Regulatory Map
India's digital law stack, at a glance.
Every rule you'll meet in this site sits somewhere in this stack. Start at the top — constitutional principles — and follow it down through primary Acts, Rules, guidelines, and sector regulation.
Educational only · not legal adviceLast updated: 5 October 2026Written and edited by Sandesh Kokate
Rows marked Regulator link to a regulator's own website. That is an entity identifier, not a primary-source document citation.
1
Constitutional foundation
- Article 21 · Right to Life & Personal LibertyWhat this means: Source of the fundamental right to privacy.Effective: 26 January 1950In ForcePrimary source
- Puttaswamy v. Union of India, (2017) 10 SCC 1What this means: 9-judge bench recognising privacy as fundamental.Effective: 24 August 2017In ForcePrimary source not yet confirmed
2
Primary Acts
- Digital Personal Data Protection Act, 2023What this means: Primary framework for personal data. Transitional while SPDI Rules remain in force.Effective: Phased; full enforcement by 13 May 2027
- Information Technology Act, 2000Effective: 17 October 2000
- Telecommunications Act, 2023Effective: Phased from 26 June 2024
- Consumer Protection Act, 2019Effective: 20 July 2020In ForcePrimary source
- Bharatiya Nyaya Sanhita, 2023 (BNS)What the law says: India's criminal code, replacing the Indian Penal Code, 1860. Contains offences relating to cheating, forgery, impersonation, and defamation.What this means: If an AI product can impersonate a person, forge documents, or defraud, those uses are criminal offences under the BNS — independent of any platform safe-harbour protection.Effective: In force 1 July 2024In ForcePrimary source
3
Rules & subordinate legislation
- DPDP Rules, 2025What this means: Rule 15 lets the Central Government set requirements for making personal data available to a foreign State or its agencies. The power to restrict transfers to a named country is in Section 16(1) of the DPDP Act. No such notification has been found.Effective: Phased; notified 13 November 2025 (G.S.R. 846(E); Gazette publication ID CG-DL-E-14112025-267650, published 14 November 2025)
- Promotion and Regulation of Online Gaming Rules, 2026What this means: Sets up the Online Gaming Authority of India, how games are checked and registered, user complaints and penalty inquiries. Made under the Online Gaming Act, 2025, which bans online money games.Effective: 1 May 2026 (rule 1(2))
- SPDI Rules, 2011 (under IT Act Section 43A)What this means: The SPDI Rules keep applying to sensitive personal data until DPDP is fully in force.Effective: 11 April 2011 — sunsets at full DPDP enforcementTransitionalPrimary source
- IT (Intermediary Guidelines) Rules, 2021Effective: 25 February 2021
- IT (Intermediary Guidelines & Digital Media Ethics Code) Amendment Rules, 2026What this means: Covers AI-made or AI-altered audio and video that looks real ('synthetically generated information', Rule 2(1)(wa)); plain text is not covered. Platforms must block banned kinds, label the rest and add metadata where feasible (Rule 3(3)); large social media platforms must collect and verify user declarations (Rule 4(1A)). Takedown after an order cut from 36 hours to 3 hours (Rule 3(1)(d)).Effective: In force 20 February 2026
- CERT-In Directions, 2022What this means: 6-hour cyber-incident reporting; 180-day log retention.Effective: 28 June 2022In ForcePrimary source
- Guidelines for Prevention and Regulation of Dark Patterns, 2023 (CCPA)What the law says: Prohibits 13 specified dark patterns (e.g. false urgency, basket sneaking, subscription traps, disguised ads) on platforms offering goods or services in India. Enforced through the Consumer Protection Act, 2019 — the guidelines carry no independent penalty of their own.What this means: If your interface uses deceptive or manipulative design that pushes users into choices they didn't intend, it can be treated as an unfair trade practice under consumer-protection law.Effective: In force 30 November 2023In ForcePrimary source
4
Guidelines & advisories
- AI Governance Guidelines, 2025Effective: Non-binding guidance
- IndiaAI Mission, 2024What this means: Over Rs 10,300 crore programme (exact outlay Rs 10,371.92 crore over five years; same March 2024 approval, PIB) covering compute, datasets, and safe & trusted AI.Effective: 7 March 2024 (Cabinet approval)
- MoHFW Health Data Management PolicyWhat this means: Ayushman Bharat Digital Mission — consent and federated architecture.Effective: 14 December 2020
- RBI FREE-AI Framework, 2025What the law says: An advisory report on responsible and ethical AI use by RBI-regulated entities. Guidance, not binding regulation, though it may shape future RBI directions.What this means: If you build AI for banking, lending, payments or fintech, treat this as RBI's expected direction — board-level AI governance and independent model validation — even though it isn't yet mandatory.Effective: Report released August 2025 (advisory, non-binding)GuidelinePrimary source
- Market Study on Artificial Intelligence and Competition, 2025 (CCI)What the law says: A market study, not a regulation. Flags that AI-driven algorithmic coordination and data concentration can raise concerns under the Competition Act, 2002, and states that any alleged anti-competitive conduct will be examined case by case under that Act.What this means: If your AI influences pricing or market conduct, algorithmic coordination — even without human intent — can attract competition-law scrutiny. No new obligations: the study is advisory.Effective: Published 6 October 2025 (market study, advisory — not an enforcement instrument)GuidelinePrimary source
