A practitioner's primer on the structural design of India's first comprehensive data-protection statute — lawful basis, data-fiduciary obligations, the Significant Data Fiduciary tier, data-principal rights, cross-border transfers, exemptions, the Data Protection Board, the Schedule's ₹250 crore penalty cap, and the staged repeal of Section 43A IT Act and the SPDI Rules 2011. Written as the foundational reference for any DPDP question.
India's first comprehensive data-protection framework is now operational, but in a staged sequence: Consent Manager rules effective November 2026; substantive Significant Data Fiduciary obligations effective May 2027. A practitioner's read on the architecture, the timeline, and the compliance work that has just become urgent for law firms and for the entities they advise.