Data protection & privacy law in India (2026)

MeitY notified the Digital Personal Data Protection Rules, 2025, bringing parts of the 2023 Act into force and establishing the Data Protection Board of India; consent-manager rules apply from Nov 2026 and most substantive obligations from May 13, 2027. This finally operationalises India's standalone privacy regime.

MeitY published draft rules to implement the DPDP Act, covering consent notices, breach reporting, children's data and Significant Data Fiduciary duties, inviting public feedback by Feb 18, 2025. This was the first concrete operational detail after 18 months of the Act sitting un-enforced.

The President assented to the DPDP Act after passage by both houses (Lok Sabha Aug 7, Rajya Sabha Aug 9), creating India's first dedicated personal-data law with consent-based processing, data-principal rights and penalties up to Rs 250 crore. It is the foundation of today's privacy framework.

After scrapping the 2019 bill, MeitY released a slimmer, principles-based DPDP Bill for consultation, signalling a shift away from the GDPR-style omnibus approach. This draft became the template for the 2023 Act.

The government withdrew the PDP Bill 2019 after the Joint Parliamentary Committee proposed 81 amendments, opting to redraft a simpler law rather than pass the comprehensive GDPR-inspired text. This reset India's privacy legislation by three years.

CERT-In directed all entities to report cyber incidents including data breaches within six hours and retain logs for 180 days within India. It remains the binding breach-reporting regime pending full DPDP enforcement.

A 5-judge bench upheld the Aadhaar Act while invalidating Section 57, barring private companies (banks, telecoms) from compelling Aadhaar authentication absent a backing law. It set key limits on data collection and purpose limitation.

The expert committee chaired by Justice B.N. Srikrishna submitted its report 'A Free and Fair Digital Economy' with a GDPR-inspired draft bill, the first official blueprint for a comprehensive Indian data law. It framed the next five years of legislation.

A unanimous nine-judge Supreme Court bench held that the right to privacy, including informational privacy, is intrinsic to Article 21 of the Constitution, overruling earlier contrary precedents. This created the constitutional mandate for a data-protection law.

Rules under Section 43A defined 'sensitive personal data or information' (passwords, financial, health, biometric data) and required body corporates to maintain reasonable security practices and obtain consent. These were India's primary data-protection rules until the DPDP regime.

India's first cyber-law received Presidential assent, recognising electronic records and later (via Section 43A and Section 72A) providing the earliest statutory hooks for protecting personal data and penalising unauthorised disclosure. It anchored data protection for over two decades.