India

The Digital Personal Data Protection Act, 2023, is currently being implemented in phases, starting with its gazette notification on 13 November 2025, whereby the Data Protection Board of India (DPBI) was created, and the administrative and penalty jurisdiction of the DPBI came into effect. This is being done through an 18-month phased implementation process, with the next important phase to take place on 13 November 2026, when independent Consent Managers will become functional, culminating in the final deadline of 13 May 2027. After that date, all organizations, whether corporate or governmental, will have to meet various substantive obligations, including data minimization, consent architecture, and 72-hour breach notification. Noncompliance with the requirements of the law after the final date may lead to financial penalties of up to ₹250 crore.