India

Rule 3(3), inserted into the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 by amendment notified 10 February 2026, applies where an intermediary offers a computer resource which may enable, permit, or facilitate the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of information as synthetically generated information.

Such an intermediary must ensure that any such information not falling within a listed prohibited category (such as child sexual exploitative material or content falsely depicting a real person or event) is prominently labelled, in the visual display or by a prefixed audio disclosure, so a viewer can immediately identify it as synthetically generated.

It must also embed that information with permanent metadata or another technical provenance mechanism, including a unique identifier, to the extent technically feasible. The intermediary must not enable removal, suppression or modification of that label or metadata.

"Synthetically generated information" is defined as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource so that it appears real, authentic or true, subject to listed exclusions for routine or good-faith editing, formatting and accessibility work. This provision has applied since its own notification date, 10 February 2026, under the parent Rules' own commencement clause.

Section 8(6) requires a Data Fiduciary to give the Board and each affected Data Principal intimation of a personal data breach, in the form and manner prescribed. Rule 7 fills in that detail: notify each affected Data Principal without delay, notify the Board without delay with an initial description, then supply a detailed follow-up report within 72 hours of becoming aware of the breach, or such longer period as the Board allows.

Neither provision is currently in force: s.8 sits in the sections-3-to-17 bucket, appointed by Notification G.S.R. 843(E) (13 November 2025) to commence eighteen months after its own publication date, 13 May 2027; Rule 7 sits in the parallel rules-3-to-16 bucket, appointed to the same 13 May 2027 date by the Rules' own Rule 1(4).

The DPDPA is India's first comprehensive personal-data statute, defining "personal data" broadly and technology-neutrally as any data about an identifiable individual (s.2(t)), with no separate sensitive or special-category tier for any kind of data, biometric included.

A Data Fiduciary must have a lawful basis under s.4 before processing, ordinarily the data principal's free, specific, informed, unconditional and unambiguous consent under s.6, or one of s.7's enumerated legitimate uses (voluntarily-provided data for a specified purpose, state functions, employment, medical emergency). A Data Fiduciary bears general erasure (s.8(7)) and security-safeguard (s.8(5)) duties.

None of ss.4, 6, 7, or 8 have commenced: Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as their commencement date under clause (c); that calendar date is arithmetic on the notification's own offset, not a separately printed date. Section 2's definitions, by contrast, came into force on the notification's publication date itself, 13 November 2025, under clause (a).

The Rules implement the DPDPA's app-facing detail: consent-notice form, security safeguards, breach notification (Rule 7), children's-data verification, and Significant Data Fiduciary duties including an annual Data Protection Impact Assessment and algorithmic-fairness assessment (Rule 13).

As notified, only Rules 1, 2, and 17 to 21, the Data Protection Board's own administrative machinery (member recruitment, meeting procedure, digital-office functioning, staff appointment), are currently in force. Rule 4 (Consent Manager registration) commences 13 November 2026; the app-facing bulk (Rules 3, 5 to 16, 22, and 23) commences 13 May 2027.

Section 16(1) sets a blacklist model: transfer of personal data outside India is permitted by default to any country or territory, except where the Central Government affirmatively notifies a restriction. This flips the 2019/2021 draft Bills' government-approved whitelist model. No data-localization mandate appears anywhere in the Act.

Section 16 sits inside the sections-3-to-17 bucket; Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as this bucket's commencement date. No restricted-country list has been notified because the enabling section is not yet in force.

Once in force, a data principal may demand a summary of their processed personal data and the identities of the Fiduciaries and Processors it was shared with (s.11), correction, completion, updating and erasure (s.12), grievance redressal against the Fiduciary in the first instance with a complaint to the Board only after that process is exhausted (s.13), and a right to nominate another individual to exercise these rights on death or incapacity (s.14).

No express portability or objection right appears in the Act text as read. None of this currently binds; Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as Chapter III's commencement date.

The Data Protection Board of India (Chapter VI, ss.18-26) is established and administratively operational, and section 39's ouster of civil-court jurisdiction over any matter the Board is empowered to decide is also in force, both since 13 November 2025 under Notification G.S.R. 843(E), clause (a).

Its penalty powers, set out in the Schedule under s.33(1), are exclusively civil monetary: up to Rs 250 crore for a failure to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, up to Rs 200 crore for a children's-data violation, up to Rs 150 crore for a Significant Data Fiduciary violation, and up to Rs 10,000 for a data principal's own breach of their s.15 duties (impersonation, suppressing material information, frivolous complaints).

No provision found authorizes the Board to award compensation to an affected data principal directly; its penalties are payable to government. Section 33 (the penalty Schedule) and the rest of the complaint and appeal machinery (ss.27-34, except s.27(1)(d)) have not commenced; Notification G.S.R. 843(E), clause (c), appoints eighteen months from its own publication date, 13 May 2027, as their commencement date.

