The DPDP Act 2023, explained in ten minutes

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) is the country’s first comprehensive data-protection law. It received Presidential assent in August 2023. The Digital Personal Data Protection Rules, 2025, notified in November 2025, now set out how it works in practice. If your business handles digital personal data of people in India, the Act almost certainly applies to you.

This guide covers what the law requires and where to start. It is not legal advice, but it should help you ask the right questions.

When does it apply?

The Act applies to the processing of digital personal data within India. That covers data collected online and data collected on paper and later digitised. It also applies to processing outside India when you offer goods or services to people in India. A SaaS company in Singapore with Indian customers is in scope.

Two things are excluded:

• data processed by an individual for personal or domestic purposes; and
• data that the person has made publicly available themselves, or that someone else is legally required to publish.

Unlike the old SPDI Rules, there is no separate “sensitive” category. All personal data gets the same baseline protection.

The timeline

The Rules come into force in phases. The provisions that set up the Data Protection Board of India took effect immediately. The framework for Consent Managers follows after 12 months. Most of the obligations on businesses, including notice, consent, security, breach reporting and data principal rights, apply 18 months after notification, in May 2027.

That sounds like plenty of time. It isn’t. A data inventory, new notices, vendor contracts and security fixes usually take a mid-sized organisation 9 to 15 months.

The key roles

• Data Principal: the person the data is about. For a child or a person with a disability, this includes their parent or lawful guardian.
• Data Fiduciary: the organisation that decides why and how data is processed. That is probably you.
• Data Processor: a vendor that processes data on your behalf, such as a cloud host or CRM. You stay responsible for what it does.
• Significant Data Fiduciary (SDF): an organisation the government designates because of the volume, sensitivity or risk of its processing. SDFs carry extra duties.
• Consent Manager: a platform registered with the Board that lets people give, manage and withdraw consent across many organisations.

Two lawful grounds: consent and legitimate uses

Every processing activity needs a lawful basis. The DPDP Act offers only two.

1. Consent

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. It must also be limited to the data needed for the stated purpose. In practice:

• No pre-ticked boxes, no “by continuing you agree” banners and no consent bundled into your terms.
• One purpose per consent, or itemised consents. If you want to use a customer’s email for order updates and marketing, those are two separate choices.
• No forced consent. You cannot make a service conditional on consent to data you don’t need to provide it.
• Withdrawal must be as easy as giving consent. After withdrawal, you and your processors must stop processing within a reasonable time.

2. Legitimate uses

Section 7 lists situations where you can process data without consent. They include:

• data a person voluntarily gives you for a specified purpose without objecting to its use, such as a phone number shared for delivery updates;
• complying with a law, court order or judgment;
• responding to a medical emergency, an epidemic or a disaster;
• certain state functions, such as subsidies and licences; and
• employment purposes, including preventing corporate espionage and protecting confidential information.

Notice what is not on the list: there is no general “legitimate interests” ground like GDPR’s. Analytics, profiling, marketing and most product-improvement work will need consent.

The notice: what you must tell people

When you ask for consent, you must give a notice that stands on its own. It cannot be buried in a long policy. Under the Rules, the notice must include:

1. an itemised description of the personal data you will collect;
2. the specific purpose of processing, and a description of the goods or services it enables;
3. a link to withdraw consent, which must be as easy as giving it;
4. how to exercise data principal rights; and
5. how to complain to the Data Protection Board.

People must be able to read the notice in English or any of the 22 languages in the Eighth Schedule to the Constitution.

If you collected data with consent before the Act took effect, you must send those people a notice too.

Your core obligations

1. Accuracy. Keep personal data complete, accurate and consistent if you use it to make decisions about someone or share it with another fiduciary.
2. Reasonable security safeguards. Protect data against breaches, including breaches at your processors. The Rules set a minimum baseline (next section).
3. Breach notification. Tell the Board and every affected person when a breach happens.
4. Retention limits. Erase data once the purpose is served or consent is withdrawn, and make sure your processors do the same, unless the law requires you to keep it.
5. Processor contracts. Engage processors only under a valid contract.
6. Grievance redressal. Publish a contact for privacy questions and run a process that resolves grievances within the timeline the Rules set (no more than 90 days).
7. Children’s data. Get verifiable parental consent before processing data of anyone under 18.

What “reasonable security safeguards” means

This is where privacy law becomes a security requirement. The Rules set out the minimum measures every Data Fiduciary must take:

• Encryption, obfuscation, masking or virtual tokens to protect personal data;
• Access controls over the systems that process it;
• Logging, monitoring and review of access, so you can detect, investigate and fix unauthorised access;
• Backups and business-continuity measures, so data stays available and intact after an incident;
• Retaining logs and related personal data for at least one year, to support breach detection and investigation. The CERT-In Directions separately require ICT logs to be kept within India for 180 days; and
• Contracts with Data Processors that require them to take the same safeguards.

