The DPDP Act, explained

India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in one page. Read it top to bottom, or jump to what you need.

Who it applies to

The Act covers digital personal data processed in India. It also applies outside India when you offer goods or services to people in India. If you decide why and how personal data is used, you are a Data Fiduciary, and the people whose data it is are Data Principals.

Size is not an exemption. A small shop with a customer list and a contact form has the same basic duties as a large company.

Rights of people

Section 11

Access information

A person can ask what personal data you hold, what you did with it, and who you shared it with.

Section 12

Correct and erase

A person can ask you to correct wrong data, complete it, update it, or erase it when the purpose is over.

Section 13

Grievance redressal

A person can complain to you first. You must have a working channel and answer within the prescribed time.

Section 14

Nominate someone

A person can name another individual to exercise their rights if they die or become incapacitated.

Your duties

Section 5

Give a clear notice

Before or when you ask for consent, tell people what data you collect, why, how to exercise rights, and how to complain.

Section 6

Take valid consent

Consent must be free, specific, informed, unconditional and unambiguous, with a clear action. People can withdraw it as easily as they gave it.

Section 8

Protect the data

Use reasonable security safeguards, report breaches, and erase data once the purpose is served unless the law requires you to keep it.

Section 9

Protect children

Get verifiable parental consent for anyone under 18. No tracking, behavioural monitoring or targeted advertising aimed at children.

Section 8(9)

Publish contact details

Publish the business contact of the person who can answer questions about your data processing.

Section 10

Extra duties for large players

Significant Data Fiduciaries appoint an India-based Data Protection Officer, an independent auditor, and run impact assessments.

Key details from the Rules

Notice must be in plain language, itemised, and tell people how to withdraw consent and how to complain.
Breach: tell affected people without delay, and tell the Board without delay with full details within 72 hours.
Keep logs and personal data needed to detect breaches for at least one year.
Certain large e-commerce, gaming and social media platforms must erase data after three years of inactivity, with 48 hours’ prior warning.
Under-18 users need verifiable consent from a parent or lawful guardian.
Publish the contact details of the person who answers questions about your data processing.

Summary for orientation. Check the official text of the Act and Rules before acting.

Penalties

The Data Protection Board decides the amount after an inquiry. These are maximums set in the Schedule to the Act.

up to ₹250 croreFailing to take reasonable security safeguards to prevent a personal data breach

up to ₹200 croreFailing to notify the Board and affected people of a breach

up to ₹200 croreBreaching the additional obligations for children’s data

up to ₹150 croreBreaching the additional obligations of a Significant Data Fiduciary

up to ₹50 croreBreaching any other provision of the Act or Rules

up to ₹10,000A Data Principal breaching their own duties, for example filing a false complaint

Timeline

Aug 2023
DPDP Act, 2023 enacted
Parliament passes the Digital Personal Data Protection Act. Provisions come into force in stages by notification.
Nov 2025
DPDP Rules notified
The Rules are published and the Data Protection Board is set up. Rollout is phased over 18 months.
Mid-Nov 2026
Consent Manager framework
Registration of Consent Managers begins. This is the next milestone on the calendar.
Mid-May 2027
Core duties become enforceable
Notice, consent, security safeguards, breach reporting, rights handling and penalties apply in full.

Official sources quote slightly different calendar days around the milestone months. Plan for the month, not the day.

Glossary

Data Principal: The individual whose personal data is processed. For a child or a person with disability, this includes the parent or lawful guardian.
Data Fiduciary: Any person or organisation that decides why and how personal data is processed. Most businesses are Data Fiduciaries.
Data Processor: A person who processes data on behalf of a Data Fiduciary, such as a cloud, CRM or payroll vendor.
Significant Data Fiduciary: A fiduciary notified by the Government because of volume or sensitivity of data, risk to people, or risk to the State. Carries extra duties.
Consent Manager: A registered entity that lets people give, manage, review and withdraw consent through one interface.
Data Protection Board: The body that inquires into breaches, directs remedial action and imposes penalties.
Personal data breach: Any unauthorised processing, or accidental disclosure, loss or destruction of personal data that compromises its confidentiality, integrity or availability.
Legitimate use: Situations in Section 7 where data can be processed without consent, such as a person voluntarily giving data for a stated purpose, or State benefits.
Verifiable parental consent: Consent from a parent or guardian that you can check, required before processing a child’s data.

See where you stand

Scan your site or take the assessment.

Scan my website