The Act sets the terms on which digital personal data may be processed in India: the obligations of organisations that process it, the rights of the individuals it concerns, and the Board that enforces both. Its obligations commence in phases under the DPDP Rules, 2025.
SCOPE OF THE ACT · SECTION 3
The Act applies to digital personal data processed in India (whether collected digitally or digitised later) and to processing outside India connected with offering goods or services to people in India.
It does not apply to data processed by an individual for personal or domestic purposes, or to data made publicly available by the individual it concerns or that a law requires to be made public. Within that scope, what an organisation must do depends on the data it processes, the role it plays, and when each obligation commences.
01 · KEY HIGHLIGHTS OF THE DPDP RULES, 2025
Six things the Rules set out.
The Rules give operational effect to the Act. Not every provision applies to every organisation; each note says to whom it is addressed, and when it commences.
Key stakeholders
HIGHLIGHT 01 OF 06S. 2 · S. 10 · S. 18
The Act allocates responsibility between six roles. Which obligations an organisation carries depends on the role it plays in each processing activity.
Data Principal: the individual to whom the personal data relatesS. 2(j)
Data Fiduciary: determines the purpose and means of processingS. 2(i)
Significant Data Fiduciary: a Data Fiduciary notified by the Central Government on factors such as the volume and sensitivity of data processedS. 10(1)
Consent Manager: registered with the Board; a single point of contact for the Data Principal to manage consentS. 2(g)
Data Protection Board of India: established to inquire into breaches and impose penaltiesS. 18
Data Processor: processes personal data on behalf of a Data FiduciaryS. 2(k)
ADDRESSED TO
Every organisation, for each processing activity: the same organisation may be a Data Fiduciary for one activity and a Data Processor for another.
COMMENCES
KEY AREAS TO FOCUS · NOT EXHAUSTIVE
Where readiness work concentrates.
01
Consent management
Itemised notice, and consent that is free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give.
SS. 5, 6 · RULE 3
02
Data security
Reasonable security safeguards against personal data breach, including for processing by Data Processors.
S. 8(5) · RULE 6
03
Breach reporting
Intimation to each affected Data Principal and to the Board, with a detailed report within 72 hours.
S. 8(6) · RULE 7
04
Accountability
The Data Fiduciary stays responsible for compliance, including for processing carried out on its behalf.
S. 8(1)–(2)
05
Cross-border data transfers
Transfers outside India, subject to restrictions the Central Government may notify or specify.
S. 16 · RULE 15
06
Children's data protection
Verifiable consent of a parent or lawful guardian; no tracking, behavioural monitoring or targeted advertising directed at children.
S. 9 · RULE 10
02 · PHASED COMMENCEMENT · DPDP RULES, 2025
What commences, and when.
The Act received assent on 11 August 2023; draft Rules followed on 3 January 2025. The final Rules were notified on 13 November 2025 and commence in three phases, and the Act's own provisions follow the same three dates. Select a phase to see what it brings into force.
TODAY · 2 NOV 2026STANDING COMPLIANCE →
PHASE III · 13 MAY 2027 · 18 MONTHS FROM NOTIFICATION
Full enforcement
The substantive regime commences. From this date the obligations of Data Fiduciaries, the rights of Data Principals and the Board's inquiry and penalty powers apply.
ACT PROVISIONS
Sections 3–5, 6(1)–(8) and (10), 7–17 and 28–34: the obligations of Data Fiduciaries, the rights and duties of Data Principals, and inquiry, appeal and penalties.
RULES
Rules 3, 5–16, 22 and 23: notice, safeguards, breach intimation, retention, children, Significant Data Fiduciaries, rights, transfers and appeals.
WHAT CHANGES FOR ORGANISATIONS
01Every Data Fiduciary within the Act's scope must comply, subject to exemptions notified under s. 17.
02Breaches found significant on inquiry can attract penalties up to the ceilings in the Schedule.
