--- title: "India Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/india-data-protection-privacy-regulation/ source_html: /jurisdictions/india/index.html description: "India data protection and privacy regulation: 10 categories, 79 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 731957fe866d60a959f91e8e7dccadcb45e2b0c9b3c44095bcd50abee56f2691 generator: "fe-fleet/md-twin@1.0" --- # India Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # India Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/india/), [World Payments](https://payments.gi/jurisdictions/india/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 79 claims · 50 sources in the cumulative register Download report (PDF) Expand all India's Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, together with enforcement-timeline notifications and the constitution of the Data Protection Board of India, bringing the Digital Personal Data Protection Act, 2023 into practical operation for the first time. Data collected 2026-11-04 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework (1 open gap). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=INDIA)[Build Report](/reports/?j=INDIA)[Compare](/compare/?j=INDIA) Framework posture In transition 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Data Protection Board of India (DPBI) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 79 Claims 0 Tier-1 sources Traffic-light mix 10 amber (sums to 10 rendered categories; click to filter) No red categories; 24 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,208 Full executive summary 203 ###### Latest update · 4 November 2026 #### Lead Signal India's Digital Personal Data Protection regime continues to move through a genuinely staged commencement rather than a single effective date, and the developments are best understood against that staging rather than as standalone events. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 was made under section 43(1) of the Act on 5 October 2026 and gazetted the following day. It corrects the wording of section 10(2)(c)(ii) from periodic audit to periodic data audit, and makes a parallel correction to the guardian-consent wording in section 9. Neither correction creates a new substantive obligation; both are drafting fixes to provisions whose underlying operative duties remain on the horizon rather than currently binding. Separately, Rule 4 of the Digital Personal Data Protection Rules, 2025, which governs Consent Manager registration, is set to commence on 13 or 14 November 2026 (secondary sources disagree by a day on the gazette date), while the bulk of substantive obligations under Rules 3, 5 through 16, 22 and 23 remain scheduled for 13 or 14 May 2027. The Data Protection Board of India, whose chairperson and members were appointed on 6 June 2026, was reported as of mid-October 2026 to still be staffing its operational capacity, meaning no substantive breach has yet been adjudicated under it. The combined picture is one of institutional machinery coming into being, and drafting being tidied, while the substantive weight of the regime, controller and processor duties, data-subject rights mechanics, and the enforcement and penalty powers under section 33, remains pending. #### Other Developments A fixed-ceiling penalty schedule under section 33 remains drafted but not yet operative. Penalties of up to rupees 250 crore, understood to be in the order of USD 26 million, per violation are structured as a ceiling within which the Board determines the actual penalty based on a proportionality assessment, rather than as a turnover-linked percentage model. This schedule is tied to the same May 2027 commencement horizon as the bulk of substantive obligations and so carries no present enforcement weight. The guardian-consent correction in section 9 is drafting-only at this stage. The Removal of Difficulties Order's parallel correction to the guardian-consent wording addresses textual precision rather than altering the substantive consent mechanism for children and persons with disabilities, which itself does not yet operate as a binding duty. #### Cross-Monitor Connections The staged commencement of India's data-protection enforcement and penalty architecture is a matter of standing interest to financial-integrity monitoring insofar as regulated financial entities handling personal data will eventually sit inside both regimes concurrently; that intersection is noted here as a link-out rather than analysed further in this brief. #### Outlook The near-term horizon is dominated by two dates: Consent Manager registration under Rule 4, expected around 13 to 14 November 2026, and the substantive-obligations commencement expected around 13 to 14 May 2027. Until the later date, the practical weight of the DPDP Act remains concentrated in institutional stand-up and drafting correction rather than in operative controller duties or enforceable penalties, and the Data Protection Board's staffing trajectory will determine how quickly adjudicative capacity catches up with the obligations once they take effect. 4 earlier updates not shown here. ###### Standing brief · as of 6 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal India's Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, together with enforcement-timeline notifications and the constitution of the Data Protection Board of India, bringing the Digital Personal Data Protection Act, 2023 into practical operation for the first time. This is the defining data-protection development for India: the regime is now structurally live, with a functioning regulator, but substantively incomplete, since the consent-manager infrastructure and the full set of data-fiduciary compliance duties are phased to commence only in November 2026 and May 2027 respectively. Operators handling personal data in India face a multi-year compliance-maturity gap between what is legally in force today and what will eventually bind them under the completed regime. The Act's material scope is confined to personal data in digital form; non-personal and non-digital data collection and handling currently falls, where regulated at all, under the Information Technology Act, 2000 and its 2011 Privacy Rules rather than under the DPDP framework itself. #### Other Developments Breach notification is already binding. Data fiduciaries must promptly notify the Data Protection Board and affected individuals of a personal-data breach, followed by a detailed report to the Board within 72 hours — a core obligation understood to be in force from Phase I of the rollout. Consent notices must now stand alone. Where processing relies on consent, the DPDP Rules require notices to be standalone, separate from standard terms of service, and to include a withdrawal mechanism as easy to use as the mechanism for giving consent in the first place. Consent managers face a defined retention duty. Once the consent-manager infrastructure becomes operative from Phase II, consent managers will be required to retain comprehensive consent records for a minimum of seven years without accessing the underlying personal data itself. Cross-border transfer has adopted a more permissive posture than earlier drafts or the GDPR. The DPDP Rules generally permit personal-data transfer outside India except to jurisdictions the government specifically restricts, a blacklist-style rather than adequacy-style mechanism; no restricted-jurisdiction list has yet been notified. The government also retains a power to notify categories of personal data that may not leave India without approval, not yet exercised. Children and persons with disabilities receive special protection. The DPDP Rules provide special protections for children and persons with disabilities as part of consent, notice, and breach-reporting requirements, although the operational mechanics were not resolved to a specific claim this cycle. Penalties can reach the hundreds of crores. The Data Protection Board of India may impose penalties for non-compliance with reasonable security safeguards or timely breach disclosure reportedly reaching INR 200 to 250 crore, though secondary sources reviewed this cycle diverge on the exact ceiling. #### Cross-Monitor Connections India's phased DPDP implementation is relevant to advennt's ongoing coverage of the online-gaming sector, where operators handling personal data for age verification, KYC, and payment processing will eventually need to align with the full data-fiduciary duties once Phase III takes effect in May 2027, and to financial-integrity's coverage of customer due diligence obligations, which will increasingly intersect with DPDP consent and cross-border transfer requirements as the regime matures. World-payments' coverage of India's payment-instrument authentication tightening is also adjacent: strengthened authentication requirements and personal-data-handling obligations