On Nov. 14, 2025, IND DP issued notifications on commencement of DPDP act, 2023 and establishment of Data Protection Board of India.
Sections 1(2), 2, 18-26, 35, 38-43, 44(1), 44(3) of the act took effect Nov. 13, 2025.
Sections 6(9), 27(1)(d) of the act shall come into force from Nov. 13, 2026.
Sections 3-5, 6(1)-(8), 6(10), 7-17, 27 (except 27(1)(d)), 28-34, 36-37, 44(2) shall come into force eighteen months from Nov. 13, 2025, namely, May 13, 2027.
Data Protection Board of India established effective Nov. 13, 2025 to exercise powers and perform functions under the act.
Document dated Nov. 14, 2025, was received on Nov. 26, 2025 due to a new feed.
On Nov. 18, IND GVT published the personal data protection bill 2022.
IND GVT, in the form of the Ministry of Electronics & Information Technology, and IND DP published details of a new Digital Personal Data Protection Bill, 2022 (DPDP 2022).
Data Protection Bill
The purpose of the Bill is to provide for processing digital personal data in a manner recognizing individual rights to protect personal data and legal need to process data.
It will establish a comprehensive legal framework on digital personal data protection.
The DPDP 2022 outlines the rights and duties of the citizen on one hand and the obligations to use any collected data lawfully of the data fiduciary on the other hand.
The bill specifies that any usage of personal data by organizations must be done in a manner that is lawful, fair to the individuals concerned and transparent to individuals.
It also says all personal data must be used for the purposes for which it was collected.
Only items of personal data required for attaining a specific purpose must be collected.
The accuracy of personal data collected is also important and reasonable effort must be made to ensure the personal data of the individual is accurate and kept up to date.
Data storage is also covered and confirms that this should be limited to such duration as is necessary for the original stated purpose for which personal data was collected.
Documentation
The documents provided consist of the DPDP 2022 bill itself, details of the consultation process, and an explanatory note to the DPDP 2022, providing an overall summary.
Next Steps
IND GVT has invited feedback on DPDP 2022 from general public until Dec. 17, 2022.
Submissions will not be disclosed to enable all persons submitting feedback to provide these submissions freely, and no public disclosure of any submissions will be made.
Dec. 2022 Extended Timeline
On Dec. 17, 2022, IND GVT extended the closing date for comments on DPDP 2022.
In response to stakeholder requests, last date for receipt of comments is Jan. 2, 2023.
Aug. 2023 Act Gazetted
On Aug. 11, 2023, IND GVT gazetted the Digital personal data protection act 2023.
Includes chapter I - preliminary provisions; chapter II - obligations of data fiduciary.
Chapter III - rights and duties of data principal; chapter IV - special provisions i.e. re cross-border transfers; chapter V - re establishment of Data Protection Board of India.
Chapter VI - re powers, functions, and procedure to be followed by this new board.
In addition, chapter VII - with respect to appeal and alternate dispute resolution; chapter VIII regarding penalties, adjudication; chapter IX - miscellaneous provisions.
Nov. 2023 Task Force
On Nov. 24, 2023, IND INS shared an order stating that the Ministry of Law and Justice constituted a task force to examine the implications of the DPDP act, 2023.
Task force is required to submit its report within one month of issuance of the order.
Document dated Nov. 24, 2023, received from IND INS Nov. 28, summarized Nov. 30.
In Jan. 2025, IND GVT drafted digital personal data protection rules, see #239365.
Nov. 2025 IND DP Act Commencement
On Nov. 14, 2025, IND DP issued notifications on commencement of DPDP act, 2023 and establishment of Data Protection Board of India.
Sections 1(2), 2, 18-26, 35, 38-43, 44(1), 44(3) of the act took effect Nov. 13, 2025.
Sections 6(9), 27(1)(d) of the act shall come into force from Nov. 13, 2026.
Sections 3-5, 6(1)-(8), 6(10), 7-17, 27 (except 27(1)(d)), 28-34, 36-37, 44(2) shall come into force eighteen months from Nov. 13, 2025, namely, May 13, 2027.
Data Protection Board of India established effective Nov. 13, 2025 to exercise powers and perform functions under the act.
Document dated Nov. 14, 2025, was received on Nov. 26, 2025 due to a new feed.
Regulators
IND DP; IND GVT; IND INS
Entity Types
CNSM; Corp; Fiduciary
Reference
PR 11/14/2025; OG, Nt G.S.R. 843(E), G.S.R. 844(E), 11/13/2025; Ord IRDAI/GA&HR/ORD/207/11/2023; 11/24/2023; OG DL-(N)04/0007/2003-23, CG-DL-E-12082023-248045, Act 22/2023, 8/11/2023; PR 12/17/2022; Bill, CP, PR 11/18/2022; DPDP 2022;
Functions
Complaints; Compliance; C-Suite; Legal; Privacy; Record Retention; Risk; Technology; Treasury
