration and obligations are Rule 4 — 13 November 2026, earlier than Section 6(7)/(8), which commence with the core. Applicants/registered Consent Managers must distinguish their obligations from an ordinary fiduciary’s recommended early integration work. The First Schedule speaks of onboarded fiduciaries, not unauthenticated universal connectivity (ACT:258–268[3]; RULES:1451–1469[4]).
• Notice (Control OBL-04/07): the duty is Section 5 — 13 May 2027; the itemised-content detail is Rule 3 — also 13 May 2027; and the legacy-consent notice of Section 5(2) interacts with the same date. Aligned clocks, but the Section 5(2) campaign’s volume work (Chapter 23) must begin long before the duty arms.

The practical rule is to check each enabling provision and rule separately, not to invent a universal “later of two clocks” algorithm. Some provisions operate without further prescription; designation and applicability are separate factual gates. The early Section 27(1)(d) function versus deferred Sections 28/33 procedure remains QL-006. An implementation record carries all dependencies and does not resolve that interpretation by choosing a convenient date.

4. The register data model and provenance contract

The authoritative lookup is research/legal/CANONICAL_PROVISION_REGISTER.json, not a reduced prose table or the old blank CSV template. It contains every Act section, every Rule and all schedules, with decision-critical subrows. Each row has a stable provision ID, actor, trigger, factual conditions, exceptions, exact source passage, physical newline range, source URL, PDF/text SHA-256, instrument date/version, commencement source, legal status at review, author interpretation and review status. The word “authoritative” describes this book’s internal source hierarchy; it does not claim counsel certification.

The chapter’s historical OBL-01 to OBL-54 identifiers remain useful operational aliases. They are preserved in the generated crosswalk below; they never replace exact ACT-* or RULE-* identifiers. An OBL can join several statutory rows and an entity’s control decision. The crosswalk preserves actor and scope differences rather than hiding them behind a single date.

The source is one layer, the interpretation another, and the implementation a third. For example, RULE-7’s text is a source fact. The Company’s proposed awareness-triage policy is an author design. Its actual notice transmission would require a delivery record, which this local teaching example does not provide. author primary-text checked is not counsel approved; a control link is not evidence that the control ran. A hash proves file identity, not legal accuracy or operational effectiveness.

out/remediation/Q02/register-view.json is a generated subset/crosswalk with the complete canonical records embedded for each alias, plus an author control link and explicit no-independent-approval status. Source metadata is inherited without overwriting Q01. Appendix A renders the same canonical records and their physical source locations. The small table below is navigation to that populated object, not a claim that a five-column table contains the full provenance.

4.1 Worked provenance record: Control OBL-12 / Control OBL-18

The obligation actor is the Data Fiduciary; the trigger is awareness of any personal-data breach within the applicable scope. ACT-8 and RULE-7 supply the substantive duty, prescribed contents and clocks. ACT:348–350[3] supplies Board/affected-principal intimation; RULES:1112–1139[4] distinguishes principal notice, initial Board description and detailed update. COMM:56–59[5] and corrected RULES:1005–1010[4] put the pair in the core tranche. Sources are the 11 August 2023 Act and 13 November 2025 Rules, reviewed 15 September 2026. The full hashes and URLs are populated in the JSON view, not placeholders.

The source condition is not “serious enough to notify”: Rule 7 says any personal-data breach. The allowed longer detailed-update period requires a written request and Board allowance; it does not extend initial notices. The recommended control is separate queues, timestamps and failure escalation in Chapter 16. Evidence status here is primary_law for the rule and author_recommendation for the queue, with no observed dispatch. The reviewer decision is independent review pending. This distinction lets a programme trace a delayed queue without pretending the rule itself was uncertain.

5. Generated obligation navigation

The child exception and SDF designation powers have scheduled commencement even when their entity-specific application depends on a notification. “Not designated” and “not in force” are different statuses. Similarly, Rule 8 is not merely an unread inactivity period: it includes a separate minimum one-year personal/traffic/log retention layer and the Rule 8(2) advance warning. All available English Rules and schedules have been mapped; interpretive questions remain expressly named rather than hidden as pending reading.