- SEBI (Intermediaries) (Amendment) Regulations, 2025 — Regulation 16CWhat the law says: Inserts Chapter IIIB into the SEBI (Intermediaries) Regulations, 2008. Any person regulated by the Board who uses AI or machine-learning tools — whether built in-house or procured from a third-party technology service provider, and irrespective of the scale and scenario of adoption — is solely responsible for the privacy, security and integrity of investors' and stakeholders' data including data held in a fiduciary capacity; for the output arising from use of those tools; and for compliance with applicable laws. SEBI may take enforcement action for violations.What this means: If you are SEBI-regulated and you use AI anywhere in your stack, you own the outcome. Outsourcing the model to a vendor does not outsource the liability. This is the binding layer — distinct from SEBI's June 2025 AI/ML consultation paper, which is still only a proposal.Effective: In force 10 February 2025 (notified 6 February 2025; commencement is the date that matters)
5
Sector regulation
- RBI — payments, lending, KYCWhat this means: Binding within remit.Effective: Ongoing
- SEBI — securities market intermediariesWhat this means: Binding within remit.Effective: Ongoing
- IRDAI — insuranceWhat this means: Binding within remit.Effective: Ongoing
- TRAI — telecomWhat this means: Binding within remit.Effective: OngoingIn ForceRegulator ↗
What isn't settled yet
The notifications, appointments, and court questions still open. Open the full tracker →
Confirmed = fixed and dated · Pending = government action awaited · Scheduled = dated, not yet live · Watch = dated future change, not yet in effect · Under challenge = before the courts, could change.
Online Gaming Act, 2025: Act text and registration notices
Pending- What it means
- The Online Gaming Rules, 2026 are in force from 1 May 2026. We have not yet opened the Act's own text, so its definition of an online money game is not quoted here. Registration of social games applies only if the government names a category in a notice (rule 12(1)).
- What to watch
- The Act's text on India Code or eGazette, and any notice naming social games that must register.
Full enforcement date
Confirmed- What it means
- The core obligations become enforceable on 13 May 2027 — 18 months after the DPDP Rules were notified on 13 November 2025. This is the one fixed date in the timeline.
- What to watch
- Two things. First, the 13 vs 14 May 2027 question above. Second, Section 1 of the Act lets the Central Government appoint different dates for different provisions — so this date can move by notification alone.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
Significant Data Fiduciary (SDF) criteria
Pending- What it means
- The government can designate certain large or higher-risk data fiduciaries as 'Significant', which triggers extra duties — appointing a DPO, independent audits, and data protection impact assessments. The criteria for who qualifies have not been notified yet.
- What to watch
- A government notification setting the SDF designation criteria.
Lowered age for children's data (Section 9(5))
Pending- What it means
- Section 9(5) of the DPDP Act lets the government notify a Data Fiduciary as able to process a child's personal data at an age below 18, where it is satisfied that fiduciary's processing is verifiably safe. That power has not been exercised. The age threshold therefore remains 18 for everyone. Note that this is narrower than it sounds: it is a per-fiduciary designation, not a general lowering of the age.
- What to watch
- A notification designating any Data Fiduciary under Section 9(5), and the age specified.
Section 16(1) restriction notification (cross-border transfers)
Pending- What it means
- Section 16(1) of the DPDP Act lets the government restrict transfers of personal data to a named country by notification. We have found no such notification, so no country is off-limits under Section 16(1). Rule 15 of the DPDP Rules is different: it lets the government set requirements for making data available to a foreign State.
- What to watch
- A notification under Section 16(1) of the DPDP Act naming any restricted country.
Data Protection Board — established in law, not yet staffed
Pending- What it means
- The Board is established in law (DPDP Act s.18; G.S.R. 843(E)). As notified, it has a Chairperson and four Members, to be appointed through a Search-cum-Selection Committee (Government reply, Lok Sabha Unstarred Question 3960, 12 August 2026). The posts were advertised in Employment News on 6 June 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 October 2026.
- What to watch
- A Gazette or MeitY notification actually appointing the Chairperson or any Member. Nominations being invited is not an appointment.
Consent Manager regime
Scheduled- What it means
- The Consent Manager registration system (Rule 4) is set to commence on 13 November 2026. Consent Managers will register with the Board and take on defined obligations. It is not operational yet.
- What to watch
- Registration opening and any operational guidelines.
Constitutional challenge in the Supreme Court
Under challenge- What it means
- Writ petitions challenge parts of the DPDP Act — chiefly Section 44(3), which amended the RTI Act, plus Sections 17(1)(c), 17(2), 33(1) and 36, and Rules 17 and 23(2) of the DPDP Rules. On 16 February 2026 the Supreme Court issued notice, referred the questions to a larger bench, and declined to stay the framework. There is no stay — the DPDP framework operates as normal while this runs.