under DPDP will increasingly need to be read together as India's regulatory perimeter for digital identity and payments data continues to develop. #### Outlook The two fixed milestones to watch are 13 November 2026, when consent-manager registration and operational obligations — including Indian incorporation, a minimum INR 2 crore net worth, a prohibition on subcontracting, and seven-year consent-record retention — become operative, and 13 May 2027, when the full set of data-fiduciary compliance duties under the DPDP Act completes the phased implementation. Whether the government exercises its cross-border data-localisation power by notifying restricted categories or jurisdictions, and whether the divergent penalty-ceiling figures reported by secondary sources are reconciled against a primary legislative or gazette text, are the two evidentiary gaps most likely to sharpen this assessment next cycle. Read full brief · 1208 words Standing brief, as of 28 September 2026. #### Regulatory Status India's data protection regime crossed into operational status with the 13 November 2025 notification of the Digital Personal Data Protection Rules, 2025, the concurrent establishment of the Data Protection Board of India, and an accompanying Enforcement Notification. This gives practical effect to the Digital Personal Data Protection Act, 2023 more than two years after enactment, via a phased commencement architecture running through to 13 May 2027. Interim milestones include Consent Manager registration becoming effective in November 2026. Substantive obligations now moving toward enforceability include itemised notice and consent standards, accessible rights-exercise channels, enhanced Significant Data Fiduciary duties (annual DPIAs and audits), a 72-hour breach-notification requirement, a Rule 13(4) traffic-data localisation restriction for Significant Data Fiduciaries, and Section 9's verifiable parental-consent requirement for children's data. The Data Protection Board's power to impose penalties of up to INR 250 crore per violation is established in statute, but its current operational capacity to exercise that power is disputed between sources. #### Outlook Track the November 2026 Consent Manager milestone and the 13 May 2027 full-enforceability date, alongside resolution of the Data Protection Board's actual staffing status, which is the dominant open uncertainty for enforcement credibility in this jurisdiction. Read full brief · 203 words Key regulatory facts for India Regulatory Dimension India Standing Position Jurisdiction India (IN) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 79 sourced findings) Regulator & Framework Regulator now exists and rules are finalized (not draft), but the material scope, territorial scope and registration provisions are enacted-but-not-yet-effective pending the 13 May 2027 commencement date. Lawful Processing & Special Data Lawful-basis and consent architecture is well documented; special-category and pseudonymisation treatment diverges structurally from GDPR and required an explicit absence finding for pseudonymisation. Data Subject Rights Core rights are documented via secondary legal analysis, but portability, restriction/objection, and precise deadline mechanics require primary Rule-text confirmation. Controller/Processor Duties Strong secondary-source coverage of DPIA/DPO/breach/retention duties, but exact SDF designation thresholds and breach-notification timelines await primary Rule-text confirmation. Primary Instruments Cited International Association of Privacy Professionals, International Association of Privacy Professionals, OneTrust DataGuidance, SCC Online, India Data Law Last Confirmed / Updated 2026-11-04 (50 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### India: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Regulator now exists and rules are finalized (not draft), but the material scope, territorial scope and registration provisions are enacted-but-not-yet-effective pending the 13 May 2027 commencement date. Primary framework Digital Personal Data Protection Act, 2023 (DPDPA) and Digital Personal Data Protection Rules, 2025 Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Regulator now exists and rules are finalized (not draft), but the material scope, territorial scope and registration provisions are enacted-but-not-yet-effective pending the 13 May 2027 commencement date. #### Sub-modules (5) #### Regulator And AuthorityGreen The DPBI is a four-person board constituted immediately upon the 13 Nov 2025 notification of the Rules, with its establishment and operational powers already in force. Claims (9): - The Data Protection Board of India's establishment and operational/powers provisions were brought into force immediately upon the 13 November 2025 notification of the DPDP Rules, 2025. - Data Protection Board of India — Disputed: one June 2026 source claims a Chairperson was appointed; two July-August 2026 sources state no Chairperson or Member had been appointed - Data Protection Board of India — established via a 13 November 2025 MeitY notification, alongside the DPDP Rules and an Enforcement Notification - The Data Protection Board of India was formally established on 13 November 2025, immediately upon notification of the DPDP Rules 2025. - Data Protection Board of India — Chairperson and four Member posts remain unfilled as of 14 October 2026, so the Board cannot yet hold proceedings or exercise adjudicatory/penalty powers - Data Protection Board of India — is established as a body corporate under s.18 DPDP Act 2023, effective 13 November 2025: true - Data Protection Board of India — Established as a body corporate with effect from the date notified by the Central Government, with perpetual succession and power to sue/be sued - Reports conflict on DPBI staffing status. - MeitY published notifications in the Official Gazette on 14 November 2025 bringing into force the DPDPA, the DPDP Rules 2025, and establishing the Data Protection Board. #### Act And InstrumentsAmber DPDPA 2023 plus the Digital Personal Data Protection Rules, 2025 form the omnibus instrument; implementation is phased with full applicability 13 May 2027. Claims (12): - The DPDPA becomes applicable to all entities and government departments 18 months after the 13 November 2025 Rules notification, i.e., 13 May 2027. - Digital Personal Data Protection (Removal of Difficulties) Order, 2026 — Substitutes wording in DPDP Act Sections 9(1) and 10(2)(c)(ii), effective 6 October 2026, gazetted 7 October 2026; creates no new duty, moves no commencement date - DPDP Rules, 2025 — The DPDP Rules 2025 implement the DPDPA 2023 via a staggered three-phase commencement schedule (13 Nov 2025 / 13 Nov 2026 / 13 May 2027). - DPDP (Removal of Difficulties) Order, 2026 — Corrects wording in ss.9(1) and 10(2)(c)(ii) of the DPDPA; issued 5 Oct 2026, gazetted 7 Oct 2026, effective 6 Oct 2026; MeitY characterises as textual/editorial - Digital Personal Data Protection Rules, 2025 — Definitions, DPBI establishment and government rule-making powers commenced 14 November 2025 - Digital Personal Data Protection Rules, 2025 — Consent Manager registration under Rule 4 commences 14 November 2026 - Digital Personal Data Protection Rules, 2025 — Substantive Data-Fiduciary duties (Rules 3, 5-16, 22, 23) commence 13 May 2027 - Digital Personal Data Protection Act, 2023 — is India's consent-based personal data processing statute: true - Digital Personal Data Protection Rules, 2025 — 2025-11-13 - Digital Personal Data Protection Act, 2023 — Act comes into force on dates notified by Central Government in the Official Gazette, with different dates for different provisions - Digital Personal Data Protection Rules, 2025 — Rules 1, 2 and 17-21 (Board establishment/procedure) effective immediately from 13 November 2025; most substantive rules deferred, including notice to Data Principal commencing 13 May 2027 - DPDP Rules 2025 commence in three staged tranches. #### Material ScopeAmber DPDPA applies only to digital personal data (including offline data subsequently digitized); non-digitized data, domestic/personal-use processing, and lawfully public data are excluded. Claims (1): - DPDPA applies to the processing of digital personal data within India, excluding non-digitized offline data, personal data processed for domestic use, and data made publicly available. #### Territorial ScopeAmber The Act has extraterritorial reach, applying to processing outside India where connected to offering goods/services to data principals within India. Claims (2): - DPDPA also applies to processing outside India if the processing relates to activity connected with offering goods or services to data principals within India. - The DPDPA applies to foreign companies processing digital personal data outside India where such processing is in connection with offering goods or services to individuals in India. #### Regulator Registration And FilingAmber Consent Manager registration and functioning rules apply 12 months after the 13 Nov 2025 finalization (i.e., ~13 Nov 2026); general data-fiduciary registration/filing thresholds beyond consent managers were not identified in this pass. Claims (4): - Rules on the registration and functioning of consent managers apply 12 months after the finalization of the DPDP Rules (from 13 Nov 2025). - Digital Personal Data Protection Rules, 2025 — Consent Manager registration (Rule 4) commences 13/14 November 2026 - Consent Manager registration (Rule 4) — Consent Manager registration provisions (Rule 4) commence 13 November 2026, one year after the Rules' notification. - Rule 4 Consent Manager registration commences approximately 13-14 November 2026. The Digital Personal Data Protection Act, 2023 (DPDPA) is India's omnibus statute, with substantive provisions brought into force in three staggered phases via the Digital Personal Data Protection Rules, 2025, notified 13 November 2025. Periodic update · new data 2026-11-04 #### Regulator & Framework India's data-protection framework is advancing on a staged timetable whose most recent marker was administrative rather than substantive. