DPDPA FAQ

Short, plain-English answers. Tap a question to open it. This DPDPA 2023 course page explains dpdpa faq in plain language.

Common questions (dpdpa faq)

What is the DPDP Act, 2023?

India’s law governing the processing of digital personal data. It balances the rights of individuals (Data Principals) with the need to process data lawfully.

Who must comply?

Any organisation processing digital personal data in India, and those outside India offering goods or services to people in India. Purely personal or domestic use is excluded.

When do the obligations start?

The Rules, 2025 phase things in: Board provisions at once, Consent Managers after about 12 months, and the core duties after about 18 months. Confirm dates on the MeitY website.

Is consent always required?

No. Section 7 lists legitimate uses such as legal obligations, medical emergencies, State benefits and employment purposes.

What rights do individuals have?

Access, correction and erasure, grievance redressal and nomination. There is no GDPR-style portability right.

What must I do if there is a breach?

Inform the Board and each affected person without delay, and send the Board a detailed report within 72 hours (unless extended).

What are the penalties?

Up to ₹250 crore for failing to secure data, ₹200 crore for not reporting breaches or violating children’s rules, ₹150 crore for SDF duties, and ₹50 crore for other breaches.

Who is a child?

Anyone under 18. Verifiable parental consent is required and tracking or targeted advertising to children is banned.

Can I send data abroad?

Yes, unless the destination is restricted by Government notification or a stricter sector rule applies.

Do I need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint a DPO in India, but every fiduciary must publish a contact for queries.

What is a Significant Data Fiduciary?

An entity notified by the Government based on data volume and sensitivity, risk to individuals, and effects on State interests. It has extra duties such as audits and DPIAs.

How is DPDPA different from GDPR?

No sensitive data category, no legitimate-interest ground, no portability right, child means under 18, and a negative-list approach to transfers.

Does it apply to small businesses and startups?

Yes, although the Government may notify relaxations for certain startups and classes.

How should I prepare?

Map your data, update notices and consent flows, set up a rights-request process, harden security, prepare a breach plan, and fix vendor contracts. Use the readiness questionnaire in this course.

Does this course give a legal certificate?

No. The course gives you a score card to print after the final assessment. It is for learning and is not a regulatory certification.

← Course home Final assessment →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for dpdpa faq: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.

Course content

"+acc(2,false)+"

";if(lead){lead.parentNode.insertBefore(hero,lead.nextSibling);hero.parentNode.insertBefore(g,hero.nextSibling)}else{dp.insertBefore(g,dp.firstChild);dp.insertBefore(hero,dp.firstChild)}try{var last=localStorage.getItem("dpdpa_last");if(last){var b=document.getElementById("tgo");b.href=last;b.textContent="Continue learning"}}catch(e){}}else{var wrap=document.createElement("div");wrap.className="tl";var side=document.createElement("aside");side.className="tcur";side.innerHTML="

Course content

"+acc(1,true)+"

";var mob=document.createElement("button");mob.type="button";mob.className="tmob";mob.textContent="Course content (tap to open)";mob.onclick=function(){side.classList.toggle("open")};var main=document.createElement("div");main.className="tmain";dp.parentNode.insertBefore(wrap,dp);var kk=document.createElement("div");kk.className="tkick";var tp="DPDPA 2023 Course";C.forEach(function(t){t.l.forEach(function(x){if(x[1]===path){tp=t.t}})});kk.textContent=tp;main.appendChild(kk);var ttl=document.querySelector("h1.page-title");if(ttl){main.appendChild(ttl)}main.appendChild(mob);var idx=-1;all.forEach(function(x,i){if(x[1]===path){idx=i}});var bar=document.createElement("div");bar.className="tbar";bar.innerHTML="← Course home";main.appendChild(bar);main.appendChild(dp);var dn=document.createElement("div");dn.className="tdone";var nx=null;if(idx>=0){if(idxMark as complete"+(nx?"Next: "+nx[0]+" →":"");main.appendChild(dn);wrap.appendChild(side);wrap.appendChild(main);function paint(){var p=pct();side.querySelector(".pbar i").style.width=p+"%";side.querySelector(".pl").textContent=p+"% complete";bar.querySelector(".tp").textContent=(idx>=0?"Step "+(idx+1)+" of "+all.length+" · ":"")+p+"% complete";var cb=document.getElementById("tcb");var is=!!done[path];cb.textContent=is?"Completed ✓ (click to undo)":"Mark as complete";cb.className=is?"is":"";side.querySelectorAll(".ti").forEach(function(a){var u=a.getAttribute("href");if(done[u]){a.classList.add("dn")}else{a.classList.remove("dn")}});var ds=side.querySelectorAll("details");for(var i=0;i