privacy
India's Digital Personal Data Protection Act, 2023 (DPDPA, No. 22 of 2023) received Presidential assent on 11 August 2023, but its substantive chapters have not yet commenced.
Notification G.S.R. 843(E) (Gazette of India Extraordinary, Part II Sec. 3(i), 13 November 2025), issued under DPDPA s.1(2), appointed its own publication date, 13 November 2025, as the date on which s.1(2), s.2 (definitions), sections 18 to 26 (the Data Protection Board), section 35, sections 38 to 43, and section 44(1) and (3) came into force, and appointed eighteen months from that same publication date, 13 May 2027, as the date on which sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 10, sections 11 to 17, section 27 (except (1)(d)), sections 28 to 34, 36, 37, and section 44(2), the entire lawful-basis, consent, data-subject-rights, and cross-border-transfer chapters, come into force.
The Act has no special or sensitive-category tier at all, so once its duties commence, a voiceprint or faceprint is governed as ordinary personal data under the same general consent and security rules as any other identifier, not as a distinct heightened category.
Section 3(c)(ii) carves out personal data the data principal has made or caused to be made publicly available, one of the broadest such carve-outs in the region, though it does not on its own terms rescue an identifier a service derives from that public material.
Because section 44(2), which would repeal IT Act section 43A and the Sensitive Personal Data or Information Rules, 2011, is itself among the provisions not yet commenced, the SPDI Rules 2011 remain India's operative sensitive-data regime today; this document does not author them as an instrument, for lack of a verified working primary URL this pass.