- What to watch
- The Union's counter-affidavit, and the next listing.
- 16 Feb 2026 — Notice issued; referred to a larger bench; interim stay refused.
New fraudulent-transaction framework for banks
Watch- What it means
- RBI has published a framework on fraudulent electronic banking transactions. We have not read the final text, so we do not state its start date, limits or compensation amounts.
- What to watch
- The final Directions on rbi.org.in, opened and read.
RBI Department of Supervision consolidation
Watch- What it means
- After the Department of Regulation consolidated its circulars in November 2025, the Department of Supervision began the same exercise for supervisory instructions — organising them into entity-specific Directions covering functions such as the compliance function and concurrent audit. This is a second wave, separate from the November 2025 one.
- What to watch
- Which supervisory circulars are withdrawn, and what replaces them.
Draft PPI Directions, 2026
Watch- What it means
- The RBI published a draft replacement for the wallet rulebook on 22 April 2026, and took comments until 22 May 2026. It has not been finalised, so the Master Direction of 27 August 2021 is still the rule.
- What to watch
- Whether the draft is issued as final, and from what date.
RBI Draft Guidance on Regulatory Principles for Model Risk Management, 2026
Watch- What it means
- Draft guidance that brings AI and machine-learning models into a board-owned Model Risk Management Framework. It covers banks, NBFCs, all-India financial institutions, asset reconstruction companies and credit information companies. It expects a board-approved framework, risk-based model tiering, a model inventory, independent validation, explainability, human-in-the-loop and kill-switch controls, and accountability for third-party models. Released 24 June 2026 (Press Release 2026-2027/528). Comments closed 24 July 2026. Not final as of 6 October 2026. Once final, it replaces RBI's 2002 guidance on credit risk models.
- What to watch
- Whether RBI issues the final guidance, and from what date.
SEBI — Advisory on Emerging Advanced AI Tools for Vulnerability Detection
Watch- What it means
- SEBI issued an advisory on 5 May 2026 about advanced AI tools used to find security weaknesses. The circular page has been verified, but the advisory PDF has not yet been read, so its exact requirements are not yet known.
- What to watch
- What the advisory requires, and whether it becomes a binding amendment.
A standalone AI law for India
Watch- What it means
- In November 2025 MeitY said a separate AI law was not needed. By mid-2026 that had shifted. The IT Minister said on 10 June 2026 that a new AI law is required, and press reports date a MeitY Secretary statement to early July 2026 (3 or 9 July) saying drafting would begin soon. There is no draft Bill, no consultation paper, and no timeline. Nothing binds anyone today.
- What to watch
- A draft AI Bill, a MeitY consultation paper on AI regulation, or Digital India Act text carrying AI provisions.
Draft IT Rules Second Amendment, 2026
Watch- What it means
- MeitY published a draft Second Amendment to the IT Rules in March 2026. It would make platforms follow MeitY's written advisories, directions and codes as part of their due diligence (proposed Rule 3(4)). It would apply the news-content oversight rules to news posted by ordinary users, not only publishers (proposed Rule 8(1)). It would let the oversight committee hear matters the Ministry refers to it (proposed Rule 14), and keep other data-retention laws in force alongside Rule 3(1)(g) and (h). It does not add new rules on AI-made content. It has no G.S.R. number and no start date.
- What to watch
- Final notification, and what changes from the consultation draft.
Draft Regulations for Use of AI in Courts, 2026
Watch- What it means
- Reports say a Supreme Court committee published draft rules in June 2026 on how courts may use AI. We have not found the draft on the Supreme Court's website, so we do not describe its contents.
- What to watch
- Whether the Supreme Court publishes the draft or final rules on sci.gov.in.
AI (Ethics and Accountability) Bill, 2025
Watch- What it means
- Reported to be a Private Member's Bill (a bill from an MP, not the government). Such bills rarely pass. It creates no obligation.
- What to watch
- Whether it is taken up for discussion at all.
EDPB web scraping and anonymisation guidelines
Watch- What it means
- The EDPB adopted two draft guidelines on 7 July 2026: one on anonymisation, and one on web scraping for generative AI. Both are drafts, and both are open for comment until 30 October 2026.
- What to watch
- Final versions after the consultation closes on 30 October 2026.
Recently resolved
Children's-data exemptions (Fourth Schedule)
ResolvedResolved 13 November 2025Notified as part of the DPDP Rules, 2025. Rule 12, read with Parts A and B of the Fourth Schedule, disapplies Section 9(1) and 9(3) for specified classes of Data Fiduciary and for specified purposes, each subject to the conditions set out in that Part. This was in force from the date the Rules were notified — it was never awaiting a separate notification.
Also watch: AI and copyright — DPIIT working paper (proposal, Part 2 pending)