On the Horizon — Not Yet Law
Digital Personal Data Protection Act, 2023
Once fully in force, applies to processing of digital personal data within India, and — per Section 3(b) — to processing outside India only where connected to offering goods or services to data principals in India (notably, unlike GDPR/PIPL, this does NOT extend to profiling/behavioral-monitoring activities conducted outside India). Section 17 allows government exemption of state instrumentalities on sovereignty/security grounds and empowers the Central Government to exempt startups/small data fiduciaries by future notification — a discretionary power, not an automatic threshold-based exemption.
Status: Enacted August 11, 2023, but not yet substantively in force. Per MeitY's official gazette notifications (Nov 13-14, 2025), only Phase I (Data Protection Board establishment) is live. Phase II (Consent Manager registration) is expected around November 2026; Phase III — the core obligations that would actually make this apply to businesses (notice, consent, data-principal rights, breach reporting) — isn't scheduled to take effect until May 13, 2027.
May 13, 2027 (core substantive obligations)
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual presence, activities, and data types.