India Digital Personal Data Protection Act, 2023
India's consent-based personal data law, and the main legal constraint on AI training and deployment there. Significant data fiduciaries face added duties including algorithmic due diligence.
Key dates
- Aug 11, 2023Received presidential assent
- Nov 13, 2025DPDP Rules notified, with phased commencement
- Nov 13, 2026Consent manager registration opens
- May 13, 2027Core duties in sections 3 to 17 apply
Risk areas addressed
Who it applies to
Data fiduciaries processing digital personal data in India, including those offering goods or services to Indian residents from abroad.
Penalties & enforcement
Up to ₹250 crore per instance of specified breaches.
Enforced by: Data Protection Board of India
India DPDP Act is enforced by Data Protection Board of India. The next dated milestone falls on Nov 13, 2026, 28 days away: Consent manager registration opens. In practice that means knowing which of your AI systems fall in scope across every sector you operate in, holding assessments that speak to privacy, data governance and transparency, and being able to produce that evidence on request, including for systems built outside the jurisdiction.