Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

India: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
Enacted
India DPDP ActIndia's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.Next: Nov 13 Consent Manager registration rule in force (12 months) · in 17 days
In force
India CERT-In Cyber Security DirectionsRequires service providers, intermediaries, data centres, body corporates and government bodies to report listed cyber incidents to CERT-In within 6 hours of noticing them. Entities must sync clocks to Indian NTP servers, keep ICT logs for a rolling 180 days within India, and name a point of contact. Data centre, VPS, cloud and VPN providers must keep validated subscriber details for 5 years.In effect since Jun 27, 2022
In force
India IT Rules amendment on synthetic contentAmends India's IT Rules 2021 to regulate synthetically generated information (AI-made or AI-altered audio, images and video). Intermediaries that enable such content must label it prominently, keep labels and metadata from being removed, and significant social media intermediaries must get a user declaration and verify it. Takedown clocks are cut sharply: 3 hours after a court or government order, 36 hours for certain grievances, and 2 hours for intimate or morphed images.In effect since Feb 20, 2026

Upcoming deadlines

Transition endsNov 13 · in 17 days
India DPDP ActConsent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.India
ComplianceMay 13, 2027 · in 7 months
India DPDP ActMain data fiduciary obligations apply (18 months)Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.India

Past deadlines

Takes effectFeb 20 · 8 months ago
India IT Rules amendment on synthetic contentSynthetic content rules take effectSGI labeling, user declaration and verification duties, and the shorter 3 hour, 36 hour and 2 hour takedown timelines apply.India
Takes effectNov 13, 2025 · 11 months ago
India DPDP ActDPDP Rules published; Board and procedural rules in forceRules 1, 2 and 17-21 (Data Protection Board constitution and functioning) take effect on publication in the Official Gazette.India
ComplianceSep 25, 2022 · 4.1 years ago
India CERT-In Cyber Security DirectionsExtended date for MSMEs and subscriber validationThe Directions apply to micro, small and medium enterprises, and subscriber validation duties apply to data centres, VPS, cloud and VPN providers, from this date.India
Takes effectTentativeJun 27, 2022 · 4.3 years ago
India CERT-In Cyber Security DirectionsCERT-In Directions take effectThe Directions apply 60 days after issue on 28 Apr 2022. The exact day (27 or 28 June 2022) depends on how the 60 days are counted.India