Key points
- The DPDP Act, 2023 applies to every organisation that processes digital personal data in India, whatever its size.
- Core obligations apply from 14 May 2027; Consent Manager registration from 14 November 2026.
- Personal data may be processed only with valid consent or for a legitimate use under Section 7.
- Every personal data breach must be reported to the Data Protection Board and affected people, with a detailed report within 72 hours.
- Penalties go up to ₹250 crore per breach.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law on how organisations collect, use, store and share personal data in digital form. The DPDP Rules, 2025, notified in November 2025, set out how the Act works in practice: what a notice must say, how to report a breach, how long to keep data, and how to handle children's data.
The law calls an organisation that decides why and how personal data is processed a Data Fiduciary, and the person the data is about a Data Principal. A vendor that processes data on your behalf is a Data Processor.
Who does the DPDP Act apply to?
It applies to every organisation that processes digital personal data in India, whatever its size or sector: companies, hospitals, schools, colleges, banks, startups, NGOs and government bodies. It also applies to processing outside India if it is connected with offering goods or services to people in India. Data collected on paper and later digitised is covered too.
DPDP timeline: when do the rules apply?
| Date | What comes into force |
|---|---|
| 13–14 November 2025 | DPDP Rules notified; Data Protection Board of India provisions in force. |
| 14 November 2026 | Registration of Consent Managers (Rule 4). |
| 14 May 2027 | Core obligations for every Data Fiduciary: notice, consent, security safeguards, breach reporting, retention and erasure, children's data, rights and grievance redressal (Rules 3 and 5 to 16). |
The 18-month runway sounds long, but data mapping, policy approval, system changes, vendor contracts and staff training together take most organisations six to twelve months.
The core DPDP obligations
- Lawful basis. Process personal data only with valid consent or for a legitimate use listed in Section 7, such as legal obligations, medical emergencies or employment.
- Notice. Give a clear, standalone notice listing the data collected and the purpose, how to withdraw consent, how to exercise rights and how to complain to the Board (Section 5, Rule 3).
- Consent. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, and as easy to withdraw as to give (Section 6).
- Security safeguards. Encryption or masking, access control, logging and monitoring, backups, and logs kept for at least one year (Section 8(5), Rule 6).
- Breach reporting. Inform affected people and the Data Protection Board of every personal data breach, with a detailed report to the Board within 72 hours. See our breach reporting guide.
- Retention and erasure. Erase data when the purpose is served or consent is withdrawn, unless a law requires you to keep it (Section 8(7), Rule 8).
- Vendors. Use a Data Processor only under a valid contract; you stay responsible for what it does (Section 8(2)).
- Contact and grievances. Publish a contact for data protection questions and resolve grievances within a published time, no more than 90 days (Sections 8(9), 8(10), 13 and Rule 14).
- Children's data. Get verifiable consent from a parent or guardian before processing data of anyone under 18, and do no tracking, behavioural monitoring or targeted advertising aimed at children (Section 9, Rule 10).
Rights of Data Principals
People can ask for a summary of their personal data and who it was shared with (Section 11), have it corrected, completed, updated or erased (Section 12), have grievances resolved (Section 13), and nominate someone to act for them (Section 14). You need a process, an owner and a register for each.
Significant Data Fiduciaries
The government can notify some organisations as Significant Data Fiduciaries based on the volume and sensitivity of the data they process and the risks involved. They must appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic data protection impact assessments and audits (Section 10).
DPDP penalties
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a breach or for breaching children's data obligations. See the full list in our DPDP penalties guide.
DPDP by sector
The obligations are the same for everyone, but the hard parts differ by sector. See our guides for hospitals and clinics, schools and colleges, NBFCs and fintech and e-commerce.
How to get DPDP-ready: a 7-step plan
- Assign ownership. Name a data protection lead and get leadership sponsorship.
- Map your data. List every system, file and vendor that holds personal data, with its purpose and lawful basis.
- Close the gaps. Use a DPDP compliance checklist or our free readiness check to find what is missing.
- Fix notices and consent. Rewrite notices, add consent records and a simple withdrawal route.
- Strengthen security and breach response. Apply Rule 6 safeguards and write a breach plan you can run in 72 hours.
- Set retention and vendor controls. Agree retention periods and add DPDP clauses to vendor contracts.
- Train and review. Train leaders and staff, keep records, and review at least once a year.
Frequently asked questions
When does the DPDP Act come into force?
The DPDP Rules were notified in November 2025 and apply in phases. Consent Manager registration starts on 14 November 2026, and the core obligations for all Data Fiduciaries, including notice, consent, security safeguards, breach reporting and retention, apply from 14 May 2027.
Does the DPDP Act apply to small businesses?
Yes. The Act applies to any organisation that processes digital personal data in India, regardless of size. Some obligations are heavier for Significant Data Fiduciaries, but core duties such as notice, consent, security and breach reporting apply to everyone.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Failing to report a breach or breaching children's data obligations can attract up to ₹200 crore each.
Do we need a Data Protection Officer under DPDP?
Only Significant Data Fiduciaries must appoint a Data Protection Officer based in India. Every other Data Fiduciary must publish the contact details of a person who can answer questions about its processing of personal data.
Is consent always required under DPDP?
No. Personal data can also be processed for legitimate uses listed in Section 7, such as complying with a law, responding to a medical emergency, employment purposes, or a purpose for which the person voluntarily gave their data and did not object.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.