DPDP Act (India)

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s horizontal law governing how digital personal data is processed. It recognises both the right of individuals to protect their personal data and the need to process it for lawful purposes. Detailed operating rules are set out in the Digital Personal Data Protection Rules, 2025, which the Central Government notified on 13 November 2025 as G.S.R. 846(E).

The Act and Rules replace the earlier regime under the Information Technology Act (the “reasonable security practices” rules) as the new framework comes into force.

Key terms

Who does it apply to?

The Act applies to the processing of digital personal data within India, whether the data was collected digitally or collected offline and later digitised. It also applies to processing outside India if it is connected with offering goods or services to Data Principals in India.

It does not apply to personal data processed by an individual for personal or domestic purposes, or to personal data made publicly available by the Data Principal or by someone under a legal obligation to publish it.

Phased commencement

Most organisations are working towards the Phase 3 deadline. See the open questions for how we read the exact dates.

Core obligations of Data Fiduciaries

Lawful processing and notice

Processing needs consent or a legitimate use under section 7. Where consent is relied on, it must be preceded by a notice. Under Rule 3, the notice must be understandable on its own, set out an itemised description of the data and the specified purposes, and explain how to withdraw consent, exercise rights and complain to the Board. Withdrawing consent must be as easy as giving it.

Reasonable security safeguards

Rule 6 sets out minimum safeguards, including:

• encryption, obfuscation, masking or tokenisation of personal data;
• access controls over computer resources;
• logging, monitoring and review to detect and investigate unauthorised access;
• measures such as backups to keep processing going after a compromise;
• retaining the logs and relevant personal data for one year for those purposes, unless another law requires otherwise;
• contractual security obligations on Data Processors.

Breach intimation

On becoming aware of a personal data breach, the Data Fiduciary must:

• inform each affected Data Principal without delay, in clear language. The notice covers what happened, likely consequences, mitigation, steps the person can take, and a contact;
• inform the Board without delay, and provide a detailed report within 72 hours (or a longer period the Board allows). The report covers facts, causes, mitigation, findings about the person responsible, remedial measures and the notices sent.

Retention and erasure

Personal data must be erased once the purpose is served, unless the law requires retention. For large e-commerce entities, online gaming intermediaries and social media intermediaries above the user thresholds in the Third Schedule, data is deemed no longer needed after three years of inactivity, with 48 hours’ advance notice to the user. Separately, Rule 8 requires Data Fiduciaries to keep personal data, traffic data and processing logs for at least one year for specified purposes.

Children and persons with disabilities

Processing a child’s data needs verifiable parental consent (Rule 10). Tracking, behavioural monitoring and targeted advertising directed at children are prohibited, subject to the exemptions in the Rules. Similar consent rules apply to persons with disabilities who have a lawful guardian (Rule 11).

Significant Data Fiduciaries

SDFs must appoint a Data Protection Officer based in India and an independent data auditor. Every twelve months they must carry out a Data Protection Impact Assessment and an audit, and submit significant observations to the Board. They must also check that algorithmic software they deploy does not pose a risk to Data Principals’ rights. They may be required to keep specified data within India.

Rights and duties of Data Principals

Data Principals may access information about their data and its processing, correct, complete, update or erase it, use grievance redressal (which they must use before going to the Board), and nominate someone to exercise their rights after death or incapacity. The Act also places duties on Data Principals, such as not filing false or frivolous complaints. Breaching those duties carries a penalty of up to ₹10,000.

Cross-border transfers

Transfers outside India are permitted, except to countries the Central Government restricts by notification. Rule 15 adds that transfers must meet any requirements the government specifies by general or special order. Sector-specific localisation rules, for example in financial services, continue to apply.

Penalties

The Schedule to the Act sets maximum penalties per instance. Examples: up to ₹250 crore for failing to take reasonable security safeguards; up to ₹200 crore for failing to notify a breach, and for breaching children’s obligations; up to ₹150 crore for breaching SDF obligations; and up to ₹50 crore for other breaches. The Board decides the amount having regard to factors such as nature, gravity, duration and mitigation.

Implementation lifecycle

1. Data discovery and mapping. Find digital personal data, its purposes, flows, processors and storage locations.
2. Lawful basis review. Decide consent or legitimate use for each purpose, and redesign notices and consent flows.
3. Rights and grievance processes. Publish contact details, build request handling and set response timelines.
4. Security safeguards. Map Rule 6 to your controls, especially logging and one-year retention.
5. Breach response. Update incident playbooks for notifying people without delay and reporting to the Board within 72 hours.
6. Retention schedules. Apply erasure rules and the minimum one-year log retention.
7. Contracts. Update agreements with Data Processors.
8. Children’s data. Implement verifiable parental consent and remove prohibited tracking.
9. SDF readiness. If you may be notified as an SDF, plan for a DPO, independent audit and annual DPIA.

Evidence and documentation

Useful records include a data inventory, notices and consent records, consent withdrawal logs, records of rights requests and grievances, security control evidence and logs, breach registers and notifications, retention and erasure records, processor contracts and, for SDFs, DPIA and audit reports.

Common misconceptions and pitfalls

• “It’s just GDPR for India.” There are important differences. The Act has no separate “sensitive personal data” category. Its lawful grounds differ, including the ‘legitimate uses’ list. Breach reporting has no materiality threshold. And the penalty model is per-instance caps decided by the Board.
• “Only big tech is affected.” Every Data Fiduciary processing digital personal data in scope is covered. SDF duties are additional.
• “We have until 2027, so nothing to do.” Data mapping, consent redesign and logging changes take time, and the Board is already constituted.
• Ignoring the one-year log retention. Many organisations will need to change their logging and storage architecture.

Relationship with other frameworks