Regulatory index

DPDP rules and regulatory updates

Audience: privacy owners, legal-ops, founders · Last reviewed: March 2026

Use this page as a dated bridge between the Digital Personal Data Protection Act, 2023 and the rules, notifications, and government publications that operationalize it. It is not legal advice and not a substitute for reading the instruments in full; dates and titles are summarized for orientation—always confirm the current gazetted text and commencement notices.

When “what changed?” is the question, start with India Code and the Gazette, then MeitY’s DPDP page—not a screenshot from social media.

Official timeline (anchor dates)

The table below lists major public milestones. Verify exact notification numbers, amendments, and staggered commencement in the sources linked.

Date Milestone Primary sources
11 Aug 2023 Presidential assent; the Act is published as Act No. 22 of 2023 (44 sections, nine chapters). India Code — DPDP Act, 2023
Ongoing Commencement: the Central Government appoints dates for different provisions to come into force (see section 1(2) and official notifications). The Gazette of India; MeitY — DPDP Act, 2023
2025 onward Rules and subordinate law: operational detail (consent managers, Board procedures, forms, etc.) is published through rules and notifications—check consolidated text whenever you change a workflow. MeitY; Gazette; Official resources (hub)

Updates on this site

We add a short note here when we materially change guides or add new operational pages tied to notified rules—so returning visitors can see what changed without re-reading the whole library.

After you confirm what is in force, translate it into owned tasks:

More context