Data Protection Rules, 2026: What Changes on July 1
The Ministry has notified operative rules under the DPDP Act with a phased compliance window. We break down the obligations that take effect first.
The Ministry has notified operative rules under the DPDP Act with a phased compliance window. We break down the obligations that take effect first.
The notification closes a two-year drafting cycle and sets in motion India's most consequential information-law reform since the IT Act.
Notably, the operative rules retain the consent-manager architecture but tighten interoperability standards, with technical specifications expected from the Board within sixty days.
Enforcement guidance suggests a calibrated approach in year one, with the Board prioritising systemic non-compliance over isolated lapses.
Key takeaways
- Significant Data Fiduciaries face a 90-day DPIA deadline.
- Cross-border transfer whitelist is narrower than the draft.
- Children's data provisions apply to all under-18 users without exception.
Never Miss a Critical Legal Update
Get the next issue delivered to your inbox.
More in Regulatory Updates
Labour Codes: A State-by-State Rules Progress Tracker
Twenty-two States have now pre-published rules under at least three of the four Codes. Our tracker maps where employers stand today.