The DPDPA in four numbers, before we start.
If you’ve seen the term DPDPA floating around and quietly hoped someone would explain it without sending you to a 50-page PDF — that’s exactly what we’re doing here. The Digital Personal Data Protection Act, 2023 is India’s first real data privacy law, and the rules that actually make it work (the DPDP Rules, 2025) were notified on 13 November 2025. So this is no longer “coming soon.” It’s here, and the clock on compliance is already ticking for a lot of companies.
I’m going to walk you through it exactly the way the DPDPA itself is organised: nine chapters, plus a penalty schedule. Each one below is collapsed — click a chapter to open it. Inside, you’ll get the plain-English version first, and if you’re the person who actually has to build the compliance (not just read about it), look for the 🛠️ For your dev/security team box in each section. That’s where the API behaviour, timelines, and system requirements live.
One honest note before we start: I’m not a lawyer, and this isn’t legal advice. Treat this as a map, not a verdict — for anything you’re about to act on, loop in someone qualified.
First, the DPDPA cast of characters
The Act keeps reusing a handful of terms, so let’s get them straight once:
- Data Principal — the person the data is about. You, basically.
- Data Fiduciary — whoever decides why and how that data gets processed. Usually the company you handed your data to.
- Data Processor — whoever processes data on the Fiduciary’s behalf (think: a vendor running the servers).
- Consent Manager — a registered middleman platform where you can give, review, and pull back consent from one place, instead of chasing ten different apps.
- Significant Data Fiduciary (SDF) — a company the government has flagged as handling especially large or sensitive volumes of data, which comes with extra homework (more on that in Chapter 2).
- Personal data breach — any unauthorised processing, or accidental loss/leak/alteration of personal data that compromises its confidentiality, integrity, or availability.
Jump to a chapter
Nine chapters, each one collapsed. Open just the ones you need — or open the lot.
Chapter 1 — Preliminary (what the Act even applies to)
What the DPDPA actually covers
This is the “ground rules” chapter. It sets the name of the DPDPA, defines terms like the ones above, and — importantly — says the DPDPA applies to digital personal data, whether it was collected online or collected offline and then digitised. It also reaches outside India: if a foreign company is processing Indian users’ data to offer them goods or services, this law can still apply to them.
🛠️ For your dev/security team: Audit your data inventory first. If any personal data touching Indian users flows through your systems — even via a third-party SaaS tool or an overseas subsidiary — it’s in scope. “Digital personal data” includes anything that started on paper and was later digitised, so don’t assume scanned forms or legacy CSV exports are exempt.
Chapter 2 — What companies (Data Fiduciaries) must do
Your core DPDPA obligations as a company
This is the heart of the DPDPA, and the chapter your company’s engineering and legal teams will spend the most time on. The short version: you can only process someone’s personal data if you have their consent. Alternatively, it may fall under a specific list of “legitimate uses” (like a job applicant’s data, or data needed for medical emergencies, or data the person voluntarily gave you and didn’t object to using for that same purpose).
If you want a concrete picture of what “reasonable security safeguards” look like when they fail, our breakdown of the FortiBleed credential attack is a useful companion read, because it walks through exactly the kind of lapse the DPDPA is written to punish.
When you do rely on consent, it has to be real consent — freely given, specific to a purpose, clearly worded, and just as easy to withdraw as it was to give. You also have to tell people, before or at the time of collecting their data, exactly what you’re collecting and why, in plain language they can actually read (English or one of the languages listed in the Eighth Schedule of the Constitution).
The duties that kick in after consent
Beyond consent, companies have a running list of duties. First, keep data accurate and complete if it’s going to be used to make a decision about someone. You also have to put in place reasonable security safeguards, report breaches, and delete data once it’s no longer needed (or once someone withdraws consent), Finally, publish a way to reach your Data Protection Officer, and set up a working grievance system. Processing a child’s data? You need verifiable consent from a parent or guardian, and you’re banned from tracking, profiling, or targeting ads at children.
If the government has labelled your company a Significant Data Fiduciary — based on how much data you handle, how sensitive it is, or the risk it poses — you get extra obligations: an India-based Data Protection Officer, an independent data auditor, and regular Data Protection Impact Assessments.
