Reference · Living tracker
What isn't settled yet
India's data-protection and AI rules are still being built. Most guides explain what the law says. This page tracks what it hasn't decided yet — the notifications, appointments, and court questions still open — and moves each one to 'Recently resolved' the day it lands.
Educational only · not legal adviceLast updated: 2 September 2026Written and edited by Sandesh Kokate
Bookmark this page to see what's fixed and what's still moving, at a glance.
Confirmed = fixed and dated · Pending = government action awaited · Scheduled = dated, not yet live · Watch = dated future change, not yet in effect · Under challenge = before the courts, could change.
Online Gaming Act, 2025: Act text and registration notices
Pending- What it means
- The Online Gaming Rules, 2026 are in force from 1 May 2026. We have not yet opened the Act's own text, so its definition of an online money game is not quoted here. Registration of social games applies only if the government names a category in a notice (rule 12(1)).
- What to watch
- The Act's text on India Code or eGazette, and any notice naming social games that must register.
Full enforcement date
Confirmed- What it means
- The core obligations become enforceable on 13 May 2027 — 18 months after the DPDP Rules were notified on 13 November 2025. This is the one fixed date in the timeline.
- What to watch
- Two things. First, the 13 vs 14 May 2027 question above. Second, Section 1 of the Act lets the Central Government appoint different dates for different provisions — so this date can move by notification alone.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
Significant Data Fiduciary (SDF) criteria
Pending- What it means
- The government can designate certain large or higher-risk data fiduciaries as 'Significant', which triggers extra duties — appointing a DPO, independent audits, and data protection impact assessments. The criteria for who qualifies have not been notified yet.
- What to watch
- A government notification setting the SDF designation criteria.
Lowered age for children's data (Section 9(5))
Pending- What it means
- Section 9(5) of the DPDP Act lets the government notify a Data Fiduciary as able to process a child's personal data at an age below 18, where it is satisfied that fiduciary's processing is verifiably safe. That power has not been exercised. The age threshold therefore remains 18 for everyone. Note that this is narrower than it sounds: it is a per-fiduciary designation, not a general lowering of the age.
- What to watch
- A notification designating any Data Fiduciary under Section 9(5), and the age specified.
Section 16(1) restriction notification (cross-border transfers)
Pending- What it means
- Section 16(1) of the DPDP Act lets the government restrict transfers of personal data to a named country by notification. We have found no such notification, so no country is off-limits under Section 16(1). Rule 15 of the DPDP Rules is different: it lets the government set requirements for making data available to a foreign State.
- What to watch
- A notification under Section 16(1) of the DPDP Act naming any restricted country.
Data Protection Board — established in law, not yet staffed
Pending- What it means
- The Board is established in law (DPDP Act s.18; G.S.R. 843(E)). As notified, it has a Chairperson and four Members, to be appointed through a Search-cum-Selection Committee (Government reply, Lok Sabha Unstarred Question 3960, 12 August 2026). The posts were advertised in Employment News on 6 June 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 October 2026.
- What to watch
- A Gazette or MeitY notification actually appointing the Chairperson or any Member. Nominations being invited is not an appointment.
Consent Manager regime
Scheduled- What it means
- The Consent Manager registration system (Rule 4) is set to commence on 13 November 2026. Consent Managers will register with the Board and take on defined obligations. It is not operational yet.
- What to watch
- Registration opening and any operational guidelines.
Constitutional challenge in the Supreme Court
Under challenge- What it means
- Writ petitions challenge parts of the DPDP Act — chiefly Section 44(3), which amended the RTI Act, plus Sections 17(1)(c), 17(2), 33(1) and 36, and Rules 17 and 23(2) of the DPDP Rules. On 16 February 2026 the Supreme Court issued notice, referred the questions to a larger bench, and declined to stay the framework. There is no stay — the DPDP framework operates as normal while this runs.
- What to watch
- The Union's counter-affidavit, and the next listing.
- 16 Feb 2026 — Notice issued; referred to a larger bench; interim stay refused.
New fraudulent-transaction framework for banks
Watch- What it means
- RBI has published a framework on fraudulent electronic banking transactions. We have not read the final text, so we do not state its start date, limits or compensation amounts.
- What to watch
- The final Directions on rbi.org.in, opened and read.
