The Legislative History of the DPDP Act: From Puttaswamy to the Gazette

The modern trajectory toward the DPDP Act begins with the Supreme Court's 2017 judgment in Justice K.S. Puttaswamy v. Union of India, which unanimously recognised the right to privacy as a fundamental right protected under Article 21 of the Constitution. That judgment did not itself create a data protection statute, but it established the constitutional foundation and, in effect, the pressure on the government to legislate a framework giving that right practical, statutory content in the context of personal data.

The judgment's reasoning, that privacy is intrinsic to dignity and liberty and that any state or private interference with it must satisfy tests of legality, necessity, and proportionality, continues to be cited as the interpretive backdrop against which the DPDP Act's own provisions, including its exemptions, are likely to be read by courts.

In the wake of Puttaswamy, the government constituted a committee of experts chaired by Justice B.N. Srikrishna to recommend a data protection framework for India. The committee's 2018 report and an accompanying draft Bill laid substantial groundwork for many concepts that persisted, in evolving form, through later drafts, including the basic Data Fiduciary and Data Principal vocabulary and the idea of a dedicated regulatory body.

This first draft was notably more prescriptive in places than the eventual DPDP Act, including provisions on data localisation and a broader regulator mandate that were significantly pared back in subsequent iterations, reflecting an ongoing legislative debate about how heavy a compliance and regulatory burden the framework should impose.

A Personal Data Protection Bill, 2019, informed by the Srikrishna Committee's work, was introduced in the Lok Sabha and referred to a Joint Parliamentary Committee (JPC) for detailed examination, a process that extended over an unusually long period and produced an extensively revised report. Ultimately, in August 2022, the government withdrew the 2019 Bill altogether, citing the scale of the JPC's recommended changes and a preference to introduce a fresh, comprehensive framework rather than amend the existing Bill piecemeal.

This withdrawal was a significant moment in the legislation's history, effectively resetting the legislative clock after roughly three years of committee deliberation, and it drew both criticism for the delay and some acknowledgment that a cleaner redraft could produce a more coherent final statute.

A new draft, the Digital Personal Data Protection Bill, 2022, was released for public consultation in November 2022, notably shorter and less prescriptive than its predecessors, reflecting a policy shift toward a leaner framework with more detail left to delegated rule-making. Following further consultation and revision, the Digital Personal Data Protection Act, 2023 was passed by Parliament, received presidential assent, and was published in the Gazette of India in August 2023.

Implementation did not follow immediately; draft DPDP Rules, 2025 were released for public consultation in January 2025, and the Rules were finalised and notified at a later point in 2025, with a phased timeline for different provisions of the Act and Rules to come into force. Readers should treat exact dates for specific commencement milestones as something to verify against current official notifications rather than assume are fixed, since phased implementation schedules of this kind are sometimes adjusted.

The Timeline Explorer translates this legislative history into a practical view of what is in force today, and the /act and /rules pages provide the primary texts referenced throughout this history for direct reading.