Skip to content
World Watch

Data protection & privacy law in India (2026)

Data protection in India: comprehensive law.

India has a comprehensive, cross-sectoral data protection law in force: the DPDP Act 2023, whose implementing Rules were notified on 13–14 November 2025, triggering a phased rollout. Some provisions (Data Protection Board, definitions) took effect immediately on notification; consent-manager and select operational duties become effective 13 November 2026; the bulk of substantive obligations (data-fiduciary duties, data-principal rights, breach notification, penalties) become fully enforceable on 13 May 2027. The regime replaces the earlier narrower Section 43A / SPDI Rules 2011 framework under the IT Act 2000 and establishes a central digital regulator (the DPB) with power to impose monetary penalties up to ₹250 crore per breach.

Last verified Official sources first · MethodologyCompare India with other countries

Legal framework

Digital Personal Data Protection Act, 2023 (DPDP Act) with implementing Digital Personal Data Protection Rules, 2025 (notified 13–14 November 2025); administered by the Ministry of Electronics and Information Technology (MeitY) and enforced by the Data Protection Board of India (DPB).

Key points: data & privacy in India

  1. Primary law and implementing rules

    The DPDP Act, 2023 was enacted on 11 August 2023 and its subsidiary Digital Personal Data Protection Rules, 2025 were officially notified by MeitY on 13–14 November 2025 via Gazette/Press Information Bureau, operationalising the Act on a phased schedule (14 Nov 2025 / 14 Nov 2026 / 14 May 2027).

    pib.gov.in static.pib.gov.in

  2. Supervisory authority — Data Protection Board of India

    The DPB is a statutory, digital-first regulator (four members) established under Chapter V of the DPDP Act. It receives citizen complaints, inquires into breaches, and can impose monetary penalties; appeals lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). MeitY sets policy while the DPB adjudicates.

    pib.gov.in en.wikipedia.org

  3. Data-principal rights

    Individuals ('Data Principals') have rights to notice, access (summary of personal data and sharing details), correction/completion/erasure, grievance redressal, and to nominate another person; consent must be free, specific, informed, unconditional and unambiguous, and withdrawing consent must be as easy as giving it.

    meity.gov.in dlapiperdataprotection.com

  4. Data-fiduciary obligations and Significant Data Fiduciaries

    Data Fiduciaries must ensure purpose limitation, accuracy, reasonable security safeguards, breach notification to the DPB and affected principals, and children's data protections (verifiable parental consent; ban on tracking/targeted ads to minors). The Central Government may designate certain entities as 'Significant Data Fiduciaries' (Section 10) with extra duties: appointing a Data Protection Officer resident in India, an independent data auditor, and periodic DPIAs.

    meity.gov.in ey.com

  5. Cross-border data transfers

    Under Section 16 of the Act and Rule 15 of the 2025 Rules, personal data may be transferred outside India by default, except to countries or classes of persons specifically restricted by Central Government notification (a 'blacklist' / negative-list approach). Sector-specific transfer restrictions (e.g., RBI payments-data localisation) continue to apply in addition.

    dpdpa.com itif.org

  6. Penalties

    The Schedule to the Act sets civil monetary penalties adjudicated by the DPB, with a ceiling of ₹250 crore for failing to take reasonable security safeguards causing a breach, up to ₹200 crore for breach-notification failures or breaches of children's-data obligations, and ₹150 crore for SDF-specific defaults. Penalties are payable to the Consolidated Fund of India and do not include individual compensation.

    meity.gov.in ey.com

Timeline of decisions

  1. Law · official
    DPDP Rules, 2025 notified; Data Protection Board operationalised

    MeitY notified the Digital Personal Data Protection Rules, 2025, bringing parts of the 2023 Act into force and establishing the Data Protection Board of India; consent-manager rules apply from Nov 2026 and most substantive obligations from May 13, 2027. This finally operationalises India's standalone privacy regime.

    Press Information Bureau (PIB)

  2. Law · official
    DPDP Rules, 2025 notified, operationalizing the data-protection law

    MeitY notified the Digital Personal Data Protection Rules, 2025, bringing the 2023 Act into operational force and setting consent, breach-notification and children's-data norms that govern how personal data can be used to train and deploy AI systems.