6. Effective date is a first-class compliance attribute

The register’s most important design decision is making effective date a column, not a footnote. This single choice forces the programme to answer, for every obligation, three useful audit-readiness questions: when did this duty become enforceable, what instrument made it so, and what was live around it while you were building? It also disciplines the whole book: the intended standard is that no chapter asserts an obligation is live without the register backing it, or treats a pending-verification designation or age notification as settled. Downstream propagation still requires its assigned review gates. The register is not merely a tracking artefact — it is the book’s theory of what the law currently is, expressed as data.

7. Keeping the register true: the monitoring loop

A register is only as good as its currency, and the loop that maintains it has five moving parts:

1. The trigger list — MeitY’s DPDP document index and the Board’s publications; the Gazette of India (Extraordinary) for GSR-numbered instruments; the sector circulars of Chapter 5’s register; and the designation-type powers — Section 10(1) SDF, Section 16(1) transfer restriction, Section 9(5) safe-age, Section 42 Schedule amendment — each watched on a monthly cadence by a named owner (not “the team”).
2. Change detection — when a new instrument appears: retain the primary text, checksum it, and add it to the evidence store before interpreting it (the same discipline this book applied to the original sources).
3. Row re-opening — in the recommended workflow, update every affected OBL row’s source, SHA-256, effective date, and status; flag rows whose Status changes; advance the register’s cut-off date.
4. Sign-off discipline — only the named reviewer (counsel, or the user-designated equivalent) marks a row live for a newly effective provision. Automated and mechanical updates stop at pending-verification. This is the fail-closed posture applied to legal status itself.
5. Downstream propagation — the re-opened row ripples where it must: the affected chapter’s controls re-test (Ch.22), the delivery plan re-sequences (Ch.23), the board dashboard re-issues (Ch.6/24). The register is the spine; the loop keeps the spine current.

The corrigendum illustrates the loop’s necessity concretely: GSR 892(E) corrected the Rules’ operative text after notification, and any register built on the pre-corrigendum wording of a corrected rule was silently wrong until its row was re-opened against the corrected text. Small instrument, large lesson — the law you cite is a version, and versions move.

8. A worked change ticket without fictional legal events

The following is a synthetic rehearsal, not a new notification or a report of a completed programme. CASE-001 remains not_designated. The exercise introduces a hypothetical message claiming the Company has become an SDF, but supplies no Gazette instrument. Its decision is unresolved; Control OBL-32 must not change to applicable merely because a monitoring feed or vendor alert says so. The legal owner requests the primary text, publication and effective dates, class definition and actual Company facts. No invented notification number is entered.

The rejected branch is deliberate. A monthly manual review cannot be represented as publication-day detection. Record published_at, detected_at, reviewed_at and control_ready_at independently; if the first is unknown, leave it unknown. A backup reviewer owns a missed-monitoring escalation. These are recommended workflow fields, not statutory monitoring cadence. A later authenticated instrument would reopen affected rows, but controls would still need scope assessment, implementation and evidence before being called ready.

A second rehearsal uses a real retained correction rather than a hypothetical instrument. GSR 892(E), dated 10 December and published in the 11 December 2025 Gazette issue, corrects Rule 1 publication wording, Rule 13(5) “Departments”, Rule 23(1) “given in such order”, First Schedule “every body” and “18 of 2013”, and Fourth Schedule definition punctuation/lettering. Its page-38 (a)–(g) correction belongs to the Fourth Schedule, not the First. It changes no breach clock and creates no nomination schedule (CORR:24–38[8]; RULES:1751–1765[4]). The source index’s 16 December display date is not either the instrument date or the Gazette issue date.

The practical change decision is to regenerate the affected source-linked views, retain original extracted wording beside corrected reading, and recheck each claim. A text-diff success is evidence of changed bytes; it does not establish that an enterprise’s notice, retention engine or Board interface now works. The programme therefore closes source repair separately from implementation acceptance.