🛠️ For your dev/security team: Under the 2025 Rules, breach reporting isn’t a “soon-ish” thing — you must notify affected users and the Data Protection Board without delay, and file a detailed report with the Board within 72 hours. Security safeguards the Rules specifically expect: encryption or tokenisation, access controls, logging and monitoring, regular backups, and keeping logs for at least one year. Build erasure as an automated workflow, not a manual ticket — data must be deleted once its purpose is served or consent is withdrawn, with 48 hours’ advance notice before deletion kicks in. If you’re an SDF, budget for an annual DPIA and an independent audit, submitted to the Board at least once every 12 months, and make sure any algorithmic/recommendation system you run doesn’t quietly violate user rights.
Chapter 3 — Your rights (and a few duties) as a user
What you can ask a company to do
This chapter flips the lens to you, the Data Principal. You can ask a company for a summary of what personal data of yours it’s processing, and which other companies or processors it has shared that data with. You can ask them to correct inaccurate data, complete incomplete data, or erase it entirely, unless they have a legal reason to keep it. You’re entitled to a visible, working grievance redressal process — and only after trying that can you escalate to the Data Protection Board. You can also nominate someone to exercise these rights on your behalf if you die or become incapacitated.
It’s not a one-way street, though. The Act also expects you not to impersonate someone else, not to hide material facts when submitting an identity document, and not to file frivolous or false complaints.
🛠️ For your dev/security team: You need a self-service “data rights” portal, not just an email inbox — a place where a user can see what you hold, request correction, request erasure, and see which third parties received their data. Build this to respond within whatever period you publish in your grievance policy, and log every request for the audit trail.
Chapter 4 — Cross-border data and exemptions
Sending data abroad under the DPDPA
By default, the DPDPA doesn’t ban sending personal data outside India. Instead, the government can name specific countries or territories where transfers are restricted — a blocklist approach rather than a whitelist. A separate, narrower set of exemptions also exists: things like processing needed to enforce legal claims, court proceedings, preventing or investigating crime, approved mergers, and research/statistics work (as long as it’s not used to make decisions about a specific person). Startups and certain notified companies can also get relief from some of the heavier obligations.
🛠️ For your dev/security team: Don’t hardcode “we can send data anywhere” into your architecture. Keep your data residency/routing logic configurable, because the restricted-country list is something the government can update by notification — and you’ll want to be able to react fast, not refactor.
Chapters 5 & 6 — The Data Protection Board of India
Who enforces the DPDPA
These two chapters set up the regulator: the Data Protection Board of India. It’s a body the government establishes, with its own Chairperson and Members, its own staff, and the power to investigate complaints, conduct inquiries, and order companies to take specific action — including, in serious cases, directing that public access to an app or service be blocked. Board members and officers are treated as public servants while doing this job.
🛠️ For your dev/security team: The Board can call for information and records at any time — have your compliance documentation (consent logs, DPIAs, breach reports, audit trails) in a state where you could actually produce them on short notice, not scattered across five people’s inboxes.
Chapter 7 — Appeals and dispute resolution
How to challenge a Board decision
If you disagree with a Board order, you can appeal to the Appellate Tribunal. The Board’s own orders are enforceable like a court decree. There’s also a built-in off-ramp: the Board can refer a dispute to mediation or another alternate dispute resolution process instead of going the full enforcement route, and a company under investigation can offer a voluntary undertaking — essentially promising to fix the problem — which the Board may accept instead of pursuing penalties.
🛠️ For your dev/security team: A voluntary undertaking is still legally binding — if you break it, the penalty tied to the original complaint can be imposed anyway. Don’t offer one unless you can actually deliver on it.
Chapter 8 — Penalties (the numbers that get everyone’s attention)
What a DPDPA breach can cost you
This is the chapter people ask about first, so here are the actual ceilings from the Schedule. Each figure is a maximum the Board may impose, not an automatic fine — the Board first has to complete an inquiry, decide the breach was significant, and give the company a chance to be heard.
For a sense of scale, the Denmark CPR data breach showed how quickly one exposed identifier set becomes a national incident. That is precisely the scenario these numbers exist to deter.
