Reference · Living tracker
What isn't settled yet
India's data-protection and AI rules are still being built. Most guides explain what the law says. This page tracks what it hasn't decided yet — the notifications, appointments, and court questions still open — and moves each one to 'Recently resolved' the day it lands.
Educational only · not legal adviceLast reviewed: 2 September 2026Reviewed by Sandesh Kokate, Editor
Bookmark this page to see what's fixed and what's still moving, at a glance.
Confirmed = fixed and dated · Pending = government action awaited · Scheduled = dated, not yet live · Watch = dated future change, not yet in effect · Under challenge = before the courts, could change.
Full enforcement date
Confirmed- What it means
- The core obligations become enforceable on 13 May 2027 — 18 months after the DPDP Rules were notified on 13 November 2025. This is the one fixed date in the timeline.
- What to watch
- Two things. First, the 13 vs 14 May 2027 question above. Second, Section 1 of the Act lets the Central Government appoint different dates for different provisions — so this date can move by notification alone.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.
Significant Data Fiduciary (SDF) criteria
Pending- What it means
- The government can designate certain large or higher-risk data fiduciaries as 'Significant', which triggers extra duties — appointing a DPO, independent audits, and data protection impact assessments. The criteria for who qualifies have not been notified yet.
- What to watch
- A government notification setting the SDF designation criteria.
Lowered age for children's data (Section 9(5))
Pending- What it means
- Section 9(5) of the DPDP Act lets the government notify a Data Fiduciary as able to process a child's personal data at an age below 18, where it is satisfied that fiduciary's processing is verifiably safe. That power has not been exercised. The age threshold therefore remains 18 for everyone. Note that this is narrower than it sounds: it is a per-fiduciary designation, not a general lowering of the age.
- What to watch
- A notification designating any Data Fiduciary under Section 9(5), and the age specified.
Restricted-country list (cross-border transfers)
Pending- What it means
- Personal data may be transferred outside India except to countries the government specifically restricts. No restricted-country list has been notified yet — so no country is currently off-limits under this rule.
- What to watch
- A government notification naming any restricted countries.
Data Protection Board — established in law, not yet staffed
Pending- What it means
- The Board was legally established on 13 November 2025, and will consist of a Chairperson and four Members (G.S.R. 845(E), 13 November 2025). MeitY began the appointment process on 6 May 2026, writing to all Union Ministries and Departments and all State and UT Chief Secretaries seeking nominations, and advertised one Chairperson post and four Member posts. A further notification followed on 6 June 2026. As at 4 Sep 2026, no appointment has been notified. Until the Board is staffed there is no active regulator to adjudicate complaints, register Consent Managers, or issue the standards the Rules assume it will issue.
- What to watch
- A Gazette or MeitY notification actually appointing the Chairperson or any Member. Nominations being invited is not an appointment.
Consent Manager regime
Scheduled- What it means
- The Consent Manager registration system (Rule 4) is set to commence on 13 November 2026. Consent Managers will register with the Board and take on defined obligations. It is not operational yet.
- What to watch
- Registration opening and any operational guidelines.
Constitutional challenge in the Supreme Court
Under challenge- What it means
- Writ petitions challenge parts of the DPDP Act — chiefly Section 44(3), which amended the RTI Act, plus Sections 17(1)(c), 17(2), 33(1) and 36, and Rules 17 and 23(2) of the DPDP Rules. On 16 February 2026 the Supreme Court issued notice, referred the questions to a larger bench, and declined to stay the framework. Substantive arguments have since begun: the second day of hearing was on 7 August 2026, before Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana. Petitioners argued the amendment removes the public-interest balancing test that Subhash Chandra Agarwal (2019) had settled. The Bench indicated it will decide whether the distinction between digital personal data and other information rests on an intelligible differentia with a rational nexus, and whether a blanket bar on disclosure is permissible or proportionality is constitutionally required. The Solicitor General told the Court the Union would file its reply within two weeks. The matter has been directed to be listed on a non-miscellaneous day. There is still no stay — the DPDP framework operates as normal while this runs.
- What to watch
- The Union's counter-affidavit, and the next listing.
- 16 Feb 2026 — Notice issued; referred to a larger bench; interim stay refused.
- 7 Aug 2026 — Day 2 of arguments. Union to file reply within two weeks; listed on a non-miscellaneous day.
