India's digital rules,
translated for builders.
An independent, editorial reference for the DPDP Act, India's AI governance guidelines, and the evolving IT Rules — written in plain English for founders, freelancers, and creators. Every claim links back to the official source.
DPDP Full Enforcement
UPCOMINGuntil full enforcement · 13 May 2027
18 months from the 13 Nov 2025 notification.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
Educational only. Re-verify enforcement dates against the Gazette of India before relying on them.
Not sure where to start? Pick your role.
Three questions, tuned to how you actually work — not a generic quiz.
Do you directly collect personal data of Indian users?
Signups, emails, phone numbers, payment details on your product.
The DPDP Rules are notified — here's what changes over the 18-month window from their notification on 13 November 2025.
The Ministry of Electronics & IT notified the DPDP Rules, 2025 on 13 November 2025, starting a phased compliance window. If you handle personal data of Indian users — even as a solo freelancer — some duties are live now; the Consent Manager rules commence in November 2026; the core obligations (notice, consent, rights, breach reporting, security) apply from 13 May 2027.
🧭 Built for how you work
Start from your role — we'll route you to what actually applies.
You're likely a Data Fiduciary. Consent, breach notification, cross-border transfers — the compliance stack for early-stage startups.
Appointing a Data Protection Officer is an enhanced duty only for Significant Data Fiduciaries — and the criteria for that status are still pending.
See founder checklistUsually a Data Processor. Contracts, sub-processing, data handling for Indian and overseas clients — without becoming your client's liability.
See freelancer guideIT Rules on synthetic media, labelling of AI-generated content, and platform grievance mechanisms you should know about.
See creator roadmapFiduciary for your users, Processor for your customers' — how to handle both.
See the SaaS guideDark patterns, the 3-year dormancy rule, and payment data localisation.
See the store guideLead lists, TRAI DND, cookie consent, and children's advertising rules.
See the agency guideThe employment consent exception, AI hiring bias, and monitoring disclosure.
See the HR guideHandling citizen data makes a department a Data Fiduciary. Breach response, the 6-hour CERT-In clock, and the Rule 7 duties to prepare for now.
See breach response guideLive regulatory status
Where each major framework stands right now.
Primary framework for personal data protection in India.
Procedural rules implementing the DPDP Act; phased compliance windows.
Established in law (DPDP Act s.18; G.S.R. 843(E)). Chairperson and four Members to be appointed through a Search-cum-Selection Committee (Lok Sabha Unstarred Question 3960, 12 Aug 2026). Posts advertised in Employment News on 6 Jun 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 Oct 2026.
Non-binding principles on human oversight, transparency, and safety.
Intermediary due diligence; synthetic media labelling obligations.
Rule 15, DPDP Rules — transfers allowed except to countries the Government restricts. No restricted list notified yet.
"In force" is not the same as "enforceable"
The DPDP Act received presidential assent on 11 August 2023 — that's in force. But most operative sections wait on the Rules being notified and the Data Protection Board being constituted before they become enforceable against you. We flag this distinction on every page so you don't over- or under-comply.
📚 The library
Data Privacy
DPDP Act, Rules, and Data Principal rights.
OpenSignificant Data Fiduciary
Who the DPO and audit duties are for — and why no one is one yet.
OpenChildren's data
Under-18 rules: verifiable parental consent, no tracking, no targeted ads.
OpenConsent Manager
Who actually registers — and the 2026 deadline aimed at an unstaffed Board.
OpenAI Policy
MeitY guidelines and AI governance.
OpenPlatforms & Internet
IT Rules, intermediary duties, and deepfake labelling.
OpenGoing Global
India vs GDPR, cross-border transfers.
OpenDPDP vs GDPR for AI
Training data, public data, automated decisions — side by side.
OpenThis Week
Latest updates, dated and sourced.
OpenRegulatory Map
The full stack, from Puttaswamy down.
OpenGlossary
Every defined term, plain English.
Open📰 Latest updates
View all →- Under challenge7 Aug 2026Data Privacy
Legal effect: No stay, no judgment. The DPDP framework operates as normal while the case runs.
The Supreme Court heard further arguments in the constitutional challenge to the DPDP Act and the RTI amendment.
- Watch9 Jul 2026AI Policy
Legal effect: Nothing changes today. There is no draft Bill, no consultation paper, and no timeline. This is stated intent, not law.
MeitY signals a standalone AI law: the Secretary told the press that discussions on standalone AI regulation are ongoing and drafting will begin soon.
Reported, not confirmed — press reports date this to early July 2026 (3 or 9 July); no primary record foundPending - Watch3 Jun 2026AI Policy
Legal effect: No duty for businesses. We have not found the draft on sci.gov.in, so we do not describe its contents.
Reported, not confirmed: press reports say a Supreme Court committee published draft rules on how courts may use AI.
Reported, not confirmed — no document found on sci.gov.inPending - WatchMar 2026Platforms
Legal effect: Nothing binding yet. The draft is not notified. The February 2026 amendment (G.S.R. 120(E)), which carries the AI-media duties, is separately in force.
MeitY released the Draft IT (Intermediary Guidelines and Digital Media Ethics Code) Second Amendment Rules, 2026 for public consultation.