Casebook

What regulators and regulated entities have published about the Act and the Rules, read at source and set down with dates and citations. The first sector is banking.

Banking

Four entries

Timeline Compiled 25 September 2026 The Act and the Rules as they reach banks: a dated timeline When each part of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 takes effect, read from the Gazette notifications themselves. Reserve Bank of India Compiled 25 September 2026 RBI’s draft data governance guidance and the DPDP Act On 15 July 2026 the Reserve Bank of India released a draft Guidance on Regulatory Expectations for Data Governance. It asks banks and other regulated entities for a framework that complies with the Act and the Rules. Disclosures Compiled 25 September 2026 What three banks disclosed about the DPDP Act in their 2025-26 annual reports Axis Bank, HDFC Bank and Kotak Mahindra Bank each describe work under the Act in their annual reports for 2025-26. This entry records what each report says, in the bank’s own terms, without assessing it. Roles Compiled 25 September 2026 State Bank of India advertises an Assistant Data Protection Officer post In August 2025 the State Bank of India advertised a contractual post to assist its Data Protection Officer, asking for knowledge of the DPDP Act and a privacy certification. The advertisement shows how one bank has framed the role.

Method

The rules every entry follows

Method Compiled 25 September 2026 How the Casebook is compiled What the Forum puts in the Casebook, where it takes it from, what it will not do, and how an organisation named here can ask for a correction.

Each entry records what an organisation or a regulator published, with the date and the document. It does not rate, rank or compare anyone, and an organisation’s absence says nothing about it. A reading of what a document means is labelled as the Forum’s own.