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, made under section 43(1) of the Act on 5 October 2026 and gazetted on 6 October, corrected the wording of section 10(2)(c)(ii) from periodic audit to periodic data audit and made a parallel textual correction to the guardian-consent provision in section 9. Both corrections resolve drafting ambiguity in provisions whose operative duties have not yet commenced, and the Order creates no new substantive obligation of its own. Alongside that correction, the staged commencement schedule under the Digital Personal Data Protection Rules, 2025 continues to unfold. Rule 4, which governs Consent Manager registration, is understood to commence around 13 or 14 November 2026, secondary sources disagree by a single day on the precise gazette date, while the bulk of substantive rules, numbered 3, 5 through 16, 22 and 23, remain scheduled to commence around 13 or 14 May 2027. That later date is the point at which the regime's core controller and processor duties, data-subject rights mechanics, and enforcement powers become operative together, rather than piecemeal. The institutional side of the framework shows similar staged progress. The Data Protection Board of India had its chairperson and members appointed on 6 June 2026, and reporting as of mid-October 2026 indicated the Board was still building out its operational staffing capacity. The practical consequence is that no substantive breach has yet been adjudicated under the Board, even though the institution itself now formally exists. Read together, the Removal of Difficulties Order and the Board's staffing trajectory describe a regime whose legal text is being finalised and whose adjudicative capacity is being built, in parallel with, rather than ahead of, the substantive obligations that will eventually require that capacity. #### Outlook Two dates anchor the near-term outlook: Consent Manager registration under Rule 4, expected around 13 to 14 November 2026, and the substantive-obligations commencement expected around 13 to 14 May 2027. Before the later date, further drafting-correction orders of the kind seen in October remain plausible as implementation proceeds, and the Board's staffing progress will be a relevant marker of how prepared the institutional framework is to exercise its powers once the substantive block of obligations takes effect. 4 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework The governing instrument remains the Digital Personal Data Protection Act, 2023, read together with the Digital Personal Data Protection Rules, 2025. On 7 October 2026 the government gazetted the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, with effect from 6 October 2026. The Order substitutes wording in Section 9(1) and Section 10(2)(c)(ii) of the Act. This is a textual clarification exercise: it creates no new obligation for data fiduciaries and does not alter any commencement date already fixed under the Act or Rules. The substantive-compliance tranche of the Act, the body of provisions that will require operational change by data fiduciaries, including notice, consent, security safeguards and data-principal rights, continues to be staged to commence on 13 May 2027, a date the October 2026 Order left untouched. One procedural element from the Rules moves sooner: Consent Manager registration under Rule 4 of the Digital Personal Data Protection Rules, 2025 is scheduled to commence from 13-14 November 2026, well ahead of the main 2027 tranche. This affects entities seeking to operate as Consent Managers under the Act's consent-architecture model, rather than data fiduciaries generally. The status of the Data Protection Board of India, the body intended to administer the Act's enforcement and redress functions, is unsettled on the current record. Reports diverge on whether a Chairperson has in fact been appointed, a dispute addressed further under Enforcement & Redress below. Pending resolution, the regulator-and-framework picture for India is one of an Act and Rules that are substantively unchanged in their staged timeline, with one earlier-landing procedural requirement (Consent Manager registration) and an open question over institutional readiness. #### Outlook The near-term dated marker is 13-14 November 2026, when Consent Manager registration opens under Rule 4. The structurally more significant date is 13 May 2027, when the Act's substantive-compliance machinery, and with it the operational test of whatever regulator and Board exist by then, comes into force. Confirmation of the Board's appointed leadership, from a primary government source, would materially sharpen the framework picture before that date arrives. Periodic update · new data 2026-10-18 #### Regulator & Framework The Digital Personal Data Protection Rules, 2025 continue to commence in three statutorily staged phases. The first phase, covering definitions, the establishment of the Data Protection Board of India, and the government's rule-making powers, commenced on 14 November 2025. The second phase, Consent Manager registration under Rule 4, is understood to commence twelve months later on 14 November 2026. The third and most substantial phase, the body of Data-Fiduciary duties under Rules 3, 5 through 16, 22 and 23, is scheduled to commence on 13 May 2027, eighteen months after notification. Within this staged framework, the government issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, under section 43(1) of the Act, correcting wording in sections 9(1) and 10(2)(c)(ii) of the Digital Personal Data Protection Act, 2023. The Order was issued on 5 October 2026 and gazetted on 7 October 2026; the Ministry of Electronics and Information Technology has characterised it as a textual and editorial correction rather than a substantive change to the obligations it touches. The institutional capacity question remains unresolved: as at 14 October 2026, the Data Protection Board of India's Chairperson post and all four Member posts remain unfilled, meaning the Board is understood to be unable to hold proceedings or exercise its adjudicatory and penalty powers. This is a hedged finding, drawn from a single tracker source referencing posts advertised on 6 May 2026 and a Parliament reply of 12 August 2026, so the precise current staffing position should be read with appropriate caution pending further confirmation. #### Outlook The Consent Manager registration milestone, understood to fall on 14 November 2026, is the next dated event in the staged-commencement timeline. Whether the Data Protection Board of India's leadership posts are filled before the substantive Data-Fiduciary duties commence on 13 May 2027 will determine whether the Board's adjudicatory capacity is operational from the moment those duties, and their associated penalty provisions, become enforceable. Periodic update · new data 2026-10-11 #### Regulator & Framework India's data protection framework took statutory form on 14 November 2025, when the Ministry of Electronics and Information Technology published notifications in the Official Gazette bringing into force the Digital Personal Data Protection Act, the DPDP Rules 2025, and establishing the Data Protection Board of India, via Gazette notifications G.S.R. 843(E) and G.S.R. 846(E). This foundational commencement is confirmed with high confidence, drawing on a primary gazette-referencing legal-commentary source. The operational status of the Data Protection Board is disputed this cycle. One tracker, dated 23 July 2026, describes the Board as constituted but not staffed, meaning the institutional shell exists without the personnel needed