Finally, the countdown begins for the implementation of the Digital Personal Data Protection Act which ushers in a new era in India of treating personal data of an individual as their own valuable property rather than a commodity to be traded by third parties without the individual's knowledge or consent.
The Data Protection Board ("DPB") has also been established comprising of 4 members with its head office at NCR, however, the said members have not been appointed yet.
The substantive provisions of the Act and the Rules related to digital personal data protection and consent management will come into force only after 18 months i.e. mid-May 2027 but at least the clock has started ticking. Of course, ultimately, a lot will depend upon how long it takes for the implementation mechanism to be set up.
As per the notifications, provisions of the Act and Rules relating to composition of the DPB, powers of Central Government to make rules as well as appointment of TDSAT as the Appellate Tribunal are now in force which should enable setting up of implementation mechanism, refinement of the framework and (hopefully) meaningful stakeholder engagement.
Provisions related to registration of Consent Managers, their obligations and related inquiries for imposition of penalties in case of breach of conditions of registration of a Consent Manager, etc will come into force after 1 year i.e. mid November 2026. Presumably by this time the DPB will be functional and will have made the necessary rules, regulations and clarified the procedural details.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
