Why the commencement schedule matters
The Digital Personal Data Protection Rules, 2025 are notified rules, but notification does not mean every operational obligation starts on the same day. For lawyers advising businesses in October 2026, the first task is to establish which provisions apply at the relevant time.
Rule 1 provides for immediate commencement of Rules 1, 2 and 17 to 21, a one-year interval for Rule 4, and an eighteen-month interval for Rules 3, 5 to 16, 22 and 23. Read the Gazette publication and the corresponding Act commencement notifications together. Avoid describing all requirements as already enforceable.
Map the data before rewriting the policy
Start with an inventory of the information the organisation actually collects. Follow an enquiry through its website form, customer database, support inbox, billing system and external service providers. Record the purpose of each transfer and who can access the information.
For a legal practice, the same exercise can cover intake forms, identity documents, hearing records and vendor uploads. Separate operational records from privileged or otherwise restricted material. The inventory is an advisory preparation tool; it does not itself decide every question of statutory scope or exemption.
Turn each processing activity into a review question
For every category of personal data, ask what purpose is being served, what legal basis is relied on, how the individual is informed and how long the record needs to remain available. A generic privacy statement may overlook a workflow that operates differently in practice.
For example, a business might stop a marketing campaign while retaining transaction records for a separate legal requirement. Document the distinction and its justification. Do not promise automatic deletion of every record if the organisation has unresolved retention duties, disputes or preservation requirements.
Review vendors and access controls together
List the services that host, analyse, transmit or support access to personal data. Ask the business team to identify the owner of each contract. Then review processing instructions, security commitments, subcontracting arrangements, incident cooperation and the practical ability to return or erase information.
Test whether access follows current roles. An employee who has moved teams should not keep unnecessary access to old client files. Contract review and technical review should produce one action list, with named owners and completion evidence, rather than separate reports that never meet.
Rehearse a request and an incident
Run a tabletop exercise using a fictional request to correct or erase information. Determine who receives it, how identity is checked, where the affected records are held and who decides whether retention remains justified. Record gaps before setting response promises in customer communications.
Use a second exercise for a suspected data leak. Identify the escalation contact, evidence preservation steps, vendor dependencies and approval process for communications. Distinguish internal preparation targets from statutory notification deadlines, which must be checked against the provisions in force when the incident occurs.
Maintain a provision-by-provision implementation plan
Create a matrix containing the provision, commencement trigger, affected process, responsible team and evidence of completion. Review it when the law, guidance or business model changes. This makes legal advice traceable and helps prevent a future requirement from being presented as a present breach.
A useful compliance memo ends with concrete tasks: update one notice, restrict one access group, resolve one vendor clause or test one request workflow. That is more actionable than a broad assurance that the organisation is ready.
Sources and further reading
Source check: 23 October 2026. Verify later amendments, notifications and judgments before applying this guide to a live matter.
Continue with legal drafting workflows.