About the DPDPA

The Digital Personal Data Protection Act, 2023 represents India's legislative framework for governing the processing of digital personal data.

3 min read

Key Milestones

  1. Act Notified

    The Digital Personal Data Protection Act, 2023 received Presidential assent and was published in the Official Gazette.

  2. Draft Rules Published

    The Ministry of Electronics and IT released the draft Digital Personal Data Protection Rules for public consultation.

  3. DPDP Rules Notified

    The DPDP Rules, 2025 were notified via Gazette Notification S.O. 846(E), containing 23 Rules with staggered enforcement provisions.

  4. Phased Enforcement Begins

    Rules 1-2 and 17-21 (Board provisions) are in immediate effect. Rule 4 (Consent Manager registration) comes into force after 1 year (~November 14, 2026). Rules 3, 5-16, 22-23 (operational provisions) come into force after 18 months (~May 14, 2027).

Explore Topics

Objectives and Legislative Intent
Balancing privacy rights with legitimate data processing needs.
Scope and Applicability
What data, entities, and activities are covered by the DPDPA.
Extraterritorial Application
How the DPDPA applies to processing outside India.
Constitutional Foundations
The Puttaswamy judgment, Article 21, and the proportionality test.
Implementation Status
Phased enforcement timelines and key compliance deadlines.
History and Evolution
From the Srikrishna Committee to the 2023 Act - key policy shifts.

Frequently Asked Questions

For a comprehensive list of FAQs segmented by audience, visit the dedicated FAQs page.

Explore More

Disclaimer: The information on this page is for educational purposes only and does not constitute legal advice or solicitation.