MeitY Signals A Sharper Turn In India's Data Protection Rollout

In a notable shift, the Ministry of Electronics and Information Technology (“MeitY”) is considering compressing the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Act Rules, 2025 (“DPDP Act & Rules”) compliance timelines, from the originally notified 18 months to immediate, 3-month, or 12-month windows for select provisions. The closed-door meeting held on January 22, 2026 proposed acceleration targets for areas with direct state interface.

Specifically, Rule 23 (power to call for information from data fiduciaries and intermediaries), Rule 15 (transfer of personal data outside India), and Rule 13(5) (constitution of a government committee to recommend restrictions on overseas data transfers by Significant Data Fiduciaries) are proposed to be enforced immediately, signalling the government's intent to retain early control over information flows and regulatory oversight. Rule 8(3) mandating retention of all personal data, traffic