New fraudulent-transaction framework for banks
Watch- What it means
- From 1 January 2027, a broader rule replaces the current framework on unauthorised electronic banking transactions. It covers transactions obtained by fraud on your credentials, and transactions you approved under threat or pressure. RBI issued the final amendment on 24 June 2026, after a draft in March 2026 that would have started on 1 July 2026.
- What to watch
- Commencement on 1 January 2027, and any further amendment before then.
RBI Department of Supervision consolidation
Watch- What it means
- After the Department of Regulation consolidated its circulars in November 2025, the Department of Supervision began the same exercise for supervisory instructions — organising them into entity-specific Directions covering functions such as the compliance function and concurrent audit. This is a second wave, separate from the November 2025 one.
- What to watch
- Which supervisory circulars are withdrawn, and what replaces them.
Draft PPI Directions, 2026
Watch- What it means
- The RBI published a draft replacement for the wallet rulebook on 22 April 2026, and took comments until 22 May 2026. It has not been finalised, so the Master Direction of 27 August 2021 is still the rule.
- What to watch
- Whether the draft is issued as final, and from what date.
SEBI — Advisory on Emerging Advanced AI Tools for Vulnerability Detection
Watch- What it means
- SEBI issued an advisory on 5 May 2026 about advanced AI tools used to find security weaknesses. The circular page has been verified, but the advisory PDF has not yet been read, so its exact requirements are not yet known.
- What to watch
- What the advisory requires, and whether it becomes a binding amendment.
A standalone AI law for India
Watch- What it means
- In November 2025 MeitY said a separate AI law was not needed. By mid-2026 that had shifted. The IT Minister said on 10 June 2026 that a new AI law is required, and the MeitY Secretary said on 9 July 2026 that drafting would begin soon. There is no draft Bill, no consultation paper, and no timeline. Nothing binds anyone today.
- What to watch
- A draft AI Bill, a MeitY consultation paper on AI regulation, or Digital India Act text carrying AI provisions.
Draft IT Rules Second Amendment, 2026
Watch- What it means
- MeitY released a draft second amendment to the IT Rules on 30 March 2026 for consultation. It would extend the Code of Ethics to individual social media users posting news and current affairs, mandate AI-content labelling, widen MeitY's direction-issuing power under Rule 3(4), extend retention beyond 180 days, and tighten takedown deadlines. It has not been notified.
- What to watch
- Final notification, and what changes from the consultation draft.
Draft Regulations for Use of AI in Courts, 2026
Watch- What it means
- The Supreme Court's AI Committee published a preliminary draft on 3 June 2026 and invited comments. AI would be strictly assistive: no algorithmic case outcomes, no bail or recidivism scoring, no profiling of parties or witnesses. Research, translation, transcription and accessibility tools would be permitted. This governs the judiciary's own use of AI, not the private sector.
- What to watch
- The final version after comments, and whether the proposed apex supervisory body is constituted.
AI (Ethics and Accountability) Bill, 2025
Watch- What it means
- A Private Member's Bill introduced in the Lok Sabha in December 2025. It proposes a statutory AI ethics committee, ethical review for high-risk and surveillance systems, bias audits, limits on AI in law enforcement and employment, and penalties up to ₹5 crore. Private Member's Bills rarely pass. It creates no obligation.
- What to watch
- Whether it is taken up for discussion at all.
EDPB web scraping and anonymisation guidelines
Watch- What it means
- The EDPB adopted two draft guidelines on 7 July 2026: one on anonymisation, and one on web scraping for generative AI. Both are drafts, and both are open for comment until 30 October 2026.
- What to watch
- Final versions after the consultation closes on 30 October 2026.
Recently resolved
Children's-data exemptions (Fourth Schedule)
ResolvedResolved 13 November 2025Notified as part of the DPDP Rules, 2025. Rule 12, read with Parts A and B of the Fourth Schedule, disapplies Section 9(1) and 9(3) for specified classes of Data Fiduciary and for specified purposes, each subject to the conditions set out in that Part. This was in force from the date the Rules were notified — it was never awaiting a separate notification.
Last updated: 4 Sep 2026 · Reviewed by Sandesh Kokate, Editor
Educational only. Re-verify against the Gazette of India before relying on anything here.