Ten years ago, “digital rights” wasn’t really a category in Indian law; it barely existed as a phrase, let alone a framework. Now it spans constitutional interpretation, a dedicated statute, and a brand-new regulator. Tracing how we got here says a lot about where things stand in 2026, and where they’re headed next.

Where it starts: Puttaswamy

The real turning point was 2017: the Supreme Court’s nine-judge bench ruling in Justice K.S. Puttaswamy v. Union of India, which held that privacy is a fundamental right under Article 21. That case didn’t create data protection law on its own, but it gave every argument that followed for a dedicated statute, for limits on government data collection, for restrictions on surveillance its constitutional footing. Without Puttaswamy, a lot of what came after would have been standing on much shakier ground.

The long gap between ruling and law

For years after Puttaswamy, India had no comprehensive data protection statute, just scattered provisions under the IT Act and its rules. Multiple draft bills got introduced, revised, and quietly withdrawn over nearly five years before Parliament finally passed the Digital Personal Data Protection Act in August 2023. And even then, it didn’t switch on right away; the government chose to phase it in deliberately.

The DPDPA rollout: where we actually are

This staggered implementation matters, because a lot of people assume the law is fully in force when it isn’t yet.

• Phase 1 (November 13, 2025): The Data Protection Board of India got set up, along with its core processes.
• Phase 2 (November 13, 2026): Consent Manager registration kicks in. Consent Managers act as intermediaries letting individuals, “Data Principals,” in the Act’s language, grant, review, and pull back consent for how their data gets used. Think of it as something conceptually close to the account aggregator system already running in Indian finance.
• Phase 3 (May 13, 2027): This is when full compliance actually bites: mandatory standalone notices in prescribed languages, 72-hour breach notification windows, and most of the substantive obligations on companies handling personal data.

So as of mid-2026, we’re genuinely in the middle of this rollout, not at the end of it.

What rights does this actually give you?

Once it’s fully live, the Act hands individuals a defined set of enforceable rights: to be told what’s being collected and why, to access and correct your own data, to ask for deletion, to object to certain processing, to move your data elsewhere, and in some cases, to nominate someone to exercise these rights on your behalf if you die or become incapacitated, say.

The Act also reaches outside India’s borders. Foreign companies processing Indian users’ personal data fall under it even if they’re operating entirely offshore, as long as they’re offering goods or services to people here. Structurally, that’s not unlike how the EU’s GDPR works, even if the details differ.

It’s bigger than data protection

Digital rights in India aren’t limited to the DPDPA. There’s ongoing tension around content takedown powers under the IT Rules, the scope of government surveillance under telecom law, net neutrality, and the right to be forgotten a question several High Courts have handled inconsistently, without the Supreme Court ever quite settling it nationally.

What this pattern tells us

Notice the shape of it: judicial recognition first, legislation years later, full institutional enforcement years after that again. This is basically how digital governance has evolved in India across the board: courts get there first, Parliament catches up eventually, and the machinery to actually enforce any of it takes longer still.

For anyone navigating this in 2026, the honest answer is: we’re mid-transition. The rights exist on paper. The enforcement machinery is being built in real time. What happens between now and the Phase 3 deadline in May 2027 will decide how much of this actually shows up in people’s day-to-day lives.

Author by,
RVR Attorneys Associates