Reading VII of XII · Act 22 of 2023
॥ डेटा सुरक्षा ॥
— Tech · in force since 13 Nov 2025 —
Six years after Puttaswamy. The Act is now in phased force; core compliance obligations run into 2027.
“
The statute is compact; the delegated architecture is not.
Editorial readingThe pitch was that India finally needed a personal data law: consent, notice, purpose limitation, breach duties, a Data Protection Board, and penalties for serious failures.
The history made the pitch heavier. The law arrived after Puttaswamy, the Srikrishna Committee draft, the 2019 Bill, a Joint Parliamentary Committee, withdrawal, and a 2022 draft. The 2023 Act is short by design, but much of its meaning lives in exemptions, rules, and the Board that enforces it.
The Bill passed in the monsoon session of 2023 by voice vote. Opposition participation was limited by the politics of the session, and the Bill was not sent to a fresh committee despite the long prior history of committee scrutiny.
The statute is compact; the delegated architecture is not.
Editorial readingThe decisive questions are institutional: how independent the Board is, how exemptions are used, and whether rights requests produce practical remedies.
Supporters read the Act as India's first workable privacy compliance framework for the digital economy.
Support readingCritics read it as under-protective against the State and too dependent on future rules, appointments, and executive discretion.
Critique readingThe Act closes a long legislative loop, but not the privacy debate. Its design is minimalist, enforcement is centralised, and the most important compliance dates now sit in a phased calendar.