DPDPA
2023.
Decoded.
"India's comprehensive digital personal data law is now in its implementation window. Organisations processing digital personal data in India, or offering goods and services to individuals in India, should use the notified Rules period to build evidence-backed compliance."
Content reflects DPDPA 2023 and DPDP Rules notified 13 November 2025. For informational purposes only — not legal advice. Engage qualified data protection counsel for your specific situation.
This page is based on the final Act and the notified Rules, not draft-rule numbering.
Compliance dates may be referred to by Gazette date or publication date in public commentary. Organisations should track MeitY, DPBI, and sectoral-regulator notifications before taking final implementation positions.
Generate Your Tailored Compliance Roadmap
Answer 6 questions about your business. Receive a prioritised, personalised DPDPA compliance plan with exact statutory obligations, required documents, and milestone deadlines.
What best describes your business?
We will tailor your compliance roadmap based on your industry-specific obligations and risks.
The 5 Rights Every Business Must Honour
Every individual whose personal data you hold has these four enforceable rights under the DPDPA 2023. Non-fulfilment can be escalated directly to the Data Protection Board of India.
Right to Information
""A Data Principal shall have the right to obtain from the Data Fiduciary — (a) a summary of personal data being processed by the Data Fiduciary; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared.""
You must tell individuals exactly what data you hold about them, why you are processing it, and who you have shared it with — upon their request. This is fulfilled through your DSAR (Data Subject Access Request) process.
"Every business processing personal data must build operational workflows to fulfil these rights within prescribed timeframes. A failure to respond can be escalated to the Data Protection Board — but only after exhausting your internal grievance mechanism first. Build that mechanism before anything else."
Key Terms You Must Get Right
The DPDPA 2023 defines 28 terms precisely in Section 2. Misidentifying your role (Fiduciary vs Processor) or your data (personal vs anonymous) fundamentally changes your compliance obligations.
Section 2 — Definitions
The DPDPA 2023 contains 28 defined terms in Section 2 that are used precisely throughout the Act. Understanding these definitions is the foundation of every compliance obligation. Misidentifying your role (Fiduciary vs Processor) or your data (personal vs anonymous) can fundamentally change your obligations.
""personal data" means any data about an individual who is identifiable by or in relation to such data"
Any piece of information that can — directly or indirectly — identify a living individual. This includes obvious identifiers (name, phone) and indirect identifiers (IP address, device ID, location, behavioural patterns linked to a person).
Email addresses, mobile numbers, Aadhaar, PAN, transaction history, GPS location, cookies tied to a person, health records, and biometric data all qualify.
Verbatim text sourced from the Digital Personal Data Protection Act, 2023 as enacted. Section references are final as published in the Official Gazette.
DPDPA 2023 & DPDP Rules 2025 — Verbatim
Browse every provision of the final Act and notified Rules with exact statutory text and plain-English explanations. Searchable and cited.
Consent
(1) Consent shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, signifying agreement to the processing of her personal data for the specified purpose and shall be limited to such personal data as is necessary for such specified purpose. (3) A request for consent shall be presented to the Data Principal in clear and plain language, giving her the option to access the said request in English or any language specified in the Eighth Schedule to the Constitution. (4) The Data Principal shall have the right to withdraw her consent given to a Data Fiduciary at any time. The ease of such withdrawal shall be comparable to the ease with which consent was given. (6) Where a Data Principal withdraws her consent, the Data Fiduciary shall cease to process the personal data of such Data Principal within a reasonable time.
Consent must be: free (no coercion), specific (per purpose), informed (clearly explained), unconditional (no bundling with T&Cs), and unambiguous (clear opt-in, no pre-ticked boxes). Withdrawal must be as easy as giving consent — a single-click unsubscribe if consent was a single click.
How DPDPA Hits Your Industry
Every business processing digital personal data of Indians is affected. Some sectors face heightened obligations — including likely SDF designation with DPO, DPIA, and annual audit requirements.