Notice the word minimum. After a breach, the Board will ask whether your safeguards were reasonable: did you test for the vulnerability, and how quickly did you fix it? A recent penetration test, a closed-out remediation tracker and working monitoring are your best evidence.

Breach notification

The DPDP Act has no materiality threshold. Any personal data breach must be reported, not just “serious” ones.

• To affected people: without delay, in clear language: what happened, the likely consequences, what you are doing, how they can protect themselves, and who to contact.
• To the Data Protection Board: an initial report without delay, then a detailed report within 72 hours of becoming aware, covering the facts, cause, mitigation and notices sent. The Board can allow more time on written request.
• To CERT-In: if the breach is also a reportable cyber incident, the CERT-In Directions require you to report it within six hours.

Two regulators, two clocks: your incident-response plan needs one playbook that triggers every notification from one set of facts.

Retention and erasure

You must erase personal data when the person withdraws consent, or when the purpose is no longer being served, whichever comes first.

For certain large platforms, the Rules make this concrete. Large e-commerce entities, online gaming intermediaries and social media intermediaries must erase a user’s data after three years of inactivity. They must warn the user 48 hours in advance, so the user can log in and keep the account.

Everyone else still needs a documented retention schedule, and a deletion process that reaches backups and vendors.

Children’s data

The Act treats anyone under 18 as a child. Before processing a child’s data you need verifiable consent from a parent or lawful guardian. You must also never:

• process data in a way likely to harm a child’s well-being;
• track or behaviourally monitor children; or
• target advertising at children.

The Rules let you verify the parent through identity details you already hold or a government-backed virtual token, such as DigiLocker. Educational institutions and healthcare providers get limited exemptions.

Significant Data Fiduciaries

If the government designates you as an SDF, you must also:

• appoint a Data Protection Officer based in India, who reports to the board of directors;
• appoint an independent data auditor;
• conduct a Data Protection Impact Assessment and an audit every year, and report the significant findings to the Board;
• check that algorithmic software you use does not put people’s rights at risk; and
• comply with any data localisation restrictions the government sets for specified categories of data.

Rights of data principals

People can ask you for:

• a summary of their personal data and how it is processed, plus the identities of everyone you have shared it with;
• correction, completion, updating or erasure of their data;
• grievance redressal, which they must use before complaining to the Board; and
• nomination of someone to exercise these rights if they die or become incapable.

People have duties too. They must not impersonate anyone, suppress information or file false complaints. Breaching these duties can attract a penalty of up to ₹10,000.

Cross-border transfers

The DPDP Act uses a negative list: transfers are allowed to any country except those the government restricts. Sector rules, such as RBI’s payment-data localisation, still apply.

Enforcement and penalties

The Data Protection Board of India is a “digital by design” regulator. Complaints, hearings and orders happen online. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Penalties are set per instance of breach and can be severe:

Breach	Maximum penalty
Failing to take reasonable security safeguards to prevent a breach	₹250 crore
Failing to notify the Board or affected people of a breach	₹200 crore
Breaching the obligations on children’s data	₹200 crore
Breaching the additional obligations of a Significant Data Fiduciary	₹150 crore
Breaching any other provision of the Act or Rules	₹50 crore

The Board weighs the nature, gravity and duration of the breach, and what you did to mitigate it. You can also offer a voluntary undertaking to settle proceedings. Documented compliance work really does reduce exposure.

The Act also removes section 43A of the IT Act and, with it, the 2011 SPDI Rules. Sector regulators such as RBI, SEBI and IRDAI keep their own requirements.

Where to start: a practical roadmap

You can’t protect data you don’t know you have.

1. Build a data inventory. List every system, vendor and spreadsheet that touches personal data: what, why, where and who can access it.
2. Map a lawful basis to every purpose. Anything that is neither consent nor a legitimate use has to stop.
3. Rewrite notices and consent flows. Make them standalone, itemised, multilingual where needed, and as easy to withdraw from as to give.
4. Review vendor contracts. Add DPDP-aligned processor clauses on security, breach reporting, deletion and sub-processors.
5. Test your safeguards. Run vulnerability assessments and penetration tests on every system that holds personal data, then fix and retest.
6. Fix logging and monitoring. Make sure you keep logs for at least a year and actually review them.
7. Rehearse breach response. Run a tabletop exercise against the 72-hour Board deadline and the 6-hour CERT-In clock.
8. Write a retention schedule and automate deletion, including in backups and at vendors.
9. Stand up a rights-request process with identity verification, tracking and deadlines.
10. Train your people. Most breaches still start with a human.

A SafCY privacy assessment covers the inventory, notices, consent and safeguards in one engagement. You get a ranked gap register, ready-to-use notice and consent copy, and penetration-test evidence you can show the Board. Talk to us about where you stand.