New Delhi: India’s landmark data privacy law is finally nearing implementation, with the government preparing to formally notify the rules under the Digital Personal Data Protection (DPDP) Act, 2023 before the end of this month.
Union Minister for Electronics and Information Technology Ashwini Vaishnaw, addressing the AI Impact Summit 2026 on Thursday, confirmed that the notification process is in its final stages. “The DPDP rules are ready and will be published in a few days from now,” he said, adding that the government is targeting a September 28 release.
The move marks the culmination of nearly two years of anticipation since Parliament passed the DPDP Act in August 2023. The law was framed in the aftermath of the Supreme Court’s 2017 Justice K.S. Puttaswamy judgment, which established privacy as a fundamental right under Article 21.
Unlike the European Union’s GDPR, which governs all types of personal data and prescribes fines up to 4% of a company’s global turnover, India’s DPDP law is narrower in scope. It applies exclusively to digital personal data and caps penalties at ₹250 crore (around €28 million) for serious breaches. The Act also diverges from earlier drafts by eliminating the distinction between “personal” and “sensitive” data, instead introducing new terms such as “data principals” (individuals) and “data fiduciaries” (entities handling personal data).
The Ministry of Electronics and Information Technology (MeitY) had issued the draft DPDP Rules, 2025, for consultation on January 3 this year, attracting more than 6,900 submissions from industry leaders, experts, and citizens by the February 18 deadline. Feedback spanned across critical areas, including consent frameworks, cross-border transfers, and breach notification mechanisms.
By notifying the rules ahead of the Winter Session of Parliament, the government aims to provide clarity for both regulators and businesses, enabling them to begin preparations for compliance and enforcement.
With the notification now imminent, India is poised to roll out its first comprehensive digital data privacy regime, balancing individual rights with the need for innovation and economic growth in a rapidly digitizing economy.