The Cost of Non-Compliance
Civil penalties are imposed under Section 33 read with the Schedule. The highest scheduled penalty is up to ₹250 crore for failure to take reasonable security safeguards.
How the Board Calculates Penalties
"The Board shall, while determining the amount of financial penalty... have regard to the following:" — DPDPA 2023, Schedule
"Section 33 penalties are imposed after inquiry and hearing. A single incident may involve more than one scheduled contravention, for example security safeguards and breach notification. The Act does not state a general ₹550 crore aggregate cap in the final Schedule."
What Compliance Must Look Like in Practice
Policies alone are not enough. The DPDPA programme must produce evidence: data maps, decision records, consent logs, breach records, processor contracts, grievance registers, and governance reporting.
Lawful Basis Decision Table
Use this before drafting notices or building consent screens.
Is the data digital personal data?
If it identifies an individual and is collected digitally, or later digitised, treat it as in scope.
Evidence: Data inventory entry with source, category, system, owner, and purpose.
Is an exemption available?
Check personal/domestic use, public data, research/statistical standards, legal proceedings, offence prevention, and notified government exemptions.
Evidence: Exemption memo with statutory clause, factual basis, and approval owner.
Can Section 7 apply?
Use only for listed legitimate uses such as voluntary provision for a specified purpose, employment purposes, medical emergency, legal compliance, or state functions.
Evidence: Legitimate-use register, purpose statement, and retention rule.
If not, is consent valid?
Consent must be free, specific, informed, unconditional, unambiguous, and withdrawable with comparable ease.
Evidence: Notice version, consent artefact, timestamp, purpose, language, and withdrawal record.
Regulator-Ready Evidence Pack
Documents are useful only if the business can prove the controls operate.
Personal Data Breach Workflow
Triage and contain
Confirm whether confidentiality, integrity, or availability of personal data is compromised. Preserve logs and isolate affected systems.
Notify affected Data Principals
Use concise, clear and plain language. Include nature, extent, timing, consequences, mitigation, safety measures, and contact details.
Initial Board intimation
Inform the Board of the breach description, nature, extent, timing, location, and likely impact.
Detailed Board update
Provide updated facts, circumstances, mitigation, cause findings, recurrence-prevention measures, and a report on Data Principal notices.
Decision Records
Every processing activity should have a recorded purpose, legal basis, data category, system owner, retention rule, processor list, and review date.
Product Gate
New products, SDKs, pixels, AI features, and vendor integrations should pass a DPDPA review before launch.
Board-Ready Evidence
Assume the regulator will ask what you did, when, why, and who approved it. Keep evidence versioned and exportable.
When the DPDPA Does Not Apply
Section 17 provides specific, narrow exemptions from the Act's obligations. These are purposive and conditional — not blanket carve-outs. Understand your boundaries precisely.
Exemptions Are Narrow, Not General
Section 17 provides specific, limited exemptions from the Act's provisions. These are not blanket carve-outs — each is purposive and conditional. The Act adopts a "necessary and proportionate" standard: processing must be genuinely required for the exempt purpose, and only the minimum necessary data may be processed.
"Nothing in this Act shall apply to processing of personal data that is necessary for exercising or performing any function of Parliament or any State Legislature..." — Section 17(1)
Treating an exemption as a permanent shield. Exemptions apply only to the specific purpose — once that purpose is served, normal DPDPA obligations resume.
Even within an exemption, data minimisation remains a best practice. Processing more data than necessary — even for an exempt purpose — creates legal and reputational risk.
"Exemptions under Section 17 are subject to judicial review. Indian courts apply the principle of proportionality — the exemption must be necessary and commensurate with the legitimate aim pursued. An overly broad claim of exemption will not withstand legal scrutiny."
Complete Document Checklist
Every document your organisation must create, maintain, and keep current under the DPDPA 2023 and DPDP Rules 2025 — with rule references and key requirements.
Privacy Policy / Notice
The primary document explaining what data you collect, why, and how individuals can exercise their rights.