to exercise its functions. A separate source states that the Ministry formalised the appointment of the Board's Chairperson and Members on 6 June 2026, a date that precedes the 23 July 2026 tracker and would, if accurate, mean the Board was staffed by the time the later tracker was compiled. These two accounts are not readily reconciled: either the 6 June appointment did not in fact result in a functioning staffed Board by late July, or the 23 July tracker was working from outdated information. No primary-source confirmation resolving this discrepancy was retrieved this cycle, and the disagreement is recorded as a genuine dispute rather than resolved in either direction. This disputed status sits against a backdrop of staged commencement for the Rules themselves: Rules 1, 2, and 17 through 21 commenced immediately alongside the 14 November 2025 notification; Rule 4, governing Consent Manager registration, commences approximately one year later, around 13-14 November 2026; and the remaining substantive Rules, including Rules 3 and 5 through 16 and 22 through 23, commence after eighteen months, on 13 May 2027. The practical significance of the Board's staffing dispute is therefore time-limited in one sense, since the Board's full adjudicatory relevance does not arise until the bulk of substantive obligations commence in May 2027, but it bears directly on whether the institutional infrastructure needed to administer the intervening Consent Manager registration regime, commencing around November 2026, is currently in place. #### Outlook The Board-staffing dispute will need resolution well before 13 May 2027, when the bulk of substantive DPDP obligations commence and the Board's adjudicatory function becomes operationally material. The more immediate marker to watch is Rule 4's Consent Manager registration commencement around 13-14 November 2026, which will test whether the Board, however currently staffed, is in a position to administer a live registration function. Primary-source confirmation of the Board's actual current staffing would resolve the present dispute and is the single most consequential missing fact for assessing India's data-protection regulator readiness at this stage. Periodic update · new data 2026-09-28 #### Regulator & Framework India's data protection framework moved from statute-without-machinery to an operationalised regime with the notification of the Digital Personal Data Protection Rules, 2025 on 13 November 2025. That notification simultaneously established the Data Protection Board of India and issued an accompanying Enforcement Notification, together operationalising the Digital Personal Data Protection Act, 2023 more than two years after its original passage. The commencement architecture is phased rather than immediate: Consent Manager registration with the Board becomes effective one year after the Enforcement Notification's gazette publication, placing that milestone in November 2026, while the broader substantive-obligation and penalty regime is understood to reach full enforceability by 13 May 2027. This phased design means organisations subject to the Act face a rolling series of compliance deadlines rather than a single cutover date, and the practical significance of the framework at any given point depends on which phase is currently in force. The Board's establishment is confirmed, but as detailed under Enforcement & Redress, its operational capacity to exercise its statutory powers is itself disputed in current reporting. #### Outlook Watch November 2026 for Consent Manager registration taking effect, and 13 May 2027 for full substantive enforceability. Confirmation of the Data Protection Board's actual staffing status, addressed in the Enforcement & Redress domain, will materially affect how meaningful this framework proves to be in the interim period. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (28) - [International Association of Privacy Professionals](https://iapp.org/news/a/with-rules-finalized-india-s-dpdpa-takes-force) — The Data Protection Board of India's establishment and operational/powers provisions were brought into force immediately upon the 13 November 2025 notification of the DPDP Rules, 2025. - [International Association of Privacy Professionals](https://iapp.org/news/a/notes-from-the-asia-pacific-region-india-releases-dpdpa-rules-ai-governance-guidelines) — The DPDPA becomes applicable to all entities and government departments 18 months after the 13 November 2025 Rules notification, i.e., 13 May 2027. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/DG-india-dpdpa-infographic.pdf) — DPDPA applies to the processing of digital personal data within India, excluding non-digitized offline data, personal data processed for domestic use, and data made publicly available. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/DG-india-dpdpa-infographic.pdf) — DPDPA also applies to processing outside India if the processing relates to activity connected with offering goods or services to data principals within India. - [International Association of Privacy Professionals](https://iapp.org/news/a/with-rules-finalized-india-s-dpdpa-takes-force) — Rules on the registration and functioning of consent managers apply 12 months after the finalization of the DPDP Rules (from 13 Nov 2025). - [SCC Online](https://www.scconline.com/blog/post/2026/10/15/dpdp-removal-of-difficulties-order-2026/) — Digital Personal Data Protection (Removal of Difficulties) Order, 2026 — Substitutes wording in DPDP Act Sections 9(1) and 10(2)(c)(ii), effective 6 October 2026, gazetted 7 October 2026; creates no new duty, moves no commencement date - [India Data Law](https://indiadatalaw.org/is-the-board-operational/) — Data Protection Board of India — Disputed: one June 2026 source claims a Chairperson was appointed; two July-August 2026 sources state no Chairperson or Member had been appointed - [Scrut.io](https://www.scrut.io/post/dpdp-rules) — Digital Personal Data Protection Rules, 2025 — Consent Manager registration (Rule 4) commences 13/14 November 2026 - [Legal500](https://www.legal500.com/intelligence/india/privacy/digital-personal-data-protection-rules-2025-%E2%80%93-notified) — Data Protection Board of India — established via a 13 November 2025 MeitY notification, alongside the DPDP Rules and an Enforcement Notification - [Legal 500](https://www.legal500.com/intelligence/india/privacy/digital-personal-data-protection-rules-2025-%E2%80%93-notified) — The Data Protection Board of India was formally established on 13 November 2025, immediately upon notification of the DPDP Rules 2025. - [Privacy World (Baker McKenzie)](https://www.privacyworld.blog/2025/11/india-passes-the-digital-personal-data-protection-rules-ushering-in-a-new-digital-age-in-india/) — DPDP Rules, 2025 — The DPDP Rules 2025 implement the DPDPA 2023 via a staggered three-phase commencement schedule (13 Nov 2025 / 13 Nov 2026 / 13 May 2027). - [Privacy World (Baker McKenzie)](https://www.privacyworld.blog/2025/11/india-passes-the-digital-personal-data-protection-rules-ushering-in-a-new-digital-age-in-india/) — The DPDPA applies to foreign companies processing digital personal data outside India where such processing is in connection with offering goods or services to individuals in India. - [Wikipedia](https://en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Rules,_2025) — Consent Manager registration (Rule 4) — Consent Manager registration provisions (Rule 4) commence 13 November 2026, one year after the Rules' notification. - [judicio.ai](https://judicio.ai/blogs/india-dpdp-act-enforcement-tracker) — DPDP (Removal of Difficulties) Order, 2026 — Corrects wording in ss.9(1) and 10(2)(c)(ii) of the DPDPA; issued 5 Oct 2026, gazetted 7 Oct 2026, effective 6 Oct 2026; MeitY characterises as textual/editorial - [Lexology](https://www.lexology.com/library/detail.aspx?g=2073ac40-628f-4112-81f3-fffdfd4b8858) — Data Protection Board of India — Chairperson and four Member posts remain unfilled as of 14 October 2026, so the Board cannot yet hold proceedings or exercise adjudicatory/penalty powers - [Baker Botts L.L.P.](https://ourtake.bakerbotts.com/post/102lund/india-notifies-final-rules-for-digital-data-protection-act) — Rule 4 Consent Manager registration commences approximately 13-14 November 2026. - [Shardul Amarchand Mangaldas & Co](https://www.amsshardul.com/insight/enforcement-of-the-dpdp-act-and-notification-of-the-dpdp-rules/) — Digital Personal Data Protection Rules, 2025 — Definitions, DPBI establishment and government rule-making powers commenced 14 November 2025 - [https://www.scrut.io/post/dpdp-rules](https://www.scrut.io/post/dpdp-rules) — Digital Personal Data Protection Rules, 2025 — Consent Manager registration under Rule 4 commences 14 November 2026 - [https://www.scrut.io/post/dpdp-rules](https://www.scrut.io/post/dpdp-rules) — Digital Personal Data