Recent Developments in Data Privacy Laws in India

• Sajai Singh
• Sankalp Inuganti
• Ayush Sahay

Over two years have passed since the Indian Digital Personal Data Protection Act (DPDP Act) was first published in 2023 and was finally enacted in November 2025, including its accompanying rules that the Ministry of Electronics and Information Technology (MeitY) had published. The following article is an update to the one previously published in PinG, outlining the principles and earlier GDPR comparisons of the DPDP Act, including a detailed note on the legal bases for processing, exemptions, and sectoral requirements. This update focuses on developments since that publication, notably: the notification of the Digital Personal Data Protection Rules (DPDP Rules) (November 13, 2025), progress toward operationalising the Data Protection Board of India, and practical compliance steps for companies ahead of the May 13, 2027 substantive compliance deadline.