Rule 1 — DPDP Rules, 2025
(1) These rules may be called the Digital Personal Data Protection Rules, 2025. (2) They shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint; and— (a) Rules 1, 2 and 4 shall come into force on 13th November, 2025; and (b) the remaining rules shall come into force on such date as the Central Government may, by notification, appoint.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 1 creates the same two-phase commencement mechanism as Section 1 of the Act. Phase 1 (13 November 2025) brought only three rules into force: the title rule, definitions, and the Consent Manager registration rule. All operational compliance rules — notice requirements, security safeguards, breach notification, rights fulfilment — sit in Phase 2 and are not yet in force. The May 2027 enforcement window referenced in government communications is a projected Phase 2 commencement date, not a date fixed in the Rules.
As of October 2026, Rule 4 (Consent Manager registration) is law. A Consent Manager operating without registration under Rule 4 is in violation today. But a Data Fiduciary that has not yet issued DPDP-compliant notices (Rule 3) is not yet in technical violation — Rule 3 has not commenced. The responsible approach is to prepare for full Phase 2 compliance well before it is enacted.