DPDP Act latest updates: every change to the Act and the Rules

6 October 2026: Removal of Difficulties Order (S.O. 5458(E))

Two corrections to the wording of the Act, made under section 43 and in force on publication. Section 9(1) now reads "child or of a person with disability", so the verifiable consent of the parent or lawful guardian clearly covers both. In section 10(2)(c)(ii) the periodic "audit" of a Significant Data Fiduciary becomes "data audit". No date or duty changes, and the notices this site writes are not affected.

10 December 2025: corrigendum to the Rules (G.S.R. 892(E))

Corrects eight printing errors in the Rules as published, such as "of this Gazette" for "in the Official Gazette" and "(18 or 2013)" for "(18 of 2013)". No rule, date or duty changes.

13 November 2025: DPDP Rules, 2025 notified, the Act in force in three steps (G.S.R. 846(E), G.S.R. 843(E))

The Rules were published and the Central Government set the dates from which each part of the Act applies:

• 13 November 2025: the definitions, the Data Protection Board and the powers to make rules, with Rules 1, 2 and 17 to 21.
• 13 November 2026: the registration of Consent Managers (section 6(9), Rule 4).
• 13 May 2027: what a business must do: notice, consent, security safeguards, breach intimation, children's data, the rights of Data Principals, and the penalties (sections 3 to 17 and 27 to 34, Rules 3 and 5 to 16).

11 August 2023: the Act published (No. 22 of 2023)

The Digital Personal Data Protection Act, 2023 received the President's assent and was published in the Gazette of India. It had no effect until the Central Government notified the dates in 2025 (section 1(2)).

Questions