An independent, public-interest institution

Legislationis notimplementation.

The Digital Personal Data Protection Act, 2023 states obligations. It does not state procedures, competencies or evidence. The Forum develops standards for that gap, publishes its interpretation openly, and builds the professional competence the Act assumes but does not create.

08 Reading the Act · Chapter II General obligations of Data Fiduciary Carried by the Reasonable Security Safeguards Baseline and the Breach Notification Protocol, in draft.
  • {{ r.text }}
{{ m.title }}{{ m.text }}

The standards register

Six frameworks.Each carries a section of the Act.

Each framework states which provision it carries and records the interpretation the Forum has taken, and why. All six are drafts, open for written comment. Select one to see what it covers.

The Act

The frameworks

{{ fw.cat }}{{ fw.version }} · draft, open for comment

{{ fw.name }}

S{{ fw.s }}Carries Section {{ fw.s }} of the Act, {{ fw.heading }}

{{ fw.text }}

What it covers

  • {{ c.t }}

How every framework is made

Drafting
Written comment
Disposition
Versioned publication

The institution at work

One Act.Every line of work around it.

Interpretation, research, education, credentials and participation, each with the date of what it has published. Where nothing is published yet, the page says so.

The Bulletin

Notes on the Act and the Rules, each with its section and sources

The Act in outline, the Rules and their phased commencement, consent, Significant Data Fiduciaries and the Schedule.

Six notes, 18 September 2026
The Casebook

What regulators and banks have published on the Act

Read at source, set down with dates and citations. Nothing here rates or ranks an organisation.

Five entries, banking, 25 September 2026
Education

Four programmes, from a first reading to implementation

No intake announced
Certifications

Five levels of assessed competence

Levels in drafting
Membership

Four pathways to participation

Expressions of interest open
The Observatory

Research on the Act as it is lived

Nothing published yet. Each study will appear with its data and method.
Resources

The statutory record the Forum works from

Linked to official sources only after verification
The chapter series

DPDPA Leadership Conclave

The first chapter has just been held.

Chapter 01 met in Mumbai at the Bombay Stock Exchange on Saturday, 17 October 2026: a keynote and four tracks on operationalising the Act. The programme, the speakers and the full record of the day are on the Conclave’s own pages. Chapter 02 is added to the register once its city is confirmed.

  1. 01MumbaiBombay Stock Exchange · 17 October 2026Held
  2. 02To be announcedAdded when its city is confirmedNext
The hall at the Bombay Stock Exchange before Chapter 01 of the DPDPA Leadership Conclave, the Conclave screen lit above empty rows Chapter 01, MumbaiA keynote and four tracks at the Bombay Stock Exchange, 17 October 2026.

The Rules, and the clock

The implementation window

The Rules were notified in November 2025 and bring the Act into force in phases. Until a phase arrives, its obligation is not in force.

  1. {{ m.stateLabel }} {{ m.kind }} {{ m.title }}

    {{ m.text }}

The eighteen-month period is the implementation window the Act allows. The procedures, competencies and evidence an organisation will be examined on have to be built inside it. That is the work the Forum’s frameworks are for.

The Rules, 2025, in the Bulletin

Institutional neutrality

Independence is a structure,not a claim

The Forum is independent. It accepts no vendor endorsement, publishes its standards freely, and does not act for any government body. Everything it publishes is its reading of the law, not the law, and carries no regulatory force.

{{ c.title }}{{ c.text }}
Read the governance commitments
Participation

Join the Forum

Membership of the Forum is participation in its work. Four pathways, none with a price on the page, and none recommended over another. An expression of interest is read by a person.