RBI Department of Supervision consolidation
Watch- What it means
- After the Department of Regulation consolidated its circulars in November 2025, the Department of Supervision began the same exercise for supervisory instructions — organising them into entity-specific Directions covering functions such as the compliance function and concurrent audit. This is a second wave, separate from the November 2025 one.
- What to watch
- Which supervisory circulars are withdrawn, and what replaces them.
Draft PPI Directions, 2026
Watch- What it means
- The RBI published a draft replacement for the wallet rulebook on 22 April 2026, and took comments until 22 May 2026. It has not been finalised, so the Master Direction of 27 August 2021 is still the rule.
- What to watch
- Whether the draft is issued as final, and from what date.
RBI Draft Guidance on Regulatory Principles for Model Risk Management, 2026
Watch- What it means
- Draft guidance that brings AI and machine-learning models into a board-owned Model Risk Management Framework. It covers banks, NBFCs, all-India financial institutions, asset reconstruction companies and credit information companies. It expects a board-approved framework, risk-based model tiering, a model inventory, independent validation, explainability, human-in-the-loop and kill-switch controls, and accountability for third-party models. Released 24 June 2026 (Press Release 2026-2027/528). Comments closed 24 July 2026. Not final as of 6 October 2026. Once final, it replaces RBI's 2002 guidance on credit risk models.
- What to watch
- Whether RBI issues the final guidance, and from what date.
SEBI — Advisory on Emerging Advanced AI Tools for Vulnerability Detection
Watch- What it means
- SEBI issued an advisory on 5 May 2026 about advanced AI tools used to find security weaknesses. The circular page has been verified, but the advisory PDF has not yet been read, so its exact requirements are not yet known.
- What to watch
- What the advisory requires, and whether it becomes a binding amendment.
A standalone AI law for India
Watch- What it means
- In November 2025 MeitY said a separate AI law was not needed. By mid-2026 that had shifted. The IT Minister said on 10 June 2026 that a new AI law is required, and press reports date a MeitY Secretary statement to early July 2026 (3 or 9 July) saying drafting would begin soon. There is no draft Bill, no consultation paper, and no timeline. Nothing binds anyone today.
- What to watch
- A draft AI Bill, a MeitY consultation paper on AI regulation, or Digital India Act text carrying AI provisions.
Draft IT Rules Second Amendment, 2026
Watch- What it means
- MeitY published a draft Second Amendment to the IT Rules in March 2026. It would make platforms follow MeitY's written advisories, directions and codes as part of their due diligence (proposed Rule 3(4)). It would apply the news-content oversight rules to news posted by ordinary users, not only publishers (proposed Rule 8(1)). It would let the oversight committee hear matters the Ministry refers to it (proposed Rule 14), and keep other data-retention laws in force alongside Rule 3(1)(g) and (h). It does not add new rules on AI-made content. It has no G.S.R. number and no start date.
- What to watch
- Final notification, and what changes from the consultation draft.
Draft Regulations for Use of AI in Courts, 2026
Watch- What it means
- Reports say a Supreme Court committee published draft rules in June 2026 on how courts may use AI. We have not found the draft on the Supreme Court's website, so we do not describe its contents.
- What to watch
- Whether the Supreme Court publishes the draft or final rules on sci.gov.in.
AI (Ethics and Accountability) Bill, 2025
Watch- What it means
- Reported to be a Private Member's Bill (a bill from an MP, not the government). Such bills rarely pass. It creates no obligation.
- What to watch
- Whether it is taken up for discussion at all.
EDPB web scraping and anonymisation guidelines
Watch- What it means
- The EDPB adopted two draft guidelines on 7 July 2026: one on anonymisation, and one on web scraping for generative AI. Both are drafts, and both are open for comment until 30 October 2026.
- What to watch
- Final versions after the consultation closes on 30 October 2026.
Recently resolved
Children's-data exemptions (Fourth Schedule)
ResolvedResolved 13 November 2025Notified as part of the DPDP Rules, 2025. Rule 12, read with Parts A and B of the Fourth Schedule, disapplies Section 9(1) and 9(3) for specified classes of Data Fiduciary and for specified purposes, each subject to the conditions set out in that Part. This was in force from the date the Rules were notified — it was never awaiting a separate notification.
Last updated: 2 September 2026 · Written and edited by Sandesh Kokate
Educational only. Re-verify against the Gazette of India before relying on anything here.
Also watch: AI and copyright — DPIIT working paper (proposal, Part 2 pending)