The story so far
First a right. Then a law. Now a clock.
Every compliance programme starts with the same question: how did we get here? In 2017, nine Supreme Court judges answered in one voice that privacy is a fundamental right. In 2023, Parliament turned the right into obligations — the Digital Personal Data Protection Act. And in November 2025 the Rules arrived, the Data Protection Board opened its doors, and the transition clock started: core obligations are enforceable 13 May 2027.
Where things stand · October 2026
The right
Privacy affirmed as a fundamental right — Puttaswamy, nine judges, unanimous.24 Aug 2017The law
DPDP Act passed by Parliament — in force.11 Aug 2023The Rules — the clock starts
G.S.R. 846(E) notified; the Data Protection Board opens; the 18-month transition begins.13 Nov 2025206
days remaining
until core Data Fiduciary obligations are enforceableThe Act asks real work of almost every organisation that handles personal data — notice before consent (§ 5 · Rule 3), consent that can be withdrawn as easily as it was given (§ 6), security safeguards (§ 8 (5)), breach reporting on a 72-hour clock (§ 8 (6) · Rule 7), and erasure once a purpose is served (§ 8 (7) · Rule 8). Every citation above opens the actual text of the law, right here.