    MeitY

  3. Guidance · official
    Draft DPDP Rules, 2025 released for public consultation

    MeitY published draft rules to implement the DPDP Act, covering consent notices, breach reporting, children's data and Significant Data Fiduciary duties, inviting public feedback by Feb 18, 2025. This was the first concrete operational detail after 18 months of the Act sitting un-enforced.

    Press Information Bureau (PIB)

  4. Law · official
    Digital Personal Data Protection Act, 2023 enacted

    The President assented to the DPDP Act after passage by both houses (Lok Sabha Aug 7, Rajya Sabha Aug 9), creating India's first dedicated personal-data law with consent-based processing, data-principal rights and penalties up to Rs 250 crore. It is the foundation of today's privacy framework.

    MeitY

  5. Guidance · official
    Draft Digital Personal Data Protection Bill, 2022 released

    After scrapping the 2019 bill, MeitY released a slimmer, principles-based DPDP Bill for consultation, signalling a shift away from the GDPR-style omnibus approach. This draft became the template for the 2023 Act.

    MeitY

  6. Decision
    Personal Data Protection Bill, 2019 withdrawn from Parliament

    The government withdrew the PDP Bill 2019 after the Joint Parliamentary Committee proposed 81 amendments, opting to redraft a simpler law rather than pass the comprehensive GDPR-inspired text. This reset India's privacy legislation by three years.

    PRS Legislative Research

  7. Decision
    Supreme Court upholds Aadhaar but strikes down Section 57

    A 5-judge bench upheld the Aadhaar Act while invalidating Section 57, barring private companies (banks, telecoms) from compelling Aadhaar authentication absent a backing law. It set key limits on data collection and purpose limitation.

    Supreme Court Observer

  8. Guidance · official
    Srikrishna Committee report and draft Personal Data Protection Bill, 2018

    The expert committee chaired by Justice B.N. Srikrishna submitted its report 'A Free and Fair Digital Economy' with a GDPR-inspired draft bill, the first official blueprint for a comprehensive Indian data law. It framed the next five years of legislation.

    MeitY

  9. Decision
    Puttaswamy judgment: privacy a fundamental right

    A unanimous nine-judge Supreme Court bench held that the right to privacy, including informational privacy, is intrinsic to Article 21 of the Constitution, overruling earlier contrary precedents. This created the constitutional mandate for a data-protection law.

    Supreme Court Observer

  10. Law · official
    IT (Reasonable Security Practices / SPDI) Rules, 2011 notified

    Rules under Section 43A defined 'sensitive personal data' and required body corporates to implement reasonable security practices (e.g., ISO 27001-type controls), making security safeguards legally enforceable for the first time. These governed corporate data security until the DPDP Act.

    WIPO Lex

  11. Law
    IT (SPDI) Rules, 2011 notified

    Rules under Section 43A defined 'sensitive personal data or information' (passwords, financial, health, biometric data) and required body corporates to maintain reasonable security practices and obtain consent. These were India's primary data-protection rules until the DPDP regime.

    India Official Gazette (via DataGuidance)

  12. Law · official
    Information Technology Act, 2000 enacted

    India's first cyber-law received Presidential assent, recognising electronic records and later (via Section 43A and Section 72A) providing the earliest statutory hooks for protecting personal data and penalising unauthorised disclosure. It anchored data protection for over two decades.

    India Code (Legislative Dept.)

Sources

  1. pib.gov.in/PressReleasePage.aspx?PRID=2190655&reg=48&lang=2
  2. static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
  3. meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
  4. en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Act,_2023
  5. en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Rules,_2025
  6. dpdpa.com/dpdparules/rule15.html
  7. itif.org/publications/2025/06/09/india-cross-border-data-transfer-regulation/
  8. dlapiperdataprotection.com/?t=law&c=IN
  9. ey.com/en_in/insights/cybersecurity/decoding-the-digital-personal-data-prote

Next for India: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 23 Sept 2026. Methodology & how to cite · State of Technology Regulation 2026