On the Horizon — Not Yet Law
Digital Personal Data Protection Act, 2023
Once fully in force, applies to processing of digital personal data within India, and — per Section 3(b) — to processing outside India only where connected to offering goods or services to data principals in India (notably, unlike GDPR/PIPL, this does NOT extend to profiling/behavioral-monitoring activities conducted outside India). Section 17 allows government exemption of state instrumentalities on sovereignty/security grounds and empowers the Central Government to exempt startups/small data fiduciaries by future notification — a discretionary power, not an automatic threshold-based exemption.
Status: Enacted August 11, 2023, and still not substantively in force. MeitY notified the DPDP Rules, 2025 on November 13, 2025 with a three-phase commencement: Phase I (constitution of the Data Protection Board of India) took effect immediately on November 13, 2025; Phase II (Consent Manager registration, and the Board's power to inquire and impose penalties) takes effect November 13, 2026; Phase III — the core obligations that actually bind businesses (notice, consent, data-principal rights, retention limits, transfer and breach duties) — takes effect May 13, 2027.
May 13, 2027 (core substantive obligations)
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual presence, activities, and data types.