Consent Notice / Form
The specific notice presented to users at the point of data collection, seeking affirmative consent.
Data Processing Agreement (DPA)
A contract with every vendor or third party that processes personal data on your behalf.
Data Retention & Erasure Policy
Internal policy documenting how long different categories of data are retained and how they are deleted.
Data Breach Incident Response Procedure
Step-by-step internal procedure for detecting, containing, reporting, and remediating data breaches.
Data Subject Access Request (DSAR) Procedure
Internal procedure for handling requests from individuals to access, correct, or erase their data.
Grievance Redressal Mechanism
Publicly accessible mechanism for Data Principals to raise complaints about data processing.
Children's Data Consent Procedure
Procedure for obtaining verifiable parental/guardian consent for processing data of users under 18.
Cross-Border Data Transfer Assessment
Assessment of all cross-border data transfers against the DPDPA negative list and sectoral restrictions.
Data Mapping / Records of Processing Activities
A comprehensive map of all personal data flows — what is collected, where it is stored, who accesses it, and why.
Data Protection Impact Assessment (DPIA)
Annual assessment of privacy risks in data processing operations, mandatory for Significant Data Fiduciaries.
Annual Compliance Audit Framework
Framework for the independent auditor to evaluate SDF compliance with the DPDPA annually.
DPO Appointment & Terms of Reference
Formal appointment document and role charter for the Data Protection Officer, mandatory for SDFs.
Algorithmic Due Diligence Report
Assessment of algorithms and AI systems for risks to Data Principal rights, mandatory for SDFs.
Security Safeguards Policy
Documents the technical and organisational measures implemented to protect personal data against breaches — mandatory under Rule 6.
Access Control & Privileged Access Policy
Governs who may access personal data within the organisation, on what basis, and the controls surrounding privileged administrative access.
Data Classification Policy
Classifies all personal data held by the organisation by sensitivity level, guiding security controls, retention, and handling procedures.
Employee / Staff Privacy Notice
Informs employees, contractors, and interns of the personal data collected about them, why it is processed, their DPDPA rights, and how to exercise them.
Cookie & Tracking Technology Notice
Discloses all cookies and tracking technologies used on digital platforms, seeks separate, granular consent for each non-essential category.
CCTV / Physical Surveillance Notice
Informs individuals of CCTV and physical monitoring at organisational premises — a DPDPA obligation where individuals' personal data is captured.
Right to Nominate Form (Section 14)
A form enabling Data Principals to nominate another individual to exercise their DPDPA rights in the event of their death or incapacity — Section 14 obligation.
Legitimate Uses Register
Documents all processing activities conducted under Section 7 "legitimate uses" — processing without consent but for specified purposes like employment, medical emergency, or state functions.
Grievance Register & Complaint Log
A mandatory internal register of all grievances received from Data Principals — recording receipt, status, resolution, and escalation to DPBI.
Data Protection Training Programme & Records
Structured training curriculum and attendance records for all staff handling personal data — demonstrating organisational accountability.
Vendor / Processor Due Diligence Checklist
Pre-engagement security and compliance assessment of all vendors who will process personal data on the organisation's behalf.
Privacy by Design Framework
Embeds data protection considerations into product development, engineering, and procurement processes from inception — mandatory for SDFs, best practice for all.
Board / Management Annual Compliance Report
Annual report to the Board of Directors summarising DPDPA compliance status, audit findings, grievances handled, and outstanding remediation — mandatory for SDFs.
Consent Manager Operating Agreement
The regulatory-compliant agreement governing the relationship between a registered Consent Manager and Data Fiduciaries using its platform — required under Rule 4 and the First Schedule.
"CompliEZ data protection lawyers can draft all mandatory documents, conduct a gap analysis against your existing policies, and deliver a complete DPDPA documentation package — reviewed and signed off by qualified advocates — before the May 2027 deadline."
13 November 2025 → Mid-May 2027
The compliance clock is running. Here are the key milestones between the Rules notification and the full compliance deadline — with days remaining calculated in real time.
