Sources

Verified August 2026 · Checked monthly

Every statement on this site names the document behind it. This page holds those documents. Where a primary document is not published online in a stable place, the entry says so and names the report used instead.

The law itself

• The Digital Personal Data Protection Act, 2023

  Act No. 22 of 2023, assented 11 August 2023. Nine chapters, forty-four sections and one Schedule. Published by India Code, maintained by the Ministry of Law and Justice. Also available from MeitY.

The notifications of 13 November 2025

• Commencement notification, G.S.R. 843(E), 13 November 2025

  Made under section 1(2). Appoints three commencement dates for different provisions of the Act. This is the document behind the Act table on the status tracker. MeitY publishes the gazette copy. India Code carries the same file as Enforcement Timeline for the DPDP Act.

• The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025

  Made under section 40(1) and 40(2). Twenty-three rules and seven Schedules. Rule 1(2) carries the commencement clause. MeitY publishes the gazette copy. India Code also carries it, in English and in Hindi.

• Corrigendum to the Rules, G.S.R. 892(E), 10 December 2025

  Five typographical corrections to G.S.R. 846(E). None changes a rule number or a Schedule. One changes a clause range from (a) to (f) into (a) to (g).

• Establishment of the Data Protection Board of India, 13 November 2025

  Establishes the Board under section 18. A second notification of the same date fixes the Board at a chairperson and four members.

Statements by the Government

• The written answer in the Lok Sabha, 12 August 2026, as reported

  Answered by the Minister of State for Electronics and Information Technology. Confirms the November 2026 and May 2027 deadlines, the recruitment advertisement of 6 June 2026, the twenty-two language obligation, the ninety day grievance limit and the processor contract requirement. The answer itself is not published online in a stable location. This is a report of it.

• The same answer on Common Service Centre operators, as reported

  Carries the part of the answer stating that Village Level Entrepreneurs may not collect or store citizen data.

• Press Information Bureau, 9 August 2023

  Salient features of the Bill as passed, including the seven principles the framework is built on and the plain-language drafting approach.

• Press Information Bureau, 1 August 2017

  Announces the expert committee under Justice B.N. Srikrishna, constituted 31 July 2017.

Legislative history

• PRS Legislative Research, the DPDP Bill, 2023

  Introduction, passage and assent dates, with the Bill text as introduced.

• PRS Legislative Research, the Personal Data Protection Bill, 2019

  Introduction on 11 December 2019 and withdrawal on 3 August 2022.

• The Srikrishna Committee report, 27 July 2018

  A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians, with the draft Personal Data Protection Bill, 2018.

The courts and legal reporting

• LiveLaw, 1 August 2026, on the Data Protection Board

  Reports that the Board has no appointed chairperson and no appointed members, and covers the direction of the Madhya Pradesh High Court at Indore in Parth Sharma v. Union of India.

• Supreme Court Observer on Puttaswamy

  The nine-judge decision of 24 August 2017 holding that privacy is a fundamental right, which is the constitutional starting point for this Act.