DPDP Status Center
What's in force, what's still developing, and what to watch for next as India's DPDP framework continues to roll out.
DPDP Act, 2023
Passed by Parliament and published in the Gazette. Verified statutory base active across Chapters I–VIII.
DPDP Rules, 2025
Implementation rules covering notice content, Consent Manager registration, security safeguards, and breach intimation timelines.
Continuous Review
Our editorial desk monitors MeitY notifications and Data Protection Board of India updates as they're published.
Data Protection Board of India
The Board's digital-first office receives breach intimations and complaints as further provisions are phased in.
Full legislative timeline
Puttaswamy judgment
The Supreme Court of India recognises the right to privacy as a fundamental right under Article 21, setting the constitutional foundation for a dedicated data protection law.
Justice Srikrishna Committee report
The expert committee submits its report along with a draft Personal Data Protection Bill, shaping the framework that would evolve over the next five years.
Personal Data Protection Bill, 2019 introduced
An earlier version of the bill is introduced in the Lok Sabha and referred to a Joint Parliamentary Committee for detailed review.
PDP Bill, 2019 withdrawn
The government withdraws the earlier bill, citing the need for a more comprehensive legislative framework.
Draft Digital Personal Data Protection Bill, 2022 released
A significantly restructured draft is released for public consultation, forming the direct basis of the eventual Act.
DPDP Act, 2023 enacted
The Digital Personal Data Protection Act, 2023 is passed by Parliament, receives Presidential assent, and is published in the Gazette of India as India's first cross-sectoral data protection statute.
Draft DPDP Rules, 2025 published
The Ministry of Electronics & Information Technology releases the draft Rules for public consultation, detailing notice content, breach timelines, consent managers, and more.
DPDP Rules finalised and notified
Following the consultation period, the Rules are finalised and notified, together with a phased timeline for provisions of the Act itself to come into force.
Data Protection Board of India operationalised
The Board is established and begins functioning as a digital-first regulator, receiving breach intimations and complaints as further provisions are notified.
What to watch next
- Formal notification of the remaining un-notified sections of the Act, on a phased timeline.
- Government notifications naming specific Significant Data Fiduciaries.
- Registration of the first cohort of Consent Managers with the Board.
- Any Central Government notification restricting cross-border data transfer to specific countries under Section 16.
- Sector-specific guidance from RBI, IRDAI, and TRAI clarifying how existing rules interact with the DPDP Act.