DPDP Act: The Compliance Clock Ticks as Government Scrambles to Implement India's Data Protection Framework

The Phased Rollout Creates a Compliance Paradox

India's data protection regime is caught in a peculiar limbo. While certain provisions of the Digital Personal Data Protection Act, 2023 are already operational, the substantive obligations that will fundamentally alter how businesses handle personal data remain on the horizon—expected around May 2027. This phased implementation, while pragmatic in theory, is creating a compliance conundrum that every general counsel and data protection officer should be watching closely.

The recent flurry of activity—from the Cabinet Secretary's August directive to prepare time-bound implementation plans to MeitY's October notification of the Removal of Difficulties Order—signals that the government is finally shifting from legislative drafting to operational reality. But the question remains: are we ready?

The Removal of Difficulties Order: More Than Cosmetic Changes

On 6 October 2026, MeitY notified the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, which makes two significant clarifications. First, it addresses consent requirements for persons with disabilities—a long-overdue recognition that accessibility cannot be an afterthought in digital governance. Second, it substitutes "audit" with "data audit" for Significant Data Fiduciaries under the Act.

The latter change might appear semantic, but it's strategically important. By specifically requiring a "data audit" rather than a general audit, the government is signaling that SDFs will face specialized scrutiny of their data processing activities, distinct from financial or operational audits. For companies designated as SDFs—likely large tech platforms, e-commerce giants, and major financial institutions—this means building dedicated data governance frameworks that can withstand technical examination.

Practical Impact: If your organization is likely to be classified as an SDF, start documenting your data flows now. The "data audit" requirement suggests that regulators will expect granular visibility into what data you collect, where it goes, and how it's protected—not just compliance certificates.

Judicial Scrutiny Intensifies: The Digi Yatra and Section 44(3) Challenges

The Kerala High Court's recent query about the status of the Data Protection Board in the Digi Yatra PIL is telling. The Board—envisioned as the primary enforcement mechanism under the DPDP Act—remains conspicuously absent even as privacy litigation accumulates. This creates an enforcement vacuum that undermines the Act's credibility.

Meanwhile, the Supreme Court challenge to Section 44(3) of the DPDP Act strikes at a fundamental tension in Indian governance: the conflict between data protection and transparency. The provision's restriction on disclosure of personal information has been challenged as undermining the Right to Information Act, 2005. Petitioners are seeking interim relief against the masking or deletion of publicly available data—information that was previously accessible under RTI.

This litigation matters enormously for practitioners. If Section 44(3) is upheld in its current form, it will create a presumption against disclosure of personal information even in public records—a significant departure from the RTI Act's transparency mandate. Government lawyers, RTI activists, and anyone dealing with public data should watch this space closely.

The AgriStack Consent Deficit: A Case Study in State Data Processing

The commentary around AgriStack and the Digital Agriculture Mission highlights a critical blind spot in the DPDP framework: consent in state-led data processing. When the government processes farmer data for agricultural schemes, the consent mechanisms that work in commercial contexts become murky. Can a farmer meaningfully consent when the alternative is exclusion from government benefits?

This "consent deficit" isn't unique to AgriStack—it extends to any government digital initiative where participation is effectively mandatory. The DPDP Act's provisions on state data processing (particularly Sections 7 and 17) provide exemptions, but these are being tested against constitutional privacy standards established in Justice K.S. Puttaswamy v. Union of India.

For lawyers advising government departments or PSUs, the message is clear: don't assume that legislative exemptions provide complete cover. The Puttaswamy proportionality test will continue to apply, and courts will scrutinize whether less intrusive alternatives exist.

What Should Lawyers Do Now?

The DPDP Act's implementation timeline creates both urgency and opportunity. Here's what should be on your radar:

1. Map your clients' data processing activities immediately. The Cabinet Secretary's directive to map personal data processing applies to government entities, but the same discipline is essential for private organizations preparing for SDF classification.

2. Review and update privacy notices. With child data rules already imposing compliance duties on ed-tech platforms under Section 9, sector-specific obligations are crystallizing faster than general ones.

3. Prepare for cross-border transfer complexities. The commentary on contractual adjustments suggests that forward-thinking organizations are already restructuring data transfer agreements in anticipation of DPDP rules on cross-border flows.

4. Don't wait for the Data Protection Board to start compliance. The Board's delayed constitution doesn't suspend obligations that are already in force. Courts are already engaging with DPDP issues even without the enforcement infrastructure fully operational.

The Road Ahead

The next eight months leading to May 2027 will be crucial. The government must constitute the Data Protection Board, notify the remaining rules, and provide clarity on SDF designations. For practitioners, this interim period is not a compliance holiday—it's a preparation window that will separate proactive organizations from those scrambling to catch up.

The DPDP Act represents India's most ambitious attempt to balance digital innovation with privacy protection. But ambition without implementation is merely aspiration. The coming months will reveal whether India's data protection framework can deliver on its promise or whether it will join the long list of well-intentioned legislation that stumbled at the enforcement stage.

For lawyers advising on data protection, the message is simple: the time to act is now, not when the full weight of obligations descends in 2027.