DPDP guide
The DPDP Act, explained for Indian businesses.
A plain-language overview of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. This is general information, not legal advice.
The clock is already running
Three dates that matter.
November 2025
DPDP Rules notified. The Data Protection Board is established.
November 2026Next
The Consent Manager framework goes live.
May 2027
Full obligations apply: notice, consent, rights, security, breach reporting, retention, children's data.
Dates per the DPDP Rules, 2025, notified by MeitY in November 2025.
What is the DPDP Act?
India's Digital Personal Data Protection Act, 2023 governs how organisations collect, use, store and share digital personal data. The DPDP Rules, 2025, notified in November 2025, set out how it works in practice, with a phased timeline for when each obligation applies.
Who does it apply to?
Digital personal data processed in India — including data collected on paper and later digitised — and processing outside India connected to offering goods or services to people here.
If your business holds names, phone numbers or emails of identifiable people, it almost certainly applies to you. That includes business contacts and employees.
Key terms
- Data Principal
- The individual the data is about.
- Data Fiduciary
- The organisation that decides why and how data is processed.
- Data Processor
- An organisation that processes data on a fiduciary's behalf.
- Significant Data Fiduciary
- A fiduciary notified by the government based on factors like volume and sensitivity of data. It carries additional obligations.
- Consent Manager
- A registered entity that helps individuals give, manage and withdraw consent.
Core obligations for Data Fiduciaries
- Give a clear notice explaining what data you collect and why
- Obtain valid consent, or rely on a legitimate use permitted by the Act
- Make withdrawing consent as easy as giving it
- Protect data with reasonable security safeguards
- Inform the Data Protection Board and affected individuals of a personal data breach, within 72 hours for the Board's report
- Erase data when its purpose is served, unless the law requires retention
- Publish a contact for data-protection questions and run a grievance process
- Engage processors only under a valid contract
- Obtain verifiable parental consent before processing children's data (under 18), and never target ads at them
Rights of individuals
- Access information about their data
- Correct, complete, update or erase it
- Grievance redressal
- Nominate someone to act for them
Penalties
The Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for breach-notification or children's-data failures, and up to ₹150 crore for a Significant Data Fiduciary's non-compliance. These can apply across categories, and are decided by the Data Protection Board.
Want to know how this applies to you?
One free call. Your roadmap in 48 hours.