What Is the DPDP Act? A Practical Guide for Indian Businesses

Executive Summary

India's Digital Personal Data Protection Act, 2023 (DPDP Act) is a comprehensive law governing how organizations collect, process, and protect personal data. Enacted on August 11, 2023, it began partial implementation on November 13, 2025, with full compliance required by May 13, 2027.

The Act establishes a consent-based framework, grants specific rights to individuals ("Data Principals"), and imposes obligations on organizations ("Data Fiduciaries") that process personal data within India.

What Is the DPDP Act?

The Digital Personal Data Protection Act is India's primary law regulating the processing of digital personal data. It applies to any organization that collects, uses, shares, or stores personal data of individuals in India—regardless of where the organization is located.

The Act was passed by Parliament and received Presidential assent on August 11, 2023. The government notified the Digital Personal Data Protection Rules, 2025 on November 13, 2025, which operationalize the Act's provisions.

The Act replaces the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 as the primary framework for personal data protection in India.

Key Definitions You Need to Know

Scope and Application

The DPDP Act applies to:

• All personal data processing in India: Any organization collecting, using, or storing personal data of individuals in India, regardless of where the organization is located
• All types of personal data: Digital personal data processed by digital means
• Most sectors: Fintech, e-commerce, SaaS, BFSI, healthcare, consumer internet, and virtually all sectors that handle personal data

Implementation Timeline

The Act has a phased implementation:

Core Obligations

1. Obtain and Prove Consent

Data Fiduciaries must obtain verifiable consent from Data Principals before processing personal data. The consent must be:

• Specific to the purpose of processing
• Informed (based on a clear notice)
• Free from coercion or undue pressure
• Unambiguous and clearly affirmative

Data Fiduciaries must be able to prove that consent was obtained in compliance with the Act's requirements.

2. Provide Clear Notices

Before requesting consent, Data Fiduciaries must provide Data Principals with a clear notice that includes:

• The personal data category and processing purpose
• How Data Principals can exercise their rights
• How to file complaints with the Data Protection Board
• Any other information prescribed in the rules

3. Implement Security

Data Fiduciaries must implement "reasonable security safeguards" appropriate to the nature and sensitivity of the personal data. This includes:

• Encryption and tokenization where appropriate
• Access controls and authentication
• Regular security assessments
• Breach response procedures

4. Report Breaches

In the event of a data breach involving personal data, Data Fiduciaries must:

• Notify the Data Protection Board "without undue delay"
• Provide a detailed report within 72 hours
• Notify affected Data Principals as soon as practicable
• Document the breach and response measures

5. Honor Data Principal Rights

Data Fiduciaries must respond to Data Principal requests for:

• Access: Know what personal data is being processed and why
• Correction: Correct inaccurate personal data
• Erasure: Delete personal data (subject to exceptions)
• Grievance Redressal: File complaints about violations

6. Establish Grievance Mechanisms

Data Fiduciaries must appoint a Grievance Officer and establish a process for Data Principals to file complaints about violations of their rights.

Data Principal Rights

The DPDP Act grants individuals four key rights:

Special Categories of Data

Children's Data

Special protections apply to processing data of children (individuals under 18):

• Parental/guardian consent is required with verification of identity
• The guardian must be verified to be an adult and authorized
• Additional safeguards apply; different from adult data processing

Sensitive Personal Data

Certain categories receive additional protection, including:

• Medical/health data
• Biometric data
• Genetic data
• Sex life information
• Religious/caste/tribe affiliation
• Political affiliation
• Union membership
• Criminal/prosecution records

Significant Data Fiduciaries

The government can designate certain Data Fiduciaries as "Significant Data Fiduciaries" (SDFs) based on:

• Volume and sensitivity of personal data processed
• Risk to Data Principals' rights
• Impact on sovereignty or public order

SDFs face additional obligations, including:

• Appointment of India-based Data Protection Officer
• Maintenance of detailed data audit trail
• Impact assessments on data processing
• Enhanced security measures
• Quarterly compliance certifications

Enforcement and Penalties

The Data Protection Board of India (DPBI) enforces the Act. Penalties are substantial:

Important: Penalties are assessed per violation, not per incident. A single breach affecting multiple individuals could result in multiple penalties.

Practical Implications

For Early-Stage Companies

If your company collects personal data of individuals in India, you must:

• Begin DPDP compliance planning now
• Audit your current data collection and usage
• Document the purposes for which you process data
• Implement consent mechanisms
• Establish data security practices
• Prepare breach notification procedures
• Implement systems to honor rights requests

For Established Companies

Established companies must:

• Urgently audit existing personal data processing
• Assess whether existing consents comply with the Act
• Update privacy notices
• Implement consent management systems
• Ensure downstream systems respect consent decisions
• Train staff on DPDP obligations
• Consider appointing a Chief Privacy Officer or Data Protection Officer

For Data Processors

If your company provides infrastructure (hosting, CRM, analytics, etc.) and customers process personal data on your platform:

• Understand your role as a Data Processor
• Establish Data Processing Agreements with customers
• Implement security features
• Document compliance capabilities for customers
• Consider privacy by design in your product

Key Takeaways

What Next?

Now that you understand the DPDP Act's basics:

• Read our article on "What Is Consent Under the DPDP Act?"
• Use our DPDP Compliance Checklist to assess your current state
• Explore our Product Overview to learn how ConsentLog helps operationalize compliance