DPDP-Ready Series
India’s data protection law took six years and two false starts to arrive. If you want the complete story, not just the short version, here is every milestone from the Supreme Court judgment that started it to where things stand today.
The full DPDP Act timeline
| Date | Milestone | What it means |
|---|---|---|
| 24 August 2017 | Supreme Court delivers the Puttaswamy judgment | The Court unanimously ruled that privacy is a fundamental right under Article 21 of the Constitution. This created a duty on the government to protect informational privacy through law, and it is the reason DPDP treats consent and individual control as central rather than optional. |
| December 2017 | MeitY sets up a Committee of Experts | The Ministry of Electronics and Information Technology appointed a committee chaired by retired Justice B.N. Srikrishna to study the issue and draft a framework. |
| July 2018 | The Srikrishna Committee submits its report | Along with the report came the first draft law, the Personal Data Protection Bill, 2018. It proposed strict rules on cross-border data transfers, data localisation, and user rights. |
| December 2019 | The PDP Bill, 2019 is introduced in Parliament | A revised version of the 2018 draft was tabled in the Lok Sabha and referred to a Joint Parliamentary Committee (JPC) for detailed review. |
| December 2021 | The JPC submits its report | The committee proposed more than 80 amendments and recommended significantly widening the bill’s scope, including renaming it. |
| 3 August 2022 | The government withdraws the 2019 Bill entirely | Rather than incorporate 80-plus amendments, the government scrapped the bill and started fresh. The commonly cited reasons: the JPC’s changes had turned the bill into a “kitchen sink” covering issues well beyond data protection, and there was unresolved disagreement over how strict cross-border data transfer rules should be. |
| 18 November 2022 | A new, simplified draft is released for public consultation | The Digital Personal Data Protection Bill, 2022 was deliberately shorter and less complex than its predecessor, aimed at being workable rather than exhaustive. |
| 11 August 2023 | The DPDP Act receives Presidential assent | After passing both houses of Parliament in a matter of days, the redrafted bill became law. India became the 19th country in the G20 to pass a comprehensive data protection law, doing so during its own G20 presidency that year. |
| 13 November 2025 | The DPDP Rules, 2025 are notified | The Rules set out the practical requirements for implementing the Act. The Act and Rules follow a phased commencement schedule, with different provisions taking effect at different times. |
| November 2026 (upcoming) | Consent Manager framework becomes operational | The Consent Manager registration provisions are scheduled to take effect, allowing eligible entities to register under the DPDP framework. These provisions do not mean that all such platforms will automatically be operational on that date. |
| May 2027 (upcoming) | Full enforcement begins | Many of the Act’s core obligations, including requirements relating to notices, consent, security safeguards, and breach reporting, are scheduled to commence 18 months after the November 2025 notification, in May 2027. |
Why the withdrawal in 2022 matters
It is worth pausing on the one moment in this timeline that was not simply forward progress: the withdrawal of the 2019 Bill in 2022.
By the time the JPC finished its review, the bill had grown beyond its original scope, including proposals relating to non-personal data governance and other areas beyond the original focus on personal data protection. Commentators at the time noted that many of the JPC’s changes could have been incorporated without a full restart, but the government chose to withdraw the bill entirely and rebuild from a simpler starting point.
The result is the DPDP Act you see today: shorter, more focused, and written in comparatively plain language for a piece of legislation. That is not an accident. It is a direct reaction to what did not work the first two times.
This timeline is background, not something you need to act on. If you are trying to figure out what DPDP actually requires of your business, start with What is DPDP? India’s Data Protection Act Explained for Businesses instead.
Frequently Asked Questions
When was the DPDP Act passed?
The Digital Personal Data Protection Act, 2023 received Presidential assent on 11 August 2023, after passing both houses of the Indian Parliament.
Why was the 2019 Personal Data Protection Bill withdrawn?
The government withdrew it in August 2022 after a Joint Parliamentary Committee proposed over 80 amendments that significantly widened its scope.
The government chose to start fresh with a simpler draft rather than incorporate the changes.
What triggered India’s data protection law in the first place?
India’s data protection law traces back to the 2017 Supreme Court judgment in Justice K.S. Puttaswamy v. Union of India. The Court declared privacy a fundamental right under the Constitution, which set the government on the path toward a formal law.
How long did it take India to pass a data protection law?
Roughly six years, from the 2017 Puttaswamy judgment to the Act’s passage in August 2023, and two earlier draft bills that did not become law.
What are the DPDP Rules, 2025?
The DPDP Rules, 2025 are the operating rules notified on 13 November 2025 that make the DPDP Act enforceable in practice, covering requirements such as valid consent notices, breach reporting timelines, and Significant Data Fiduciary thresholds.
Is the DPDP Act fully enforced yet?
Not yet. Enforcement is rolling out in three phases: the Data Protection Board was established in November 2025, Consent Managers become operational in November 2026, and many of the Act’s main compliance obligations are scheduled to commence in May 2027.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
