India's digital rules,
translated for builders.
An independent, editorial reference for the DPDP Act, India's AI governance guidelines, and the evolving IT Rules — written in plain English for founders, freelancers, and creators. We link claims to official sources. Where we have not confirmed one, we say so on the page.
DPDP Full Enforcement
UPCOMINGuntil full enforcement · 13 May 2027
18 months from the 13 Nov 2025 notification.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
Educational only. Re-verify enforcement dates against the Gazette of India before relying on them.
Not sure where to start? Pick your role.
Three questions, tuned to how you actually work — not a generic quiz.
Do you directly collect personal data of Indian users?
Signups, emails, phone numbers, payment details on your product.
The DPDP Rules are notified — here's what changes over the 18-month window from their notification on 13 November 2025.
The Ministry of Electronics & IT notified the DPDP Rules, 2025 on 13 November 2025, starting a phased compliance window. If you handle personal data of Indian users — even as a solo freelancer — some duties are live now; the Consent Manager rules commence in November 2026; the core obligations (notice, consent, rights, breach reporting, security) apply from 13 May 2027.
🧭 Built for how you work
Start from your role — we'll route you to what actually applies.
You're likely a Data Fiduciary. Consent, breach notification, cross-border transfers — the compliance stack for early-stage startups.
Appointing a Data Protection Officer is an enhanced duty only for Significant Data Fiduciaries — and the criteria for that status are still pending.
See founder checklistUsually a Data Processor. Contracts, sub-processing, data handling for Indian and overseas clients — without becoming your client's liability.
See freelancer guideIT Rules on synthetic media, labelling of AI-generated content, and platform grievance mechanisms you should know about.
See creator roadmapFiduciary for your users, Processor for your customers' — how to handle both.
See the SaaS guideDark patterns, the 3-year dormancy rule, and payment data localisation.
See the store guideLead lists, TRAI DND, cookie consent, and children's advertising rules.
See the agency guideThe employment consent exception, AI hiring bias, and monitoring disclosure.
See the HR guideHandling citizen data makes a department a Data Fiduciary. Breach response, the 6-hour CERT-In clock, and the Rule 7 duties to prepare for now.
See breach response guideLive regulatory status
Where each major framework stands right now.
Primary framework for personal data protection in India.
Procedural rules implementing the DPDP Act; phased compliance windows.
Established in law (DPDP Act s.18; G.S.R. 843(E)). Chairperson and four Members to be appointed through a Search-cum-Selection Committee (Lok Sabha Unstarred Question 3960, 12 Aug 2026). Posts advertised in Employment News on 6 Jun 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 Oct 2026.
Non-binding principles on human oversight, transparency, and safety.
Intermediary due diligence; synthetic media labelling obligations.
Transfers allowed unless the Government restricts a country (DPDP Act s.16(1)). No such notification found.
"In force" is not the same as "enforceable"
The DPDP Act received presidential assent on 11 August 2023 — that's in force. But most operative sections wait on the Rules being notified and the Data Protection Board being constituted before they become enforceable against you. We flag this distinction on every page so you don't over- or under-comply.
📚 The library
See all guides →Data Privacy
DPDP Act, Rules, and Data Principal rights.
OpenSignificant Data Fiduciary
Who the DPO and audit duties are for — and why no one is one yet.
OpenChildren's data
Under-18 rules: verifiable parental consent, no tracking, no targeted ads.
OpenConsent Manager
Who actually registers — and the 2026 deadline aimed at an unstaffed Board.
OpenAI Policy
MeitY guidelines and AI governance.
OpenPlatforms & Internet
IT Rules, intermediary duties, and deepfake labelling.
OpenGoing Global
India vs GDPR, cross-border transfers.
OpenDPDP vs GDPR for AI
Training data, public data, automated decisions — side by side.
OpenThis Week
Latest updates, dated and sourced.
OpenRegulatory Map
The full stack, from Puttaswamy down.
OpenGlossary
Every defined term, plain English.
Open📰 Latest updates
View all →- Watch24 Sep 2026AI Policy
Legal effect: Nothing binding. A speech, not a direction.
RBI Deputy Governor Rohit Jain said in a speech that governance must come before scale. He said AI can amplify errors as quickly as it amplifies efficiency.
- Watch1 Sep 2026Sector Rules
Legal effect: A consultation paper. No duty on anyone today.
IRDAI published a public consultation paper on a Public Insurance Registry. The paper calls it Digital Public Infrastructure. It refers to the DPDP Act and to consent-based processing.
- Watch19 Aug 2026AI Policy
Legal effect: Nothing binding. A speech, not a direction.
RBI Deputy Governor Shirish Chandra Murmu set out five principles for AI in banking. He said a bank that cannot name the person who owns a model's decision "has delegated its accountability". Where a decision materially affects a customer, such as a loan declined, there must be a route to a person who can look again.
- Notified12 Aug 2026Data Privacy
Legal effect: No change. It restates the existing timetable: the Board first, Consent Managers within one year, most duties within eighteen months.
In a Lok Sabha answer, MeitY restated that the DPDP Rules, 2025 were notified on 13 November 2025. It set out three phases over the 18-month transition.