Official changes in date order
The list covers the criminal law and the law of evidence, the data protection rules, the rules for platforms and the Reserve Bank’s instructions on payment fraud. The status column says whether a change is in force, still a draft, scheduled by the rules that bring it into force, or a reply or alert and not a change in the law. The dates are those of the official documents.
| Date | What changed | Status | Official document | Explained on |
|---|---|---|---|---|
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23 of the DPDP Rules, which hold the main duties of organisations, come into force eighteen months after publication of the Gazette. The date is counted from 13 November 2025. | Scheduled | Rule 1(4), DPDP Rules 2025 | Read the page |
| 13 November 2026 | Rule 4 of the DPDP Rules, on registration of Consent Managers, comes into force one year after publication of the Gazette. The date is counted from 13 November 2025. | Scheduled | Rule 1(3), DPDP Rules 2025 | Read the page |
| 1 July 2026 | The Reserve Bank - Integrated Ombudsman Scheme, 2026 comes into force and replaces the 2021 Scheme. A complaint must reach the Ombudsman within 90 days after the bank’s reply period or last communication. | In force | Reserve Bank of India, FAQs on the Scheme | Read the page |
| 30 March 2026 | Draft amendments to the IT Rules 2021 are published on the Ministry’s website for comment. A notice of 21 April 2026 extends the time for feedback to 29 April 2026 and proposes a further change to the labelling requirement in rule 3(3)(a)(ii). | Draft | MeitY, notice of 21 April 2026 | Read the page |
| 6 March 2026 | The Reserve Bank issues revised instructions on limiting the liability of customers in unauthorised electronic banking transactions, including a compensation mechanism for small value fraud, for public consultation. | Draft | PIB release of 24 March 2026 | Read the page |
| 26 February 2026 | A corrigendum, G.S.R. 148(E), corrects the references to the criminal law in the 2026 amendment of the IT Rules to read the Bharatiya Nyaya Sanhita, 2023 read with the Bharatiya Nagarik Suraksha Sanhita, 2023. | In force | IT Rules 2021, consolidated text updated on 10 February 2026 | Read the page |
| 10 February 2026 | G.S.R. 120(E) amends the IT Rules 2021: removal within three hours of actual knowledge, complaints resolved in seven days, intimate or impersonating content removed within two hours of a complaint, and labelling of synthetically generated information. | In force | IT Rules 2021, consolidated text updated on 10 February 2026 | Read the page |
| 2 December 2025 | In a Lok Sabha reply the Ministry of Home Affairs gives the number of incidents registered on the National Cyber Crime Reporting Portal, the amounts reported lost and the amount saved through the financial fraud reporting system. | Reply | Lok Sabha Unstarred Question No. 432 | Read the page |
| 13 November 2025 | The Digital Personal Data Protection Rules, 2025 are notified as G.S.R. 846(E). The Press Information Bureau gives 14 November 2025 as the date of notification. | In force | Gazette notification and PIB note of 17 November 2025 | Read the page |
| 22 October 2025 | G.S.R. 775(E) substitutes rule 3(1)(d) of the IT Rules 2021, with effect from 15 November 2025: actual knowledge arises only through a court order or a reasoned intimation from an officer not below the rank of Joint Secretary. | In force | IT Rules 2021, consolidated text updated on 10 February 2026 | Read the page |
| 27 November 2024 | In a Rajya Sabha reply on digital arrest scams the Ministry of Home Affairs describes the Cyber Fraud Mitigation Centre, the blocking of spoofed international calls and the Suspect Registry launched on 10 September 2024. | Reply | Rajya Sabha Unstarred Question No. 228 | Read the page |
| 1 July 2024 | The Bharatiya Nyaya Sanhita, except sub-section (2) of section 106, and the Bharatiya Sakshya Adhiniyam come into force. The Press Information Bureau records it on 30 July 2024. | In force | PIB release, Highlights of new criminal laws | Read the page |
| 14 May 2024 | The Ministry of Home Affairs issues an alert against blackmail and digital arrest by cyber criminals who impersonate police and other law enforcement agencies, and advises reporting on 1930 or cybercrime.gov.in. | Alert | PIB alert of 14 May 2024 | Read the page |
| 25 February 2021 | The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 are notified as G.S.R. 139(E), superseding the 2011 intermediary guidelines. | In force | IT Rules 2021, consolidated text updated on 10 February 2026 | Read the page |
| 25 December 2023 | The Bharatiya Nyaya Sanhita, the Bharatiya Nagarik Suraksha Sanhita and the Bharatiya Sakshya Adhiniyam, Acts 45, 46 and 47 of 2023, are notified in the Gazette of India. | Enacted | Gazette of India, Extraordinary | Read the page |
| 30 November 2023 | The provisions of the Jan Vishwas (Amendment of Provisions) Act, 2023 that amend the IT Act come into force (S.O. 4745(E) of 31 October 2023): penalties replace imprisonment in sections 33(2), 67C(2), 68(2), 72 and 72A, the limits in sections 44, 45 and 70B(7) rise, section 69B(4) is reduced and section 66A is omitted. | In force | MeitY note on the Jan Vishwas Act amendments | Read the page |
The criminal law and the law of evidence
The Bharatiya Nyaya Sanhita, the Bharatiya Nagarik Suraksha Sanhita and the Bharatiya Sakshya Adhiniyam were notified in the Gazette of India on 25 December 2023 and, apart from sub-section (2) of section 106 of the Sanhita, came into force on 1 July 2024. The Sanhita repealed the Indian Penal Code and the Adhiniyam repealed the Indian Evidence Act, 1872, with savings for what was done and for proceedings pending before the change. The numbers of the sections that matter in cyber crime cases are on the page on IPC to BNS, and the replacement for section 65B is on the page on section 63 of the BSA.
Data protection and platforms
The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) in a Gazette dated 13 November 2025, in three groups that come into force on publication, after one year and after eighteen months. The two dates after publication are shown above as scheduled. The IT Rules 2021 have been amended four times in the text that the Ministry publishes: in October 2022, April 2023, October 2025 and February 2026, and a draft further amendment was published for comment in March 2026. A draft is not part of the Rules. The page on the IT Rules 2021 sets out the text as updated on 10 February 2026.
Payment fraud and complaints
The Reserve Bank’s instructions of 6 July 2017 on limiting the liability of customers are under revision. Revised instructions were issued for consultation on 6 March 2026, and a customer should check the Reserve Bank’s notifications for the final text and the date from which it applies. The Reserve Bank - Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026, as described on the page on a UPI fraud complaint.
Frequently asked questions
What changed in Indian cyber law recently?
The criminal law and the law of evidence were replaced from 1 July 2024 by the Bharatiya Nyaya Sanhita and the Bharatiya Sakshya Adhiniyam. The Digital Personal Data Protection Rules, 2025 were notified in November 2025, and the IT Rules 2021 were amended in October 2025 and February 2026 to shorten takedown and grievance timelines and to cover AI-generated content.
When do the DPDP Rules come into force?
In three steps counted from publication in the Gazette dated 13 November 2025: some rules at once, rule 4 on Consent Managers after one year, and the rules that hold the main duties of organisations after eighteen months.
Where are the official texts?
Each entry in the table links to the official document: a Gazette notification or consolidated text published by the Ministry of Electronics and Information Technology, a Parliament reply or Gazette copy published by the Ministry of Home Affairs, a release of the Press Information Bureau, or a Reserve Bank of India document.