Section 43 makes any person who, without the permission of a computer resource's owner or the person in charge of it, accesses or secures access to it, or downloads, copies or extracts data from it, liable to pay damages by way of compensation to the person so affected; the 2009 amendment that substituted this closing language removed the original one-crore-rupee ceiling, so the civil compensation now carries no cap. Section 66 makes the same conduct, done dishonestly or fraudulently, a criminal offence punishable with imprisonment for a term which may extend to three years or a fine which may extend to five lakh rupees, or both.

The Act has applied since its own commencement, 17 October 2000, per the Central Government's notification under section 1(3).

Section 2(o) defines a literary work to include computer programmes, tables and compilations including computer databases, so a database or compilation is protected only as an ordinary literary work rather than under a separate sui generis database right, which the Act does not create.

Section 51 makes any unlicensed exercise of the copyright owner's exclusive rights an infringement, and section 63 punishes a knowing infringement with imprisonment of not less than six months and up to three years, and a fine of not less than fifty thousand rupees and up to two lakh rupees.

Section 52(1)(a) confines fair dealing, for any work other than a computer programme, to private or personal use including research, criticism or review, and the reporting of current events and current affairs, and names no exception for text-and-data-mining or AI-model training.

Section 65A separately makes it an offence, punishable by up to two years' imprisonment and a fine, to circumvent an effective technological protection measure with the intention of infringing a right the Act confers, subject to listed exceptions including encryption research and authorised security testing. The Act has applied since its own commencement, 21 January 1958, per notification under section 1(3).

A body corporate, meaning any company, firm, sole proprietorship, or other association of individuals engaged in commercial or professional activities, that possesses, deals in, or handles sensitive personal data or information, meaning a password, a financial account or payment-instrument detail, a physical, physiological, or mental health condition, sexual orientation, a medical record or history, or biometric information, in a computer resource it owns, controls, or operates, must implement and maintain reasonable security practices and procedures: a comprehensive, documented information security programme with managerial, technical, operational, and physical control measures commensurate with the information assets it protects.

Certification to the international Standard IS/ISO/IEC 27001 is deemed to satisfy this duty as a matter of law. That certification must be audited by an independent, government-approved auditor at least once a year. The same Rules require the body corporate to publish a privacy policy on its website. The body corporate must also appoint a Grievance Officer.

Section 43A of the Information Technology Act makes a body corporate negligent in implementing or maintaining this programme liable to pay uncapped compensation to any person it causes wrongful loss or wrongful gain.

Any service provider, intermediary, data centre, body corporate, or Government organisation that operates a computer resource in India must synchronise all its ICT system clocks to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or an equivalent source that does not deviate from them. The same entities must enable logs of all their ICT systems and retain them securely within Indian jurisdiction on a rolling 180-day basis.

They must also designate a Point of Contact for CERT-In. They must mandatorily report a broad enumerated list of cyber security incidents to CERT-In within six hours of noticing the incident or being notified of it. That enumerated list includes a data breach, a data leak, and an attack through a malicious or fake mobile app.

Data centres, virtual private server providers, cloud service providers, virtual private network service providers, and virtual asset service providers face an additional duty to register and retain specified customer KYC and transaction records for five years.

Rule 8 binds a publisher of online curated content, defined as one who, performing a significant role in determining the content made available, makes available to users a computer resource enabling access to online curated content over the internet. Rule 9 requires that publisher to observe the Code of Ethics in the Appendix.

That Code classifies all such content into a "U" rating suitable for all ages, with tiered "U/A 7+", "U/A 13+" and "U/A 16+" ratings viewable below the stated age with parental guidance. It also sets an "A" rating restricted to adults, a person the Rules define as eighteen years or older. A publisher making available content classified U/A 13+ or higher must ensure access control mechanisms, including parental locks, are available for it.

A publisher making available "A"-rated content must implement a reliable age-verification mechanism for its viewership. Every publisher offering "A"-rated content must take all efforts to restrict a child's access to it through appropriate access-control measures. The Rules have applied since their own commencement, 25 February 2021, the date of their Official Gazette publication.

Section 52(1)(a)(iii) excuses, as fair dealing, the reporting of current events and current affairs, including the reporting of a lecture delivered in public. Section 52(1)(m) separately excuses the reproduction in a newspaper, magazine or other periodical of an article on current economic, political, social or religious topics, unless the article's author has expressly reserved the right of such reproduction, which makes this exception an opt-out rather than an unconditional one.

Section 39(b) gives the same fair-dealing protection, for the reporting of current events, to excerpts of a broadcast or of a recorded performance. The Act has applied since its own commencement, 21 January 1958, per notification under section 1(3).