03Policies, notices, contracts and controls need to be operating, not in draft.
FULL ENFORCEMENT · KEY REQUIREMENTS FROM 13 MAY 2027SUBJECT TO EXEMPTIONS UNDER S. 17
Lawful processingPersonal data processed only for a lawful purpose, on consent or for a legitimate use.SS. 4, 7
Notice and consentItemised notice; consent that is free, specific, informed, unconditional and unambiguous, with withdrawal as easy as consent.SS. 5, 6 · RULE 3
Security and breach intimationReasonable security safeguards and breach intimation apply in full.S. 8(5)–(6) · RULES 6, 7
Retention and erasureErasure once the specified purpose is no longer served, with the periods the Rules set for certain classes of Data Fiduciary.S. 8(7) · RULE 8
Children's dataVerifiable parental consent; no tracking, behavioural monitoring or targeted advertising directed at children.S. 9 · RULES 10–12
Significant Data FiduciariesData Protection Officer in India, independent data auditor and annual impact assessment for notified Significant Data Fiduciaries.S. 10 · RULE 13
Data Principal rightsAccess, correction and erasure, grievance redressal and nomination become exercisable.SS. 11–14 · RULE 14
Cross-border transfersTransfers outside India, subject to restrictions the Central Government may notify or specify.S. 16 · RULE 15
Board inquiry and penaltiesThe Board may inquire into breaches and impose penalties up to the Schedule ceilings.SS. 27–28, 33 · SCHEDULE
AppealsOrders of the Board may be appealed to the Telecom Disputes Settlement and Appellate Tribunal.S. 29 · RULE 22
ORGANISATIONAL IMPACT
01All obligations in forceThe complete regime applies to every Data Fiduciary within scope.
02Penalties may applySignificant breaches found on inquiry can attract penalties under the Schedule.
03Compliance frameworksGovernance, processes and controls must be in place and evidenced.
04Operational readinessTeams must be able to answer rights requests and report breaches within the prescribed time.
03 · PENALTIES · SECTION 33 AND THE SCHEDULE
What non-compliance can cost.
The Schedule fixes the maximum for each kind of breach. The Board decides the amount, only after an inquiry, and only after hearing the organisation.
Reasonable security safeguards
MAXIMUM UNDER THE SCHEDULE · ITEM 1
UP TO₹250 crore
THE BREACH
Failure to take reasonable security safeguards to prevent a personal data breach.
WHAT THE OBLIGATION ASKS
Rule 6 sets minimum measures, among them encryption, masking or tokenisation, access controls, logging and monitoring, and backups for continuity.
PROVISIONS. 8(5) · RULE 6
ADDRESSED TOEvery Data Fiduciary, including for processing carried out by its Data Processors.
IMPORTANT
These are ceilings, not tariffs.
A penalty can be imposed only if the Board, on concluding an inquiry, finds the breach significant, and only after the organisation has had an opportunity to be heard (s. 33(1)). The figure is then set with regard to the factors in s. 33(2); the maximum is not imposed automatically.
WHAT THE BOARD WEIGHS · S. 33(2)
01The nature, gravity and duration of the breach
02The type and nature of the personal data affected
03Whether the breach is repetitive
04Whether the person realised a gain or avoided a loss
05Any action taken to mitigate the effects, and how timely and effective it was
06Whether the penalty is proportionate and effective in securing observance and deterring breach
07The likely impact of the penalty on the person
The Schedule also provides for breach of a Data Principal's duties under s. 15 (up to ₹10,000) and breach of a voluntary undertaking accepted by the Board under s. 32 (up to the ceiling for the underlying default). Penalties go to the Consolidated Fund of India. The Act gives individuals no compensation and creates no criminal offence.
04 · TERMS OF THE ACT
Four terms the Act turns on.
TERM · PROVISIONTHE ACTIN PLAIN TERMS
TERM 01 · S. 2(j)Data Principal
THE ACTThe individual to whom the personal data relates.