Protection Rules, 2025 — Substantive Data-Fiduciary duties (Rules 3, 5-16, 22, 23) commence 13 May 2027 - [Ministry of Electronics and Information Technology (MeitY)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — Digital Personal Data Protection Act, 2023 — is India's consent-based personal data processing statute: true - [Gazette of India / MeitY (reproduced)](https://www.dpdpa.in/dpdpa_rules_2025/Rule_0.htm) — Digital Personal Data Protection Rules, 2025 — 2025-11-13 - [Indian Kanoon](https://indiankanoon.org/doc/146786225/) — Data Protection Board of India — is established as a body corporate under s.18 DPDP Act 2023, effective 13 November 2025: true - [Ministry of Electronics and Information Technology (MeitY)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — Digital Personal Data Protection Act, 2023 — Act comes into force on dates notified by Central Government in the Official Gazette, with different dates for different provisions - [Gazette of India / MeitY (reproduced)](https://www.dpdpa.in/dpdpa_rules_2025/Rule_0.htm) — Digital Personal Data Protection Rules, 2025 — Rules 1, 2 and 17-21 (Board establishment/procedure) effective immediately from 13 November 2025; most substantive rules deferred, including notice to Data Principal commencing 13 May 2027 - [Indian Kanoon](https://indiankanoon.org/doc/146786225/) — Data Protection Board of India — Established as a body corporate with effect from the date notified by the Central Government, with perpetual succession and power to sue/be sued - [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/india-data-privacy-laws/dpdp-act-implementation-status/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/india-data-privacy-laws/dpdp-act-implementation-status/) — Reports conflict on DPBI staffing status. - [https://www.amsshardul.com/insight/enforcement-of-the-dpdp-act-and-notification-of-the-dpdp-rules/](https://www.amsshardul.com/insight/enforcement-of-the-dpdp-act-and-notification-of-the-dpdp-rules/) — MeitY published notifications in the Official Gazette on 14 November 2025 bringing into force the DPDPA, the DPDP Rules 2025, and establishing the Data Protection Board. - [Baker Botts L.L.P.](https://ourtake.bakerbotts.com/post/102lund/india-notifies-final-rules-for-digital-data-protection-act) — DPDP Rules 2025 commence in three staged tranches. ### India: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful-basis and consent architecture is well documented; special-category and pseudonymisation treatment diverges structurally from GDPR and required an explicit absence finding for pseudonymisation. Primary framework Digital Personal Data Protection Act, 2023, ss. on consent and legitimate uses Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Lawful-basis and consent architecture is well documented; special-category and pseudonymisation treatment diverges structurally from GDPR and required an explicit absence finding for pseudonymisation. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data Section 9(1) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to obtain verifiable consent of a parent or lawful guardian before processing the personal data of a child, and separately requires verifiable consent of the lawful guardian of a person with a disability, where such a guardian exists. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarified the wording of this provision with effect from 6 October 2026, but the clarification is textual only: it introduces no new consent threshold and does not bring the duty into operative effect ahead of schedule. The provision's substantive commencement remains fixed to 13 May 2027, alongside the rest of the Act's compliance tranche. Until that date, data fiduciaries processing personal data relating to children or to persons with disabilities who have a lawful guardian are not yet subject to the verifiable-consent duty in binding operative terms, notwithstanding that the underlying Act provision has been enacted and its wording settled. The legal position is therefore one of a duty that exists on the statute book in clarified form but awaits its appointed commencement date before it takes practical effect. No other development in lawful-processing or special-category data was evidenced this period; the broader consent and processing-ground architecture of the Act is unchanged and continues to await its 13 May 2027 commencement alongside Section 9(1). #### Outlook The operative question for this module is less the content of the consent duty, which is now textually settled, than the practical mechanics data fiduciaries will need to have in place by 13 May 2027: verification methods for parental and guardian consent, and how these interact with the Consent Manager framework due to begin registration from 13-14 November 2026. Further clarity on verification mechanics would be the next material development to watch for. Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data Section 9(1) of the Digital Personal Data Protection Act, 2023 requires verifiable consent from a parent or lawful guardian before a Data Fiduciary may process the personal data of a child, or of a person with a disability who has a lawful guardian. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 corrects the wording of this provision so that the two categories, children and persons with disabilities, are textually distinct from one another, a change the Ministry of Electronics and Information Technology describes as editorial rather than substantive. This textual correction took effect alongside the Order, understood to be 6 October 2026, but the underlying substantive consent duty it corrects is enacted and not yet effective: it forms part of the third-phase Data-Fiduciary obligations scheduled to commence on 13 May 2027. Until that commencement date, the verifiable-consent requirement for processing children's and disabled persons' data is a provision on the books rather than an operative duty, and entities processing such data in India should plan against the 13 May 2027 commencement date as the point at which the requirement, in its now textually corrected form, becomes enforceable. #### Outlook The operative milestone for this provision is the 13 May 2027 commencement of the substantive Data-Fiduciary duties. No further amendment or clarification to the consent mechanics for children and vulnerable persons was identified this cycle beyond the textual correction itself. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data Under the Digital Personal Data Protection Rules, 2025, Data Fiduciaries are required to provide clear, itemised notices to data subjects specifying the purpose or purposes of processing, the categories of personal data being processed, applicable retention periods, and the mechanisms available for withdrawing consent. This notice standard is more granular than a general privacy-policy disclosure, requiring itemisation rather than an omnibus statement of purposes, and it establishes consent withdrawal as a mechanism that must be actively made available rather than merely implied. These consent and notice requirements form part of the same Rules package that establishes the Data Protection Board and the phased commencement timetable described elsewhere in this brief; as such, the practical enforceability of the notice standard tracks the same phased schedule running through to 13 May 2027. #### Outlook The notice and consent standard is enacted but not yet fully in force under the phased commencement schedule. Organisations should expect scrutiny of notice itemisation practices to increase as the Board's operational capacity develops and as the substantive-obligation deadline of 13 May 2027 approaches. D2 · Lawful Processing — Full Module Record 4 sub-modules · 49 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core rights are documented via secondary legal analysis, but portability, restriction/objection, and precise deadline mechanics require primary Rule-text confirmation. Primary framework Digital Personal Data Protection Act, 2023, Chapter III (Data Principal Rights) Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Core rights are documented via secondary legal analysis, but portability, restriction/objection, and precise deadline mechanics require primary Rule-text confirmation. #### Sub-modules (5) #### Access RightAmber Data principals have a codified right of access to their personal data held by fiduciaries. Claims (2): - DPDPA codifies data principal rights including access, correction, erasure, grievance redressal, and the right to nominate another person to exercise rights on the data principal's behalf. - The DPDP Rules articulate Data Principals' rights-enablement and grievance timelines, commencing with the Phase 3 substantive-provisions date of 13 May 2027. #### Rectification And ErasureAmber Rights of correction and erasure ('completion') are codified alongside access. Claims (1): - DPDPA codifies data principal rights including access, correction, erasure, grievance redressal, and the right to nominate another person to exercise rights on the data principal's behalf. #### Restriction And ObjectionRed No explicit generalized right to restrict processing or object (analogous to GDPR Art 18/21) was identified; rights are limited to access, correction, completion, and nomination. Claims (1): - Unlike the GDPR and CCPA, the rights available to data principals under the DPDPA are limited to access, correction, completion, and nomination, with no explicit portability or general objection/restriction right. #### Data PortabilityRed DPDPA does not include an explicit data-portability right comparable to GDPR Art 20. Claims (1): - Unlike the GDPR and CCPA, the rights available to data principals under the DPDPA are limited to access, correction, completion, and nomination, with no explicit portability or general objection/restriction right. #### Deadlines And Response WindowsRed No specific statutory response-deadline window for data-principal requests or grievance redressal was located in the secondary sources reviewed. Data principals are granted a narrower set of codified rights than under GDPR/CCPA: access, correction, erasure ('completion'), grievance redressal, and the right to nominate a representative. There is no explicit statutory data-portability right or generalized right to object/restrict processing, and no specific statutory response-deadline window was identified for grievance handling in this pass. No periodic updates recorded in this cycle Sources and claims (3) - [International Association of Privacy Professionals](https://iapp.org/resources/article/operational-impacts-of-indias-dpdpa) — DPDPA codifies data principal rights including access, correction, erasure, grievance redressal, and the right to nominate another person to exercise rights on the data principal's behalf. - [International Association of Privacy Professionals](https://iapp.org/resources/article/operational-impacts-of-indias-dpdpa-part6) — Unlike the GDPR and CCPA, the rights available to data principals under the DPDPA are limited to access, correction, completion, and nomination, with no explicit portability or general objection/restriction right. - [Wikipedia](https://en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Rules,_2025) — The DPDP Rules articulate Data Principals' rights-enablement and grievance timelines, commencing with the Phase 3 substantive-provisions date of 13 May 2027. ### India: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong secondary-source coverage of DPIA/DPO/breach/retention duties, but exact SDF designation thresholds and breach-notification timelines await primary Rule-text confirmation. Primary framework Digital Personal Data Protection Act, 2023 ss. 8-10; Digital Personal Data Protection Rules, 2025 Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Strong secondary-source coverage of DPIA/DPO/breach/retention duties, but exact SDF designation thresholds and breach-notification timelines await primary Rule-text confirmation. Periodic update · new data 2026-10-25 #### Controller/Processor Duties Section 10(2)(c)(ii) of the Digital Personal Data Protection Act, 2023, which touches the data-audit obligations of significant data fiduciaries, had its wording clarified by the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, with effect from 6 October 2026. As with the parallel clarification to Section 9(1), this is a textual correction: it does not create a new duty, does not alter the substance of the data-audit requirement, and does not change when that requirement takes effect. The data-audit duty, along with the balance of controller- and processor-facing obligations such as breach-notification duties under Rule 7 of the Digital Personal Data Protection Rules, 2025, remains part of the staged tranche commencing 13 May 2027. No independently retrieved pinpoint detail on the exact breach-notification deadline wording in Rule 7 was confirmed against gazetted text this period; secondary compliance commentary shows minor inconsistency on this point, and that gap is noted rather than resolved here. Taken together, the controller/processor duties picture for this period is one of continuity: the only change is a wording correction to an audit-related provision, with the operative compliance burden, data audits, breach notification, security safeguards and the rest, still awaiting its 13 May 2027 commencement date. #### Outlook Controllers and processors preparing for the 2027 tranche should expect the data-audit and breach-notification provisions to be the areas most likely to see further clarificatory instruments of this kind before substantive commencement. A primary-source confirmation of the precise Rule 7 breach-notification deadline would resolve the one open pinpoint gap in this module. Periodic update · new data 2026-09-28 #### Controller/Processor Duties The Digital Personal Data Protection Rules, 2025 impose significantly enhanced duties on Significant Data Fiduciaries, a heightened category of controller subject to obligations beyond those applying to ordinary Data Fiduciaries. Significant Data Fiduciaries must conduct annual Data Protection Impact Assessments and audits, a recurring accountability obligation rather than a one-time compliance exercise. All Data Fiduciaries, not only the Significant category, must notify the Data Protection Board and affected individuals of personal data breaches, with a detailed submission required within 72 hours of the breach becoming known — a materially fast notification window by comparative standards. Significant Data Fiduciaries also face a targeted cross-border restriction under Rule 13(4), addressed in full under Cross-Border & Adequacy, which prohibits transferring traffic data pertaining to the flow of personal information outside India. Rule 13(5) separately constitutes a committee tasked with recommending further Significant-Data-Fiduciary-specific measures, suggesting the compliance burden on this category of controller is likely to continue to expand. #### Outlook The 72-hour breach-notification clock and the annual DPIA/audit cycle for Significant Data Fiduciaries are the two obligations most likely to generate near-term compliance activity as the Rules phase into force. The Rule 13(5) committee's eventual recommendations are worth monitoring as a likely source of further SDF-specific obligations. D4 · Controller & Processor — Full Module Record 7 sub-modules · 82 words · 15 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The blacklist mechanism is well documented, but no country has yet been notified as restricted, and sector-specific localisation interacts with, rather than is superseded by, the DPDPA. Primary framework Digital Personal Data Protection Act, 2023, s.16 Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber The blacklist mechanism is well documented, but no country has yet been notified as restricted, and sector-specific localisation interacts with, rather than is superseded by, the DPDPA. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy India has not adopted an EU-style adequacy, standard-contractual-clause, or binding-corporate-rules framework for cross-border personal data transfers. Instead, the Digital Personal Data Protection Rules, 2025 impose a narrower, targeted restriction: Rule 13(4) prohibits Significant Data Fiduciaries specifically from transferring any traffic data outside India where that data pertains to the flow of personal information. This is a data-localisation measure aimed at a defined category of data and a defined category of controller, rather than a general cross-border transfer-control regime applicable to all personal data or all data fiduciaries. Rule 13(5) establishes a committee to recommend further measures specific to Significant Data Fiduciaries, which may in time expand the scope of cross-border restrictions currently in force. As of this cycle, no broader adequacy-assessment mechanism or transfer-safeguard instrument analogous to the EU General Data Protection Regulation's Chapter V exists in the Indian framework. #### Outlook Watch for the Rule 13(5) committee's recommendations, which represent the most likely near-term source of any expansion to India's currently narrow, traffic-data-specific localisation restriction. Organisations processing traffic data through Significant Data Fiduciary structures should treat the current Rule 13(4) restriction as a hard constraint on data flow architecture. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 68 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector overlay is well evidenced; other sectoral sub-modules require targeted follow-up research against sector regulator (RBI, IRDAI, TRAI, UGC/health-ministry) primary sources. Primary framework RBI/SEBI sectoral directions operating alongside DPDPA s.16 Supervisory authority [Reserve Bank of India (RBI)](https://www.rbi.org.in/) Traffic-light rationale — Amber Financial-sector overlay is well evidenced; other sectoral sub-modules require targeted follow-up research against sector regulator (RBI, IRDAI, TRAI, UGC/health-ministry) primary sources. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 55 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Only the children-targeted-advertising ban was substantiated; broader adtech sub-modules are largely unaddressed by the DPDPA and require dedicated follow-up. Primary framework Digital Personal Data Protection Act, 2023, s.9 (children) Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Only the children-targeted-advertising ban was substantiated; broader adtech sub-modules are largely unaddressed by the DPDPA and require dedicated follow-up. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 47 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Profiling restriction and state-exemption findings are sourced; ADM transparency, AI risk assessment, biometric and genetic sub-modules remain unaddressed by DPDPA and require dedicated follow-up (and cross-reference to the AI-governance surface). Primary framework Digital Personal Data Protection Act, 2023, s.9 (children) and exemption provisions Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Profiling restriction and state-exemption findings are sourced; ADM transparency, AI risk assessment, biometric and genetic sub-modules remain unaddressed by DPDPA and require dedicated follow-up (and cross-reference to the AI-governance surface). D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 68 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core child/dependent-adult consent architecture is well sourced from the finalized Rules; education-settings sub-module remains unaddressed. Primary framework Digital Personal Data Protection Act, 2023, s.9; Digital Personal Data Protection Rules, 2025 Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Core child/dependent-adult consent architecture is well sourced from the finalized Rules; education-settings sub-module remains unaddressed. Periodic update · new data 2026-11-04 #### Children & Vulnerable Groups The guardian-consent provisions of the Digital Personal Data Protection Act received a textual correction rather than a substantive change. The Removal of Difficulties Order, 2026, made under section 43(1) on 5 October 2026 and gazetted on 6 October, made a parallel correction to the guardian-consent wording in section 9 alongside its correction to the audit-terminology wording in section 10. The correction addresses drafting precision in the text governing consent for children and for persons with disabilities who have a lawful guardian; it does not alter the underlying consent mechanism itself, and that underlying mechanism has not yet become an operative duty. The timing matters for how this correction should be read. Section 9's guardian-consent duty sits within the substantive block of obligations that is scheduled to commence around 13 or 14 May 2027, alongside the bulk of the Rules numbered 3, 5 through 16, 22 and 23. Until that date, the guardian-consent requirement, like the rest of the substantive controller and processor duties, remains a prospective obligation rather than a binding one. The October correction is therefore best understood as the legislature and executive tidying the statutory text in advance of commencement, reducing the risk of ambiguity in the guardian-consent wording once the duty does become operative, rather than as a signal of any change in India's approach to protections for children and vulnerable groups. No enforcement or adjudicative activity concerning children's data or guardian consent has occurred, consistent with the Data Protection Board of India's own staffing trajectory: the Board's chairperson and members were appointed on 6 June 2026, and as of mid-October 2026 it was still reported to be building out its operational capacity, meaning no substantive breach of any kind, including in relation to guardian consent, could yet be adjudicated under it. #### Outlook The guardian-consent duty under section 9 will become a live compliance question only once the substantive block of obligations commences, expected around 13 to 14 May 2027. Between now and then, the corrected wording stands as the operative text that will apply from that date, and further drafting refinements of this kind remain possible as the Act's staged implementation continues. Periodic update · new data 2026-10-25 #### Children & Vulnerable Groups The Digital Personal Data Protection Act, 2023 extends its verifiable-consent duty under Section 9(1) beyond children to persons with a disability who have a lawful guardian, requiring a data fiduciary to obtain the guardian's verifiable consent before processing that person's personal data, on the same footing as parental consent for a child. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarified the wording of this provision with effect from 6 October 2026. The clarification affects phrasing only; it does not expand, narrow or bring forward the duty, which remains part of the Act's substantive-compliance tranche staged to commence on 13 May 2027. This means that, as of the current period, neither limb of the Section 9(1) duty, consent for processing a child's data nor consent for processing the data of a person with a disability who has a lawful guardian, is yet in binding operative effect, notwithstanding that both are now textually settled provisions of an enacted Act awaiting their appointed commencement date. No other development specific to children or vulnerable groups was evidenced this period. #### Outlook The practical significance of this module's one development is interpretive rather than operational for now: data fiduciaries handling data relating to children or to persons with disabilities with lawful guardians have a settled text to plan against ahead of 13 May 2027, without yet facing a live compliance obligation. Verification-mechanism guidance, expected to accompany the broader 2027 commencement, is the next development to watch for. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 makes a targeted correction to how the Digital Personal Data Protection Act, 2023 treats children and persons with disabilities as distinct categories for consent purposes. Prior wording in section 9(1) is corrected so that the verifiable parental-or-guardian-consent requirement reads as applying distinctly to each category rather than conflating them. This correction is characterised by the Ministry of Electronics and Information Technology as textual and editorial, not an expansion or contraction of the underlying protection. The practical significance of this correction is limited for the present: the substantive duty to obtain verifiable parental or guardian consent before processing a child's or a disabled person's personal data is enacted but not yet effective, forming part of the Data-Fiduciary obligations scheduled to commence on 13 May 2027 under the Rules' third commencement phase. Entities that process data belonging to children or to persons with disabilities in India should therefore treat the corrected wording as the version of the law that will become operative on that date, rather than as a duty currently enforceable. #### Outlook No further children-or-vulnerable-groups-specific development, such as an age-verification standard or a specific guardian-verification mechanism, was identified this cycle. The 13 May 2027 commencement date remains the key forward marker for this module. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups Section 9 of the Digital Personal Data Protection Act, 2023 mandates that organisations obtain verifiable consent from a child's parent or guardian before processing that child's personal data. This is a statutory requirement under the primary Act itself, distinct from the phased Rules-level obligations discussed elsewhere in this brief, though its practical enforceability moves in step with the same phased commencement timetable running through to 13 May 2027. No further detail on verification mechanisms, age thresholds, or exceptions for parental-consent requirements was available in the claims for this cycle. #### Outlook As the Data Protection Board's operational capacity develops and the substantive-obligation deadline approaches, expect increased organisational focus on verifiable-parental-consent mechanisms for services likely to be accessed by children. D9 · Children's Privacy — Full Module Record 5 sub-modules · 55 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### India: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Penalty framework and Board constitution are well documented; enforcement-activity track record under DPDPA itself is not yet available since substantive obligations are not yet effective, and collective-redress mechanisms remain unconfirmed. Primary framework Digital Personal Data Protection Act, 2023, Chapter on Data Protection Board and Penalties Supervisory authority Data Protection Board of India (DPBI) Traffic-light rationale — Amber Penalty framework and Board constitution are well documented; enforcement-activity track record under DPDPA itself is not yet available since substantive obligations are not yet effective, and collective-redress mechanisms remain unconfirmed. