Summary
- Consent or legitimate use is needed to process digital personal data (ss.4, 6, 7). Consent must be specific to the purpose, so using customer data to train a new AI model usually needs its own notice and consent, or a listed legitimate use.
- Publicly available data exemption (s.3(c)(ii)): the Act does not apply to personal data the person made public themselves, or that someone was legally required to publish. This is the main legal footing for scraping public web data for training, but it does not cover data others posted about a person.
- Research exemption (s.17(2)(b)): processing for research, archiving or statistics is exempt if it is not used for decisions about a specific person and follows prescribed standards.
- Significant Data Fiduciaries (s.10, Rule 13): must appoint a DPO in India, run a DPIA and audit every 12 months and report key findings to the Board, and do due diligence that their algorithmic software is not likely to risk users' rights (Rule 13(3)). Rule 13 applies from 2027-05-13.
- Children (s.9): verifiable parental consent; no tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)). This limits AI personalisation for under-18 users.
Who it applies to
- Processing of digital personal data in India, and processing outside India connected with offering goods or services to people in India (s.3(b)).
- All sectors, public and private.
- Not covered: personal or domestic use, and self-published or legally published data (s.3(c)).
Key dates
- DPDP Act receives assent (Act No. 22 of 2023)
- Draft DPDP Rules published (G.S.R. 02(E))
- DPDP Rules notified (G.S.R. 846(E), Gazette dated 13 Nov 2025); Board provisions and Rules 1, 2, 17 to 21 in force
- Rule 4 (Consent Manager registration) in force, one year after publicationUpcoming
- Rules 3, 5 to 16, 22, 23 in force, eighteen months after publication (sources differ by one day)Upcoming
Full date record
| Date | Event |
|---|---|
| 2023-08-11 | Act assented |
| 2025-11-13 | Rules notified in Gazette (PIB press release says 14 Nov); Data Protection Board provisions (ss.18 to 26) and Rules 1, 2, 17 to 21 in force |
| 2026-05-06 | MeitY invites applications for DPBI Chairperson and four Members (vacancy notice) |
| 2026-11-13 | Rule 4 (Consent Managers) in force; s.6(9) and s.27(1)(d) also start (secondary) |
| 2027-05-13 | Core duties in force: notice, security, breach reporting, retention, children, SDF duties, data principal rights, cross-border rules |
Penalties and enforcement
- Schedule penalties: up to INR 250 crore (security safeguards), INR 200 crore (breach notification; children), INR 50 crore (other).
- The Data Protection Board adjudicates; appeals go to TDSAT. Board set up on 2025-11-13; Chairperson and Member posts were still being recruited in May 2026.
- MeitY reportedly consulted in January 2026 on cutting the 18-month window to 12 months (secondary sources). No amendment to the Rules was found as of 2026-10-19.
What it means for an Indian company
- Training data audit now: list every dataset used for AI and record whether it rests on consent, a legitimate use, s.3(c)(ii) public data, or the research exemption (SC-AI-011 Lawful basis and consent for personal data used in AI, SC-AI-010 Training and input data governance (provenance, quality)).
- Refresh notices and consent before 2027-05-13 so AI training and AI features are named as purposes; plan for consent withdrawal and erasure affecting training sets (SC-AI-012 Data minimisation and retention for AI).
- Children: switch off behavioural profiling and targeted ads for under-18 users unless a Fourth Schedule exemption fits.
- If you may be notified as an SDF (large volumes, sensitive data, platforms): prepare an annual DPIA and audit and an algorithmic risk review process (SC-AI-006 AI impact assessment (people and society), SC-AI-037 Internal audit of AI, SC-AI-017 Fairness and discrimination testing of outputs).
- Logs: Rule 8(3) requires keeping processing logs for at least one year, which overlaps with AI logging (SC-AI-032 Logging and record keeping).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when India DPDP Act 2023 and DPDP Rules 2025 is done.
Glossary
- Data Fiduciary: the organisation that decides why and how personal data is processed (the GDPR "controller").
- Data Principal: the person the data is about; for children, includes the parent.
- Significant Data Fiduciary (SDF): a fiduciary the Government notifies as high-impact, with extra duties.
- Consent Manager: a registered platform people use to give, manage and withdraw consent.
- Legitimate uses: listed situations where consent is not needed (s.7).
- DPBI: Data Protection Board of India, the adjudicating body.
- TDSAT: Telecom Disputes Settlement and Appellate Tribunal, which hears appeals.
Key takeaways
- Not AI-specific, but it governs AI training data, AI features and children's profiling in India.
- Phased start: Board now, Consent Managers from 2026-11-13, most duties from 2027-05-13.
- s.3(c)(ii) public data exemption and s.17(2)(b) research exemption are the key levers for training data.
- SDFs face annual DPIAs, audits and algorithmic due diligence (Rule 13).
Official sources
- DPDP Rules, 2025, G.S.R. 846(E), Gazette dated 13 Nov 2025 (MeitY PDF), accessed 2026-10-19
- Digital Personal Data Protection Act, 2023 (MeitY PDF), accessed 2026-10-19
- PIB explainer: DPDP Rules, 2025 Notified, accessed 2026-10-19
- MeitY vacancy circular for DPBI Chairperson and Members, 6 May 2026, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.