Fifteen years from the Justice A.P. Shah Committee to the substantive core of the DPDP Rules 2025. Three withdrawn or superseded bills. One nine-judge constitutional judgment. Below is the dated arc.
The Committee reports on data protection in October 2012, proposing nine principles and recommending a Privacy Commissioner. First formal Indian call for a data protection statute.
A unanimous nine-judge bench of the Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 recognises the fundamental right to privacy under Article 21. The constitutional foundation of every subsequent data protection bill.
MeitY constitutes a committee under Justice B.N. Srikrishna to draft a data protection framework. Committee reports on 27 July 2018 with a draft bill.
The Bill is referred to a Joint Parliamentary Committee. JPC report tabled 16 December 2021 with 81 amendments. Withdrawn in August 2022.
Government withdraws the Bill and announces intent to introduce a simplified replacement.
Simplified draft published for public consultation. Shorter (30 sections) and consent-centric.
Passed by Lok Sabha on 7 August 2023 and Rajya Sabha on 9 August 2023.
Gazette of India publication. Substantive provisions await Rules and Board.
MeitY publishes draft Rules for public consultation. 45-day window that is later extended.
F. No. 2(1)/2026-Pers.I. Follow-up notification on 6 June 2026. Cabinet Secretary heads the search-cum-selection committee.
Gazette Notification G.S.R. 846(E). Rules 1, 2 and 17 to 21 take effect from this date. Phased enforcement begins.
As of August 2026, no Chairperson or Member appointment has been publicly announced. Search-cum-selection process ongoing.
Consent Manager registration opens. Any organisation intending to operate a Consent Manager platform can file with the Data Protection Board.
The substantive core of the DPDP framework binds Data Fiduciaries. Consent notice format (Rule 3), security safeguards (Rule 6), breach notification (Rule 7), retention (Rule 8), verifiable parental consent (Rule 10), SDF obligations (Rules 12, 13), Data Principal rights (Rule 14), cross-border transfer (Rule 15).
Data Protection Board Chairperson and Members appointed. Consent Manager registration opens 14 November 2026. Get your consent stack designed.
Ship your Rule 3 notice, Rule 6 security controls, Rule 7 breach handler, Rule 8 retention schedule, Rule 10 VPC flow, Rule 14 DSR handler.
Rules 3 to 16, 22, 23 in force. Board begins substantive inquiries. First penalty orders expected in the second half of 2027.
