Source: IAPP

The full enforcement of India’s Digital Personal Data Protection Act (DPDPA) is scheduled to begin on 13 May 2027, bringing into effect compliance obligations related to consent management, data principal rights, security safeguards, breach reporting, and a penalty regime with fines reaching up to INR2.5 billion. The consent manager registration framework will become mandatory on 13 November 2026. The Data Protection Board’s budget was increased from INR20 million to INR100 million in the 2026 Union Budget, signaling enhanced preparation for enforcement activities. Regulators in India are increasingly addressing dark patterns, with the Reserve Bank of India’s draft amendment directions taking effect on 1 July 2026, explicitly prohibiting specific manipulative design practices such as basket sneaking, false urgency, and subscription traps in banking applications.

Enforcement data includes findings from a LocalCircles survey cited by Financial Express, which reported a high prevalence of drip pricing, basket sneaking, and interface interference among banking app users. The Central Consumer Protection Authority (CCPA) has issued 997 notices under its 2023 Dark Patterns Guidelines, facilitating refunds totaling INR14.4 million, and issued notices to 15 major e-commerce platforms that continued dark pattern use despite self-audit declarations. The judiciary granted interim reliefs to protect personality rights against AI deepfakes: on 8 and 9 May 2026, an injunction was granted to MP Shashi Tharoor to remove unauthorized AI-generated deepfake videos, and on 10 May 2026, an ex parte ad interim order protected entrepreneur Aman Gupta from unauthorized use of his likeness. On cybersecurity, SEBI issued a 5 May circular naming Anthropic’s Claude Mythos AI model in an advisory on vulnerability detection and created a coordinating task force; IRDAI on 15 May required insurers to submit action reports on frontier AI cyber readiness by 22 May; and CERT-In issued a 25 May blueprint recommending patching internet-facing critical vulnerabilities within 12 hours of discovery or exploitation. On 20 May, a nationwide strike was called by the All India Organisation of Chemists and Druggists protesting online pharmacies allegedly accepting AI-generated fake prescriptions.