Data protection

The Digital Personal Data Protection Act, 2023 governs how organisations collect and use people’s personal data in digital form. Its rules, notified in November 2025, bring it into force in phases over 18 months.

Where things stand

The provisions setting up the Data Protection Board of India took effect when the rules were notified. The Board still has no chairperson or members. The Ministry of Electronics and Information Technology invited applications for a chairperson and four members on 6 May 2026, and the posts were advertised on 6 June. No appointment had been reported as of 11 October 2026.

The consent manager framework, which lets people manage their consent across services through a single platform, begins on 13 November 2026. Most duties on organisations, and the Board’s power to inquire and impose penalties, start on 13 May 2027.

Two search-cum-selection committees are handling the Board appointments, one chaired by the Cabinet Secretary, LiveLaw reported. The law requires at least one member with legal expertise. Until members are named, the Board cannot hear a complaint or pass an order. Appeals against its decisions, once it starts work, will go to the Telecom Disputes Settlement and Appellate Tribunal.

Key dates

1. 2023DPDP Act passed
2. Nov 2025Rules notified; Board established in law
3. 6 May 2026MeitY invites applications for Board posts
4. 13 Nov 2026Consent manager framework begins
5. 13 May 2027Most obligations and Board's penalty powers take effect

Key numbers

• 90 daysmaximum time for an organisation to answer a rights request
• ₹250 croremaximum penalty, for failing to keep security safeguards
• 0Board members appointed as of the latest reports
• 18 monthsphased compliance period under the rules

Key questions

What rights do I have? You can ask for a copy of your data, have it corrected or updated, ask for it to be erased, nominate someone to act for you, and complain to the organisation and to the Board.

Can I complain to the Board today? In practice, no. A board without members cannot hear complaints or pass orders, as LiveLaw and India Data Law note.

What is a consent manager? An India-based company that runs one platform for people to give, review and withdraw consent across services, under the Board’s oversight.

Where do appeals go? To the Telecom Disputes Settlement and Appellate Tribunal.