Global compliance guide

India Technology Compliance Hub

Plain English guide to tech regulation in India — updated July 2026

1. Digital Personal Data Protection Act 2023

What it is: India's framework for processing digital personal data, consent, legitimate uses, security, individual rights, and cross-border transfers.
Who it applies to: Organisations processing digital personal data in India and certain overseas organisations offering goods or services to people in India.
Key deadlines: Duties commence in stages through government notifications and implementing rules; confirm which provisions are in force.
Penalties for non-compliance: The statutory schedule allows penalties up to ₹250 crore for certain failures to prevent personal-data breaches.

Not sure if this applies to you? The free audit takes 4 minutes.

What it is: Responsible-AI principles addressing safety, equality, inclusion, privacy, transparency, and accountability.
Who it applies to: Public and private organisations designing or deploying AI; the frameworks are policy guidance rather than general binding law.
Key deadlines: No general statutory deadline.
Penalties for non-compliance: No direct penalty under the voluntary frameworks.

Not sure if this applies to you? The free audit takes 4 minutes.

What it is: India continues to develop AI governance through policy, sector regulation, technical measures, and possible future legislation.
Who it applies to: Scope will depend on final measures; higher-impact systems and online platforms are likely to face the closest scrutiny.
Key deadlines: No single general AI compliance date as of July 2026.
Penalties for non-compliance: No general AI-specific penalty until binding rules are enacted; existing data, consumer, competition, and sector laws still apply.

Not sure if this applies to you? The free audit takes 4 minutes.

Operating across multiple jurisdictions? NudgeCompliant maps your obligations across all of them in one audit.

This guide is for information only — not legal advice. Requirements change, so confirm critical decisions with a qualified professional.

Tell us what technology you use and where you operate. Get a plain-English readout of what matters — and what doesn't.

No account. No card. Start with the obligations that matter now.