The DPDP Act 2023 and DPDP Rules 2025, in practice
India's Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and the DPDP Rules, 2025 set out how organisations may collect and use digital personal data, what they owe the people it belongs to, and what happens when they fail.
Updated 28 September 2026 · General information, not legal advice
Who the Act applies to
The Act applies to digital personal data processed in India, whether collected online or collected offline and later digitised. It also applies to processing outside India when it is connected with offering goods or services to people in India. There is no size threshold, although the government can exempt some classes of organisations, such as startups, from some provisions.
| Term | Meaning |
|---|---|
| Data Principal | The individual the data is about (for a child, including the parent or lawful guardian). |
| Data Fiduciary | The organisation that decides why and how the data is processed. Most obligations sit here. |
| Data Processor | An organisation that processes data on behalf of a Data Fiduciary, under a valid contract. |
| Significant Data Fiduciary | A Data Fiduciary notified by the government as significant, with extra duties. |
| Consent Manager | A registered, India-based platform through which people give, manage and withdraw consent. |
| Data Protection Board | The digital-first regulator that inquires into breaches and imposes penalties; appeals go to TDSAT. |
What a Data Fiduciary must do
- Have a lawful basis. Process personal data only with consent or for a listed legitimate use (section 4 and 7).
- Give notice. Tell people what data you collect, for what purpose, how to withdraw consent, exercise rights and complain (section 5).
- Get valid consent. Free, specific, informed, unconditional and unambiguous, as easy to withdraw as to give (section 6).
- Protect it. Take reasonable security safeguards, including encryption, access control, logging and backups (section 8(5)).
- Report breaches. Tell the Board and each affected person about a personal data breach (section 8(6)).
- Erase it. Delete data when the purpose is served or consent is withdrawn, and make processors delete it too (section 8(7)).
- Answer questions. Publish a contact for queries and run grievance redressal (sections 8(9) and 8(10)).
- Use processors carefully. Engage them only under a valid contract; you stay responsible (section 8(2)).
Read more: consent and notice, breach notification, retention and erasure.
Rights of Data Principals
People can ask for a summary of their data and who it was shared with, correction, completion, updating and erasure, grievance redressal, and can nominate someone to act for them. Under the DPDP Rules, Data Fiduciaries must respond withinninety days. See Data Principal rights and the 90-day rule.
Children's data
Processing personal data of a child (under 18) needs verifiable consent of a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited, subject to exemptions the Rules allow. See children's data under DPDP.
Significant Data Fiduciaries
Organisations notified as significant must appoint a Data Protection Officer based in India who reports to the board, appoint an independent data auditor, and carry out Data Protection Impact Assessments and audits periodically. The Rules add due diligence on algorithmic software and possible restrictions on transferring specified data. SeeSignificant Data Fiduciary obligations.
Timeline
| When | What applies |
|---|---|
| 11 August 2023 | The Act receives assent and is published. |
| 14 November 2025 | DPDP Rules 2025 notified; provisions for the Data Protection Board take effect. |
| November 2026 | Consent Manager framework (twelve months after notification). |
| May 2027 | Most Data Fiduciary obligations, including notice, consent, security, breach notification, erasure and rights (eighteen months after notification). |
Confirm exact commencement dates against the Gazette notifications. See theDPDP Rules 2025 timeline.
Penalties
| Failure | Maximum penalty |
|---|---|
| Reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Notifying the Board and affected people of a breach | ₹200 crore |
| Additional obligations towards children | ₹200 crore |
| Other violations of the Act or Rules by a Data Fiduciary | ₹50 crore |
The Board decides the amount considering factors such as the nature, gravity and duration of the breach and steps taken to mitigate it. See DPDP Act penalties explained.
How CERT-In fits in
The CERT-In Directions of 28 April 2022, issued under section 70B of the Information Technology Act, 2000, apply alongside the DPDP Act. They require reportable cyber incidents to be reported within six hours of noticing them, logs of ICT systems to be kept securely for a rolling 180 days within Indian jurisdiction, clocks synchronised with NIC or NPL time servers, and a designated point of contact. See CERT-In six-hour reporting andlog retention under CERT-In and DPDP.
Where to start
- Find where personal data sits: systems, datasets, files, vendors, countries.
- Record why you hold it: purposes, lawful basis, retention.
- Check the safeguards: access, MFA, encryption, exposure, logging, backups.
- Fix notices and consent, and set up rights and breach processes with clocks.
- Keep evidence, and review it continuously rather than once a year.
This is what TrustNiq automates.
Frequently asked questions
When does the DPDP Act come into force?
The DPDP Rules 2025 were notified on 14 November 2025 with an eighteen-month phased rollout. Provisions setting up the Data Protection Board applied first, the Consent Manager framework follows after twelve months (November 2026), and most Data Fiduciary obligations apply after eighteen months (May 2027). Confirm exact dates against the Gazette notifications.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach, and breaching obligations towards children, can each attract up to ₹200 crore, and other violations up to ₹50 crore.
Is the DPDP Act the same as GDPR?
No. The DPDP Act covers digital personal data only, has no separate category of sensitive personal data, relies mainly on consent and a closed list of legitimate uses rather than legitimate interests, and allows cross-border transfers except to countries the government restricts.
Do CERT-In Directions still apply?
Yes. The CERT-In Directions of 28 April 2022 under section 70B of the IT Act apply separately: reportable cyber incidents within six hours, 180 days of logs kept in India, and clocks synchronised to NIC or NPL time servers.
Sources
- Digital Personal Data Protection Act, 2023 (MeitY)
- Digital Personal Data Protection Rules, 2025 (MeitY)
- PIB: DPDP Rules, 2025 notified
- CERT-In Directions under section 70B, 28 April 2022
General information about Indian law as published on the date above, to help organisations plan compliance work. It is not legal advice.
See your compliance posture on your own systems
DPDP, CERT-In, ISO 27001, SOC 2 and more. Connect one cloud account and one identity directory in a 14-day trial. No card needed.