Current status
Supreme Court challenge to the DPDP Act: what stands today
Writ petitions in the Supreme Court challenge the DPDP Act's RTI amendment, exemptions and Board design. Notice issued, no stay: what stands in October 2026.
Archive
Articles and updates, page 3
57 articles on the DPDP Act 2023 and the DPDP Rules 2025, newest first. Every legal claim cites the official source it rests on.
Children
Children's data under the DPDP Act: consent, bans and exemptions
The child definition is in force and the section 9 duties are not: they commence on a computed 13 May 2027, interpretation until officially confirmed. What section 9 requires, the tracking and targeted advertising ban, Rule 10 verification and the Fourth Schedule exemptions.
Compliance
DPDP compliance requirements for businesses: the obligations map (2026)
The DPDP duties on a business in 6 groups, none of them in force yet: the 2 grounds, notice, consent, section 8, rights, children, SDF and transfers. Every one is cited to the Gazette.
Consent
What is a Consent Manager under the DPDP Act? Definition, registration and obligations
A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for consent, not software. Computed commencement for registration under Rule 4 is 13 November 2026, interpretation until officially confirmed. The section 2(g) definition, the section 6 consent channel, and the First Schedule's Part A conditions and Part B obligations, quoted and cited.
Vendors
DPA clauses under the DPDP Act: what the law requires versus good drafting
The DPDP Act prescribes little about a DPA, and none of that little is in force: a contract, Rule 6(1)(f) safeguards, erasure, from a computed 13 May 2027. Every other clause is drafting the statute never asks for, and that date is interpretation until officially confirmed.
Compliance
Data protection audit under the DPDP Act: who must be audited and what the text requires
Only notified Significant Data Fiduciaries need a DPDP audit, and the duty has not started: section 10(2)(b) and Rule 13 commence on a computed 13 May 2027. That date is interpretation until officially confirmed. The independent auditor, the 12 month cycle, and the significant observations report.
Notice
Does the DPDP notice have to be in 22 languages? What section 5(3) actually says
The section 5(3) language option is not in force yet: it commences on a computed 13 May 2027, interpretation until officially confirmed. Section 5(3) gives the Data Principal the option of English or any Eighth Schedule language. A readiness duty, not 22 published versions, and no 250 crore penalty.
Compliance
Additional obligations of a Significant Data Fiduciary: DPO, auditor, DPIA
Section 10 adds an India based DPO, an independent auditor and a 12 month Rule 13 DPIA and audit cycle once notified: all 3 commence on a computed 13 May 2027. That date is interpretation until officially confirmed. The DPO answers to the board of directors, and Rule 13 adds algorithmic due diligence and conditional localisation.
Compliance
DPIA under the DPDP Act: who must do one, what it contains, when it starts
Only a notified Significant Data Fiduciary will owe a DPIA, and section 10 and Rule 13 both commence on a computed 13 May 2027. That date is interpretation until officially confirmed. What section 10(2)(c)(i) defines, the 12 month Rule 13 cycle, and the GDPR habits that do not carry.