Are the SPDI Rules still in force after the DPDP Act 2023?

Yes. As of 2026, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, commonly known as the SPDI Rules, remain technically in force. The DPDP Act 2023 does not explicitly repeal them. SPDI is expected to be effectively superseded once all DPDP Act provisions are notified and the Draft DPDP Rules are finalised, but until that transition is complete both regimes co-exist.

What the SPDI Rules cover

The SPDI Rules were issued under Section 43A of the Information Technology Act, 2000. They require any body corporate that collects, receives, possesses, stores, deals with, or handles "sensitive personal data or information" (SPDI) to implement reasonable security practices and procedures. SPDI is narrowly defined and includes passwords, financial information such as card and bank account details, physical and mental health condition, sexual orientation, medical records, and biometric information.

Key SPDI obligations include:

• Publishing a privacy policy on the website that handles SPDI
• Obtaining written consent before collection of SPDI, with the option to withdraw consent
• Permitting data principals to review and correct their information
• Restricting disclosure to third parties without prior consent, with limited exceptions
• Implementing reasonable security practices, with ISO/IEC 27001 cited as a recognised standard

Where DPDP and SPDI overlap and differ

Current status in 2026

The DPDP Act was published in the Gazette in August 2023, but its provisions take effect on dates notified by the Central Government. The MeitY-issued Draft DPDP Rules went out for public consultation, and rolling notifications are bringing different sections of the Act into force. Until the entire DPDP regime is operational and Section 44(3) repeal-and-savings effects are clear, SPDI remains the binding text under IT Act Section 43A. Practitioners therefore treat both as live and design controls to the higher standard.

Practical compliance approach

1. Align to DPDP today. Build consent capture, notices in multiple Indian languages, rights workflows, retention automation, and breach notification playbooks against the DPDP Act now.
2. Retain SPDI controls. Keep your ISO/IEC 27001 certification, written consent for SPDI, and published privacy policy because Section 43A liability has not gone away.
3. Map both regimes. Maintain a control matrix showing which control satisfies which obligation. When DPDP fully replaces SPDI, the matrix becomes the basis for retiring duplicative controls.
4. Watch the notifications. Track MeitY notifications and the final DPDP Rules. The repeal or amendment of Section 43A and SPDI will be a defined moment, not a gradual fade.

Common pitfalls

Some Indian organisations have already removed SPDI-style consent forms and ISO 27001 references in favour of DPDP-only language. This is premature. Until SPDI is formally retired, dropping its specific consent and security artefacts can leave gaps that an adjudicating officer can still act on under Section 43A. Equally, building only to SPDI and ignoring DPDP leaves you unprepared for Data Protection Board scrutiny.

How Opsio helps

Opsio's India compliance team builds a single control set that satisfies both SPDI and DPDP obligations, supported by ISO/IEC 27001 alignment and SOC 2 compliance for Indian IT vendors where customer contracts demand it. Through our cybersecurity services we operate SOC, MDR, and VAPT functions that map to both the SPDI "reasonable security practices" standard and DPDP Section 8 safeguard obligations.

Frequently Asked Questions

Has IT Act Section 43A been repealed?

Not as of 2026. The DPDP Act includes a savings and consequential amendments clause, and Section 43A is widely expected to be modified or repealed in step with full DPDP rollout. Track the official notifications for the actual effective date.

Do I still need a privacy policy under the SPDI Rules?

Yes. The SPDI Rules require a published privacy policy covering the type of information collected, purpose, disclosure practices, and security practices. The DPDP Act adds further notice requirements but does not eliminate the SPDI obligation while SPDI remains in force.

Does ISO 27001 satisfy the "reasonable security practices" requirement?

Yes. The SPDI Rules expressly recognise ISO/IEC 27001 as a reasonable security standard. It is a defensible baseline, and aligns naturally to DPDP Section 8 expectations.

What happens to consents collected under SPDI when DPDP takes full effect?

The Central Government is expected to clarify transition arrangements through the DPDP Rules and supporting notifications. Conservative practice is to refresh notices and re-anchor lawful basis under the DPDP framework as it comes into force, particularly for high-volume consumer platforms.

Which regulator enforces SPDI today?

SPDI Rules do not have a dedicated regulator. Affected individuals can seek compensation before the Adjudicating Officer designated under the IT Act. Once the Data Protection Board is fully operational under the DPDP Act, enforcement of personal data obligations will shift to the Board for matters within DPDP scope.