IN PLAIN TERMSThe person whose data it is. For a child, the term includes the parent or lawful guardian.
TERM 02 · S. 2(i)Data Fiduciary
THE ACTThe person who, alone or with others, determines the purpose and means of processing personal data.
IN PLAIN TERMSThe organisation that decides why and how data is used, and carries the obligations under the Act.
TERM 03 · S. 6(1)Consent
THE ACTFree, specific, informed, unconditional and unambiguous, given by a clear affirmative action.
IN PLAIN TERMSAgreement an organisation can rely on only if it was clearly asked for, for a stated purpose, and can be withdrawn as easily as it was given.
TERM 04 · S. 18 · S. 27Data Protection Board
THE ACTThe body the Act establishes to inquire into breaches and impose penalties.
IN PLAIN TERMSThe authority that hears complaints and decides penalties. Its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal.
05 · WHERE THINGS STAND · STATUS ON 3 OCTOBER 2026
What is in force today.
The substantive duties and the penalties commence on 13 May 2027. Until then, only the definitions, the Board provisions and the rule-making powers are in force.
WATCH LIST · POSITIONS MOST LIKELY TO MOVERE-CHECKED BEFORE ANY CLIENT RELIES ON IT
Data Protection Board
A body corporate with a Chairperson and four Members. Nominations were sought on 6 May 2026. None had been appointed as at 1 August 2026. A High Court has already sent a petitioner to the Board.
PENDING APPOINTMENTSLIVELAW · 1 AUGUST 2026
Significant Data Fiduciaries
No company or class notified.
NONE NOTIFIEDCONSENTOS SDF NOTE
Shorter timeline proposal
On 22–23 January 2026 MeitY proposed a 12-month window for Significant Data Fiduciaries and an earlier start for some provisions. Not gazetted as at August 2026.
PROPOSAL · NOT GAZETTEDCONSENTOS SDF NOTE
Cross-border restrictions
No restricted country has been notified, as far as the reference records.
OPEN ITEMOPEN ITEM
Existing regime
IT Act section 43A and the 2011 sensitive-data rules continue. CERT-In six-hour reporting is live.
OPEN ITEM · CONFIRMOPEN ITEM · FOR ADVOCATE CONFIRMATION
06 · THE ACT, SECTION BY SECTION
What each section asks.
Select a section to read it in plain words, with what an organisation needs to have in place. Tick what you already have.
SECTION 8 · DUTIES
8General duties
01Accountable for processors
02Processors only under a valid contract
03Accuracy where data drives a decision or is shared
04Technical and organisational measures
05Reasonable security safeguards
06Breach intimation
07Erasure when purpose ends or consent is withdrawn unless law requires retention
08Publish a contact person
09Run a grievance mechanism
WHAT THE ORGANISATION NEEDSIN PLACE · 0 / 6
07 · THE RULES, RULE BY RULE
The Rules, at a glance.
The DPDP Rules, 2025 (23 Rules and 7 Schedules), laid out by the date each commences. Filter by date, then select a Rule to read what it requires.
RULE 7
Breach intimation
FROM 13 MAY 2027 · IN 192 DAYS
To each affected person without delay: what happened, likely consequences, mitigation, steps they can take, a contact
To the Board without delay, then detailed information within 72 hours of becoming aware
08 · DPDP AGAINST THE GDPR
Coming from the GDPR?
Ten points where the DPDP Act departs from the EU General Data Protection Regulation. Select a topic to set the two side by side.
WORK A GDPR-COMPLIANT COMPANY STILL HAS TO REDO
TOPIC 01 / 10
Grounds for processing
DPDP ACT, 2023INDIA
Consent, or a closed list of legitimate uses. No "legitimate interests" and no "contract" ground.
Yes. A company that sells only to other companies still holds personal data on its employees and their families, job applicants, directors, shareholders, vendor and customer contacts, visitors, and the people on its CCTV footage. All of it falls within the Act.