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Digital Personal Data Protection Act, 2023 vests the Data Protection Board of India with adjudicatory and penalty powers under Sections 27-28 and 33-34, including fines reportedly reaching up to Rs 250 crore for the most serious breaches, though secondary sources show minor variation on the exact penalty figure. Those powers, and the penalty machinery generally, do not commence until 13 May 2027, a date unaffected by any development this period. Whether the Board currently has appointed leadership able to carry out preparatory work ahead of that commencement date is genuinely disputed on the present record. One source dated June 2026 states that a Chairperson was appointed; two further sources, dated July and August 2026, state that no Chairperson or Member had been appointed as of their publication. Reports suggest the Board's appointment status may remain unresolved, and the conflict between these accounts has not been settled by any primary government confirmation located this period. Given that the Board's adjudicatory powers do not commence until 13 May 2027 in any event, the practical consequence of this dispute is limited for now, it bears on institutional readiness and preparatory capacity rather than on any live enforcement exposure. #### Outlook A primary-source confirmation of the Data Protection Board's current composition would resolve the one open factual dispute in this module. Beyond that, the next material date for enforcement and redress remains 13 May 2027, when the Board's adjudicatory and penalty powers, and the associated fine structure under Sections 27-28 and 33-34, are due to come into force. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Data Protection Board of India's capacity to adjudicate remains constrained by an unresolved staffing gap. As at 14 October 2026, the Chairperson post and all four Member posts are understood to remain unfilled, meaning the Board cannot yet hold proceedings or exercise its adjudicatory and penalty powers, notwithstanding that the Board's establishment itself commenced in the first phase of the Digital Personal Data Protection Rules, 2025 on 14 November 2025. This finding rests on a single tracker source referencing posts advertised on 6 May 2026 and referenced again in a Parliament reply of 12 August 2026, so it is reported with appropriate hedging as the current best-available account rather than a confirmed position. The penalty architecture the Board would eventually apply is itself not fully settled in public reporting. Rule 7 of the Digital Personal Data Protection Rules, 2025 establishes a two-stage breach-notification process, an initial notice to the Board without undue delay, a detailed notice within 72 hours, and notification to affected Data Principals within 72 hours of the Board notification, but sources of comparable standing disagree on the maximum penalty for a failure to meet this breach-reporting duty, with figures of up to Rs200 crore and up to Rs250 crore both reported. Both the breach-notification duty and its associated penalty exposure remain enacted but not yet effective, scheduled to commence as part of the third-phase Data-Fiduciary duties on 13 May 2027. #### Outlook Whether the Data Protection Board of India's leadership posts are filled, and whether the disputed penalty figure for breach-reporting failures is authoritatively resolved, before the 13 May 2027 commencement date will together determine whether the Board is positioned to exercise meaningful adjudicatory and penalty powers from the moment the substantive duties become enforceable. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Data Protection Board of India is understood to hold the power to impose penalties of up to two hundred fifty crore rupees for major violations once its full adjudicatory powers become exercisable, a figure drawn from compliance-timeline commentary that has not independently re-verified the precise Schedule pinpoint underlying it this cycle. This penalty ceiling represents a significant potential enforcement exposure once operative, but its practical relevance is presently constrained by two factors: the staged commencement of the underlying substantive obligations, the bulk of which do not take effect until 13 May 2027, and the disputed operational status of the Board itself, which this cycle's sourcing could not resolve either toward confirmed staffing or confirmed non-staffing. Consistent with this pre-commencement posture, no DPDP enforcement action, fine, or published Board order had been reported as of a 23 July 2026 tracker. This absence of enforcement activity is probable rather than confirmed, and should be read as consistent with, rather than independently diagnostic of, a Board not yet functioning as an adjudicator: the DPDP Act's substantive provisions generally have not yet commenced, so an absence of enforcement activity to date would be expected regardless of the Board's precise staffing status, since there is limited substantive basis for enforcement action under provisions that have not yet taken legal effect. The redress architecture more broadly therefore remains in a pre-operational phase: the penalty ceiling is specified in the instrument, but neither the staffing question that determines the Board's present capacity to act, nor the substantive commencement dates that determine what conduct is presently sanctionable, currently point toward near-term enforcement activity. This is a structural observation about the sequencing of India's data-protection enforcement architecture rather than an assessment of regulatory leniency or stringency. #### Outlook Enforcement activity under the DPDP Act is unlikely to materialise in volume before the 13 May 2027 commencement of the bulk of substantive obligations, since there is limited sanctionable conduct before that date regardless of the Board's staffing status. The more immediate indicator to watch is whether any enforcement-relevant activity emerges around the Rule 4 Consent Manager registration commencement in November 2026, which would test the Board's operational capacity ahead of the main 2027 commencement date. Resolution of the current Board-staffing dispute remains a prerequisite for assessing whether the penalty architecture, once the underlying obligations commence, will have a functioning adjudicator behind it from day one. Periodic update · new data 2026-09-28 #### Enforcement & Redress The Data Protection Board of India, established via the 13 November 2025 notification, holds the power to impose penalties of up to INR 250 crore per violation for security-safeguard failures under the Digital Personal Data Protection Act's penalty schedule — the ceiling for the most severe violation class under the Act. That penalty power is, however, currently the subject of a genuine and unresolved conflict in available reporting. One tracker states that the Board had zero members as of July 2026 and could not yet hear complaints or impose fines, while other commentary describes the Board as already operational. Both positions are drawn from sourced reporting and neither is resolved by the material available this cycle; the state of the Board's actual operational capacity should be treated as disputed rather than settled in either direction. This uncertainty matters because it determines whether the substantial penalty powers created by the Act are currently exercisable in practice, as distinct from existing on paper pending the Board's full staffing. The full substantive-obligation and penalty regime is understood to become enforceable by 13 May 2027, which may resolve, or may simply coincide with, the current staffing ambiguity. #### Outlook Resolution of the Data Protection Board's actual staffing and operational status is the single most consequential open question in India's data-protection enforcement landscape. Until that is clarified, the practical bite of the INR 250 crore maximum penalty and the Board's broader adjudicatory powers should be treated as uncertain rather than confirmed. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 96 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties