Government to notify DPDP Act rules by September 28, says Vaishnaw

New Delhi: The government is preparing to formally notify the rules under the Digital Personal Data Protection (DPDP) Act, 2023, as early as September 28. 

The announcement, made by Union Minister for Electronics and Information Technology Ashwini Vaishnaw, signals the end of a nearly two-year wait since the legislation was passed, paving the way for the nation's first comprehensive data privacy framework to take effect.

Vaishnaw, speaking at the AI Impact Summit 2026 on Thursday, confirmed that the DPDP rules are "ready and will be published in a few days from now," with the formal release targeted before the end of the month. 

This timeline aligns with earlier commitments to notify the rules ahead of the Winter Session of Parliament, allowing businesses and regulators to gear up for enforcement. "The DPDP rules are ready and will be notified within the next 10 days," Vaishnaw stated.

The DPDP Act, enacted in August 2023 following years of debate sparked by the 2017 Supreme Court ruling in the Justice K.S. Puttaswamy case, affirming privacy as a fundamental right under Article 21 of the Constitution, aims to regulate the collection, processing, storage, and transfer of digital personal data. 

Unlike the European Union's General Data Protection Regulation (GDPR), which applies to all forms of personal data and imposes hefty fines up to 4% of global turnover, the DPDP Act focuses exclusively on digital data and caps penalties at Rs 250 crore (about €28 million) for violations. 

It does not distinguish between "personal" and "sensitive" data, a departure from earlier drafts, and introduces concepts like "data fiduciaries" (entities handling data) and "data principals" (individuals whose data is processed).

The draft Digital Personal Data Protection Rules, 2025, released by the Ministry of Electronics and Information Technology (MeitY) on January 3, 2025, for public consultation, flesh out the Act's operational details. 

Over 6,900 inputs were received from citizens, industry stakeholders, and experts by the February 18 deadline, covering everything from consent mechanisms to data breach notifications.