- Failing to take reasonable security safeguards, leading to a breach — up to ₹250 crore
- Failing to notify the Board or affected users about a breach — up to ₹200 crore
- Not following the rules around children’s data — up to ₹200 crore
- Significant Data Fiduciaries skipping their extra obligations (DPO, audits, DPIAs) — up to ₹150 crore
- Any other breach of the DPDPA or its rules — up to ₹50 crore
- A Data Principal breaching their own duties (like filing false complaints) — up to ₹10,000, a very different order of magnitude from the company-side penalties
When deciding the actual amount, the Board has to weigh things like how serious and long-running the breach was, how sensitive the data involved was, whether it’s a repeat offence, whether the company gained (or avoided losing) money because of it. It also asks whether the company moved quickly to contain the damage.
🛠️ For your dev/security team: “We took timely and effective steps to mitigate the breach” is literally one of the factors that can reduce a penalty. That’s a strong argument for investing in incident response tooling and a rehearsed breach playbook before you need one, not after.
Chapter 9 — Miscellaneous (the fine print that still matters)
The fine print that still matters
The last chapter is a grab-bag, but a few parts matter in practice. It protects anyone acting in good faith under the DPDPA from liability. The central government can also issue directions and call for information. Importantly, this law works alongside other laws rather than replacing them. Finally, it gives the government power to make further rules — which is exactly how we got the DPDP Rules, 2025.
🛠️ For your dev/security team: Because the government can keep adding detailed rules under this power, treat your compliance setup as a living system, not a one-time project. The Rules are where the real operational detail (timelines, formats, thresholds) will keep showing up.
Bonus: the 2025 Rules you actually need to act on now
What the 2025 DPDPA Rules changed
The Act gave the framework; the DPDP Rules, 2025 (notified 13 November 2025) give the operational detail. A few are already in force, and the rest phase in over the next year to eighteen months. The ones worth knowing:
- Consent Managers must be Indian companies with a minimum net worth of ₹2 crore, and must keep consent records for at least seven years.
- Breach notification to the Board and users must happen without delay, with a detailed report due within 72 hours.
- Verifiable parental consent for children’s data needs a real identity check (think Aadhaar-linked DigiLocker tokens) — a simple “I’m over 18” checkbox doesn’t cut it anymore.
- Narrow exemptions exist for hospitals, schools, and childcare services to process children’s data without parental consent, but only for things like safety, health, or welfare delivery — not analytics or ads.
- Security safeguards spelled out include encryption/tokenisation, access controls, monitoring, backups, and at least a year of log retention.
If you’re building or maintaining a product that touches Indian users’ data, this is the document your engineering team should actually be reading line by line — the DPDPA tells you what matters, the Rules tell you how to build it.
The DPDPA compliance timeline: what starts when
Here is the part that decides how much sleep you lose this quarter. India passed the DPDPA in August 2023, yet almost nothing switched on at the time, because the government held back commencement. That changed when it notified the Rules on 13 November 2025. Those Rules stagger the duties on purpose, so nobody has to rebuild everything at once.
In short, the definitions and the Data Protection Board provisions commenced on the gazette date, so the regulator already exists. Consent Manager provisions follow roughly a year later. Meanwhile the substantive duties — notice and consent, security safeguards, breach intimation, children’s data, retention limits and Data Principal rights — carry the eighteen-month runway that the government highlighted, which lands around May 2027.
That sounds comfortably far away. However, eighteen months is a short runway if you have to inventory every system, renegotiate processor contracts and rebuild your consent flows. Therefore the teams that start now will simply ship on time, while the ones who wait will be doing it in a panic. Do check the Gazette, or the Ministry of Electronics and Information Technology, for the exact commencement dates that apply to you. Notification sets the phasing, not the law itself.
So, what should you actually do this week?
Your starter checklist
Tick things off as you go — your progress is saved in this browser, so you can come back to it.
That’s the DPDPA, chapter by chapter, in the time it takes to read a few cups of chai. If you want us to go deeper on any one chapter — the penalty math, the SDF criteria, or how consent managers actually work — tell us in the comments and we’ll write it up.
Quick check: does the DPDPA apply to you?
Four questions, answered in your browser. Nothing is sent anywhere — and this is orientation, not legal advice.
Penalty explorer
The Schedule sets a ceiling for each kind of failure. Tap one to see it.
