Executive Brief
From the landmark right to privacy judgment to the 2026 amendments, India's journey toward comprehensive data protection legislation has been long and contentious.
Key Takeaways
From the landmark right to privacy judgment to the 2026 amendments, India's journey toward comprehensive data protection legislation has been long and contentious.
- Supreme Court declared right to privacy a fundamental right in 2017
- DPDP Act 2023 received presidential assent after 6 years of deliberation
- 2026 amendments expanded regulatory scope and compliance requirements
- Tech companies face fines up to ₹250 crore for non-compliance
Evidence
India's DPDP Act imposes the highest data privacy fines in the world.[1]
Strong85%Supporting Evidence
- While ₹250 crore is significant, EU GDPR fines can reach €20 million or 4% of global turnover, which is substantially higher for large tech firms.
Citations
Report1
The DPDP Act exempts government agencies from all provisions.[1]
Verified88%Supporting Evidence
- Section 17 of the Act allows the central government to exempt any instrumentality of the state by notification, and 15 agencies have been exempted as of 2026.
Citations
Key Numbers
₹250 croreMaximum Fine for Non-ComplianceDPDP Act 2023
24 months from notificationImplementation TimelineMeitY
15 notified agenciesExempted Government AgenciesCentral Government Notification
Timeline
Frequently Asked Questions
Sources
Research
Evidence & Confidence Summary
90
Confidence Score
Strong Evidence
1/2 claims verified
1 Verified1 Unverifiable