Bulletin

The Act 18 September 2026 The Digital Personal Data Protection Act, 2023, in outline What Parliament enacted in August 2023: the scope of the Act, the roles it creates, and the obligations it places on those who process personal data. → The Rules 18 September 2026 The DPDP Rules, 2025: notified, with a phased commencement The Rules that make the Act operable were notified in November 2025. The obligations they carry arrive in stages, not at once. → The Act 18 September 2026 Consent, as Section 6 defines it Five adjectives, one affirmative act, and a right to withdraw that must be as easy as the giving. What the Act requires of consent, and where it does not require it at all. → The Act 18 September 2026 What the Act asks of a Significant Data Fiduciary Section 10 lets the Central Government single out fiduciaries whose processing carries greater risk, and attaches three further obligations to the designation. → The Act 18 September 2026 Penalties under the Schedule to the Act The Act sets a monetary ceiling for each class of breach and lists the factors the Board must weigh before imposing any of them. → Conclave 18 September 2026 Conclave, Chapter 01: what is confirmed The first chapter of the DPDPA Leadership Conclave is set for Mumbai on 17 October 2026. This note records what is settled and what is not. →

Every note carries its date and its sources, cites the section it describes, and distinguishes the Act from the Rules. A note is the Forum’s reading of the law, not the law.