A running log of what MeitY, the Board, the Central Government, and TDSAT have actually done. Circulars, notifications, orders, amendments — anything a compliance team needs to know about, with a link to the primary source so you never have to take our word for it. Latest first. Bookmark this or grab the email alert; RSS is on the list, not shipped yet.
MeitY issued a follow-up notification on the search-cum-selection process for the Data Protection Board of India. The process, chaired by the Cabinet Secretary, is expected to conclude by end of Q4 calendar 2026 based on the timeline signalled in the earlier circular.
Impact: Enforcement remains blocked until the Board is seated. Substantive Rules take effect 14 May 2027 regardless.
MeitY published F. No. 2(1)/2026-Pers.I inviting applications for the position of Chairperson and four Members of the Data Protection Board of India. Eligibility criteria specify ability, integrity, standing, and expertise in data governance, law, dispute resolution, information technology, or related fields.
Impact: First operational step toward Board seating. Enforcement architecture begins to move.
MeitY notified the final Digital Personal Data Protection Rules, 2025 via Gazette Notification G.S.R. 846(E). Rules 1, 2 and 17 to 21 take effect on this date. Rule 4 (Consent Manager registration) takes effect on 14 November 2026. Rules 3, 5 to 16, 22, and 23 take effect on 14 May 2027.
Impact: The core operational framework of DPDP is now law. Phased enforcement clock has started. All Data Fiduciaries have 18 months to prepare for substantive compliance.
MeitY published the draft DPDP Rules 2025 for public consultation. Consultation window ran for 45 days and was subsequently extended. Ten months later, the final Rules were notified with material adjustments to consent notice format, breach notification form, and SDF obligations.
Impact: First view of how MeitY intended to operationalise the DPDP Act. Established the baseline that the final notified Rules refined.
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) was published in the Gazette of India. The Act covers 44 sections across 8 chapters. Substantive provisions await Rules and the seating of the Data Protection Board.
Impact: India's first horizontal data protection statute. Foundation for the entire framework.
Any organisation intending to operate a registered Consent Manager platform under Section 2(g) and Section 6(3) can file with the Data Protection Board from this date. First tranche of Consent Managers likely to be approved by Q1 calendar 2027.
The consent notice format, security safeguards, breach notification, retention limits, verifiable parental consent, SDF obligations, algorithm due diligence, Data Principal rights timelines, and cross-border transfer mechanism all become live obligations from this date. First substantive Board orders expected in the second half of 2027.
