/ DPDP Operational Status · Updated 2026-10-22
DPDP Rules Operational Status October 2026, draft Rules circulated Jan 2025, operational notification imminent.
DPDP Act 2023 was enacted August 2023. Draft Rules for operationalisation were circulated by MeitY in January 2025. As of October 2026, final Rules notification is anticipated (expected around Budget 2026 timeframe). Here's the operational status, draft Rules content, and what foreign + Indian companies should do now to be ready.
DC
Written by CA Durgesh Chavda
Chartered Accountant (ICAI) · Founder, Bharat Quantum Prospera · US incorporation, India-US DTAA, FEMA ODI, NRI taxation, cross-border structuring · LinkedIn
/ Current operational status
What's live, what's pending.
- DPDP Act 2023 (enacted): statutory framework in place. Act defines Data Fiduciary / Data Processor / Data Principal roles, consent framework, data principal rights, Data Protection Board, penalty structure (up to INR 250 crore).
- Draft Rules January 2025 (circulated): operational mechanics - consent mechanisms, breach notification format, Significant Data Fiduciary notifications, cross-border transfer blocklist country notifications, Data Protection Board procedures, grievance redressal timelines.
- Public consultation (Feb-May 2025): stakeholder submissions received by MeitY.
- Finalisation (Oct 2026 status): Rules being finalised. Industry expects notification by end of CY 2026 or Budget 2026 (Feb 2027).
- Enforcement effective date: typically 90-180 days from final notification. So earliest enforcement likely mid-2027.
/ Key draft Rules provisions (likely to be retained)
What foreign companies should assume.
- Notice format: standardised notice template for data processing. English + 22 scheduled Indian languages option.
- Consent mechanism: granular / specific / informed / unconditional / unambiguous consent. Easy withdrawal mechanism.
- Consent Manager framework: licensed Consent Managers (analogous to Account Aggregators for financial data) will manage consent exchange.
- Breach notification: within reasonable period (likely 24-72 hours); specific format to Data Protection Board + each affected data principal.
- Significant Data Fiduciary (SDF) notifications: specific entity classes (likely large social media, fintech, health, e-commerce). Additional obligations: India-based Data Protection Officer, independent Data Auditor, periodic DPIA + audit.
- Cross-border transfer: Section 16 blocklist approach - specific countries may be restricted. Initial list likely to be minimal or empty; dynamic.
- Children's data: verifiable parental consent (under 18 default; may be lowered); no behavioural monitoring; no targeted advertising.
- Data Protection Board procedures: inquiry + enforcement + appeal to TDSAT.
/ What foreign companies should do now
The 90-day readiness plan.
- DPDP applicability analysis under Section 3 (extraterritorial reach).
- Data inventory: what personal data of Indian residents is collected, where stored, how processed, with whom shared.
- Legal basis mapping: consent vs legitimate uses (Section 7).
- Notice + consent flow design (English + Indian language option).
- Consent Manager integration readiness (likely required post Rules).
- Data Processing Agreement (DPA) templates with Indian processors + sub-processors.
- Breach response plan: detection + 24-72 hour notification mechanism.
- Significant Data Fiduciary (SDF) risk assessment: if likely SDF, appoint India-based DPO.
- Cross-border transfer documentation: current flows + mitigation if Section 16 blocklist applies.
- DPIA (Data Protection Impact Assessment) for high-risk processing.
- Children's data compliance if applicable.
- Grievance Officer appointment + response SLA setup.
Last updated: 2026-10-22.
/ Ready when you are
DPDP Rules finalisation imminent. Readiness window is now.
90-day readiness programme: applicability + inventory + consent + DPA + breach plan + SDF assessment + cross-border transfer. BQP end-to-end + co-ordinated with foreign privacy counsel.
FAQ
Common questions, answered.
Are DPDP Rules operational in October 2026?
Not yet. Draft Rules were circulated January 2025; public consultation Feb-May 2025. Final Rules notification expected around end of CY 2026 or Budget 2026 timeframe (February 2027). Enforcement typically 90-180 days from final notification - so enforcement date likely mid-2027. But: DPDP Act itself is enacted; broad obligations already applicable.
What's the biggest risk if I'm not DPDP-ready?
Penalty up to INR 250 crore (~USD 30M) for failure to take reasonable security safeguards to prevent personal data breach (Section 33 + Schedule). Separate penalties up to INR 200 crore for breach non-notification, children's data violations, SDF obligation failures. Data Protection Board enforcement. Appeal to TDSAT.
How do final DPDP Rules affect foreign companies?
Extraterritorial reach (Section 3): any entity processing personal data of Indian residents in connection with offering goods/services is in scope - regardless of entity location. Foreign US SaaS, UK e-commerce, Singapore fintech all captured if they have Indian paying users. Compliance obligations: notice + consent + breach notification + data principal rights + DPDP-compliant DPA with Indian processors.
Is India's DPDP similar to GDPR?
Similar concepts but with India-specific nuances. Both have extraterritorial reach, lawful basis requirements, data principal rights, breach notification. Differences: DPDP has blocklist approach to cross-border transfer (vs GDPR adequacy whitelist); DPDP consent is more central (narrower 'legitimate interests'); DPDP specifically governs children + persons with disabilities; DPDP has specific SDF tier. GDPR-compliant companies need India-specific adjustments but core governance framework translates.
Does BQP help with DPDP readiness?
Yes - 90-day DPDP readiness programme. Applicability analysis + data inventory + notice/consent flow design + DPA templates + breach response plan + SDF assessment + cross-border transfer documentation + DPIA for high-risk processing + Children's data compliance + Grievance Officer appointment. Co-ordinated with foreign privacy counsel (GDPR / CCPA alignment). WhatsApp +91 78018 87130.
Related reading