9. Bounded residuals and update ownership

The source dates, Rules staging, Rule 7 clocks, Rule 8 retention, Rule 13 cadence, Rule 14 rights mechanism and corrigendum mappings are verified author research, not deferred source reads. Remaining questions are the Board composition/appointment evidence (QL-003), comprehensive later-instrument assurance (QL-004), early CM enforcement interaction (QL-006), and entity-specific grounds, retention and sector application. The Q01 official-update check was bounded: a failed complete eGazette search is not proof that no later instrument exists.

Before real reliance, the legal owner must check the relevant official orders/designations and actual entity facts. Before book release, independent reviewers must inspect source-to-claim correctness and propagation. This chapter neither certifies the absence of later law nor treats an unresolved flow as approved. The register supports those reviews by making the missing decision explicit.

Bridge to the next chapter

The register proves that DPDP applies differently on different dates to different roles — which surfaces the first real decision an entity must make: is this specific processing in scope at all, and who am I in it? Chapter 3 takes up Scope, Roles, Exemptions and Processing Grounds — the decision trees and role matrix that turn the register’s provisions into an entity-specific answer.

References (sources retained & checksummed)

• DPDP Act 2023 (22 of 2023), Gazette — research/legal/evidence/01_dpdp_act_2023_gazette.txt
• Commencement GSR 843(E) — research/legal/evidence/02_gsr_843e_commencement.txt
• Board establishment GSR 844(E); Members GSR 845(E) — research/legal/evidence/03_, 04_
• DPDP Rules 2025, GSR 846(E) — research/legal/evidence/05_gsr_846e_dpdp_rules_2025.txt
• Corrigendum GSR 892(E) — research/legal/evidence/06_gsr_892e_corrigendum.txt
• Board recruitment notice (2026) — research/legal/evidence/07_board_recruitment_notice_2026.txt
• Checksum manifests — research/legal/evidence/SHA256SUMS.txt, ALL_SHA256SUMS.txt (verify with scripts/verify_hashes.py)
• Canonical source: research/legal/CANONICAL_PROVISION_REGISTER.json; generated operational-alias view: out/remediation/Q02/register-view.json. LEGAL_REGISTER_TEMPLATE.csv is a legacy blank template, not the canonical populated register.

Source key and provenance legend

Physical references use newline-based line numbers in the following retained source paths; each numbered reference resolves to its original source URL. Review date: 15 September 2026. Full calculated hashes and source versions: out/remediation/Q02/source-manifest.json. The Q01 baseline and its bounded official-update limitations remain controlling; no later-law absence or entity certification is asserted.

• ACT: research/legal/evidence/01_dpdp_act_2023_gazette.txt — Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023).[3]
• RULES: research/legal/evidence/05_gsr_846e_dpdp_rules_2025.txt — Digital Personal Data Protection Rules, 2025, G.S.R. 846(E).[4]
• COMM: research/legal/evidence/02_gsr_843e_commencement.txt — G.S.R. 843(E), DPDP Act commencement notification.[5]
• EST: research/legal/evidence/03_gsr_844e_board_establishment.txt — G.S.R. 844(E), establishment of Data Protection Board of India.[6]
• MEMBERS: research/legal/evidence/04_gsr_845e_board_members.txt — G.S.R. 845(E), number of members of Data Protection Board of India.[7]
• CORR: research/legal/evidence/06_gsr_892e_corrigendum.txt — Corrigenda to G.S.R. 846(E), G.S.R. 892(E).[8]
• RECRUIT: research/legal/evidence/07_board_recruitment_notice_2026.txt — Filling up the post of Chairman & Members in the Data Protection Board of India.[9]

Sources

[3] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf [4] https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf [5] https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf [6] https://www.meity.gov.in/static/uploads/2025/11/cc217843dc3bcb37b2b05bcc3b4e031f.pdf [7] https://www.meity.gov.in/static/uploads/2025/11/f6c0837972422cf79d890bfe84cc04d6.pdf [8] https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf [9] https://www.meity.gov.in/static/uploads/2026/05/53b1bcf01cab9a0adde463e73fbc3417.pdf

Contents · Reader guide and citation conventions · Artifact index