DPDP Rules 2025 Notified
Enforcement Clock Starts
- DPDP Rules formally notified by MeitY
- Data Protection Board of India (DPBI) established under Section 18
- Data Protection Board framework established as a digital-by-design institution
- Procedural provisions and Board-related rules begin coming into force
- Compliance timeline begins — 18 months to full enforcement
6-Month Mark
Foundation Phase Complete
- Data mapping and gap analysis completed
- DPDPA Compliance Lead / DPO appointed
- Cross-functional compliance team established
- All vendor/processor inventory completed
- Privacy Policy and Consent Notice redesign in progress
12-Month Mark
Consent Manager Registration Framework
- Consent Manager registration framework under Rule 4 becomes operative around this stage
- All vendor DPAs signed and in force
- Breach response plan live and tested
- Grievance redressal mechanism operational
- For SDFs: DPO appointed, first DPIA completed, independent auditor engaged
- Staff training programme completed
FULL COMPLIANCE DEADLINE
All DPDP Rules in Full Force
- All DPDP Rules fully operational and enforceable
- Cross-border transfer rules under Section 16 in full effect
- All consent mechanisms 100% deployed and tested
- Log retention at 1-year minimum (Rule 6(e)) established
- For SDFs: Annual audit completed, DPIA cycle established
- Algorithmic due diligence implemented (SDFs)
- Full compliance achieved across all business units
The Consent Manager Ecosystem
A regulated consent intermediary that lets Data Principals give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
What is a Consent Manager?
A Consent Manager is a new type of regulated entity created by the DPDPA 2023. It acts as a single, interoperable platform where an individual (Data Principal) can give, manage, review, and withdraw consent for multiple services — all in one place.
Think of it like an "Account Aggregator" but for data consent. Just as Account Aggregators transfer financial data on consent without holding the data themselves, Consent Managers manage the consent flow — never the actual personal data.
Section 2(g): "Consent Manager" means a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
Rule 4 Commencement: One Year After Gazette Publication
Rule 4 and the First Schedule create the Consent Manager registration framework. Entities should treat the one-year commencement point as the practical date by which registration readiness, technical certification, governance, and net-worth evidence must be prepared.
Consent Manager Requirements (Rule 4 + First Schedule)
Who Should Pay Attention?
The Data Protection Board of India
India's dedicated data protection adjudicatory body, established under Section 18 and designed as a digital-by-design office. Understand its powers, inquiry process, and evidence expectations.
Data Protection Board of India
Section 18(2): "The Board shall be a digital office and shall carry out its functions in such digital manner as may be prescribed."
Digital-First Complaint Mechanism
Board Powers (Sections 19–33)
How a Complaint Reaches You (Section 24)
Every Question, Answered
34 critical questions across 8 categories — covering consent, rights, obligations, children's data, cross-border transfers, penalties, and more. Every answer cited to the Act and Rules.
The DPDPA 2023 is India's comprehensive digital personal data protection law, enacted on 11 August 2023. It governs the processing of digital personal data of individuals in India. The Act establishes enforceable rights for Data Principals, imposes obligations on Data Fiduciaries, creates the Data Protection Board of India for adjudication and enforcement, and prescribes civil monetary penalties under Section 33 read with the Schedule. The DPDP Rules 2025 were notified through a Gazette notification dated 13 November 2025, with public PIB materials referring to 14 November 2025.
Preamble; Sections 1–3
If you collect, store, or process personal data of individuals in India in digital form — you are legally subject to this Act. There is no SME/startup exemption.
"These answers reflect the DPDPA 2023 and DPDP Rules notified on 13 November 2025. Data protection law continues to evolve through government notifications and DPBI guidance. Consult qualified data protection counsel for advice specific to your organisation."
Ready to Become
DPDPA Compliant?
"Our data protection lawyers will review your business, draft all required documents, implement controls, and deliver a legally sound implementation plan — before the May 2027 deadline."