India’s DPDP Act, what it means for your business
Understand your duties as a data fiduciary, handle consent properly, and be ready for the rules.
Official sources
Use these official places to read the text and find the latest version.
Official website
The Ministry of Electronics and IT publishes the Act, the Rules and updates.
Visit meity.gov.in ↗Get the document
The Act and the DPDP Rules are published free by the Indian government. See the MeitY site and the Press Information Bureau release on the Rules.
Open the official page ↗What DPDP is
The Digital Personal Data Protection Act is India’s first full data protection law. It says how organisations, called data fiduciaries, may use the personal data of individuals, called data principals.
It centres on clear consent, limited use, security safeguards and prompt breach reporting.
How DPDP got to where it is today
The milestones that changed what organisations have to do.
Privacy ruling
The Supreme Court of India declares privacy a fundamental right in the Puttaswamy case.
First draft bill
A committee led by Justice Srikrishna publishes a draft data protection bill.
Revised draft
The government releases a shorter draft for consultation.
DPDP Act passed
Parliament passes the Act in August 2023.
Rules notified
The government notifies the Digital Personal Data Protection Rules, 2025 on 14 November 2025, with an 18-month phased compliance timeline.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You collect personal data from people in India.
You run an app, website or service with Indian users.
You use vendors to process Indian customer data.
You want to be ready before enforcement starts.
What it asks of you
The requirements fall into six areas.
Notice and consent
Tell people what you collect and why, and get clear consent.
Purpose and minimisation
Use data only for the stated purpose and keep only what you need.
Rights of individuals
Access, correction, erasure and grievance handling.
Security safeguards
Take reasonable security steps to prevent breaches.
Breach notification
Tell the Data Protection Board and affected people.
Special duties
Extra rules for children’s data and significant data fiduciaries.
7 parts, 14 topics and 40 obligations
India's DPDP Act protects digital personal data and puts duties on data fiduciaries, who decide why and how data is processed. The 2025 Rules add operating detail and phase in over a transition period.
14 topics · 40 obligations
G1Lawful processing, notice and consentWhy you may process personal data and what you must tell people first.3 topics · 8 obligations
C1Grounds and notice (ss. 4-5)Process only on consent or a listed legitimate use, and tell people what and why.3 obligations
- s.4
Process personal data only for a lawful purpose, either with the person's consent or for a legitimate use listed in the Act.
What you do
- Map each processing purpose to consent or a legitimate use
- Stop processing where neither applies
- s.5
Give each person a notice before or when asking for consent, saying what data is collected, why, how to exercise rights and how to complain to the Board.
What you do
- Show a clear itemised notice at the point of collection
- Offer it in English or an Eighth Schedule language on request
- Rule 3 (Rules 2025)
Make the notice stand alone, in plain language, with an itemised description of data and purpose and a link to withdraw consent and exercise rights.
What you do
- Keep notice separate from other terms
- Include a contact route for rights requests
Evidence to keep
- Records of processing purposes and legal basis
- Privacy notice text with version history
C2Consent (s. 6)Consent must be free, specific, informed, unconditional and unambiguous, and easy to withdraw.4 obligations
- s.6(1)
Obtain consent that is free, specific, informed, unconditional and unambiguous, by clear affirmative action, limited to what is necessary for the stated purpose.
What you do
- Use unticked boxes and separate consent per purpose
- Do not bundle unrelated purposes
- s.6(4)-(6)
Let people withdraw consent as easily as they gave it, and stop processing within a reasonable time after withdrawal.
What you do
- Add a one-click withdrawal link
- Propagate withdrawals to processors
- s.6(7)-(9)
Allow people to manage consent through a registered consent manager where they choose to.
What you do
- Check readiness to integrate with consent managers
- Honour consent manager requests
- s.6(10)
Be ready to prove that a valid notice was given and consent was obtained.
What you do
- Keep consent logs for the retention period
- Audit consent flows twice a year
Evidence to keep
- Consent records with timestamp and notice version
- Withdrawal logs
C3Legitimate uses (s. 7)Limited cases where processing is allowed without consent.1 obligation
- s.7
Rely on a legitimate use without consent only where it clearly fits one listed in the Act, such as voluntary provision of data for a stated purpose, legal obligation, medical emergency or employment purposes.
What you do
- Document which listed use applies to each case
- Review the register yearly
Evidence to keep
- Legitimate use justification register
G2Data fiduciary dutiesGeneral obligations on the organisation that decides why and how data is processed.3 topics · 12 obligations
D1General obligations (s. 8)Be accountable for processing, keep data accurate and secure, and erase it when no longer needed.9 obligations
- s.8(1)
Remain responsible for compliance for all personal data under your control, including data handled by processors.
What you do
- Assign an accountable owner
- Keep a processing inventory
- s.8(2)
Engage a data processor only under a valid contract.
What you do
- Sign data processing agreements before sharing data
- Include security and breach duties
- s.8(3)
Make reasonable efforts to keep data complete, accurate and consistent where it is used to decide about the person or disclosed to another fiduciary.
What you do
- Validate data at capture
- Let people correct records
- s.8(4)
Put in place appropriate technical and organisational measures to comply.
What you do
- Adopt documented privacy policies and controls
- Train staff
- s.8(5)
Protect personal data with reasonable security safeguards to prevent breach.
What you do
- Apply encryption, access control and logging
- Test controls regularly
- Rule 6 (Rules 2025)
Apply specified safeguards such as encryption or masking, access control, logging and monitoring, backups, and keep logs for a set minimum period.
What you do
- Enable audit logs on systems holding personal data
- Keep logs for at least one year
- s.8(7)
Erase personal data when consent is withdrawn or the purpose is served, unless the law requires retention, and have processors do the same.
What you do
- Set retention periods per purpose
- Automate deletion jobs
- s.8(9)
Publish business contact details of the person who answers questions about processing (the DPO for significant data fiduciaries).
What you do
- Publish an email and phone on the website
- Include it in the notice
- s.8(10)
Provide an effective grievance redressal system.
What you do
- Set up a grievance inbox with a ticket system
- Publish the response timeline
Evidence to keep
- Data processing agreements
- Security controls evidence
- Retention schedule and erasure logs
- DPO or contact publication
D2Breach notification (s. 8(6), Rule 7)Report personal data breaches to the Board and to each affected person.2 obligations
- s.8(6)
Intimate the Data Protection Board and each affected person of a personal data breach in the prescribed form and manner.
What you do
- Add DPDP steps to the incident response plan
- Prepare notice templates
- Rule 7 (Rules 2025)
Tell affected people without delay in plain language about the breach, its likely impact and steps to take, and give the Board a prompt initial notice followed by a fuller report within 72 hours.
What you do
- Pre-define the 72 hour reporting workflow
- Keep a named reporting contact
Evidence to keep
- Breach register
- Notification copies and timeline
- Incident response plan
D3Retention and erasure timelines (Rules 2025)Specific time limits for certain large online services.1 obligation
- Rule 8 (Rules 2025)
Retain traffic data and logs for the minimum required period and, for specified classes of large e-commerce, gaming and social media services, erase inactive accounts' data after the prescribed time with advance warning.
What you do
- Check whether your service falls in a specified class
- Warn users before erasure
Evidence to keep
- Erasure policy
- Advance erasure notices
G3Rights and duties of data principalsWhat individuals can ask of you, and what is asked of them.2 topics · 5 obligations
R1Rights (ss. 11-14)Access, correct, erase, complain and nominate.4 obligations
- s.11
Give a person, on request, a summary of the data you hold, the processing activities, and the identities of others you have shared it with.
What you do
- Build a self-service or ticketed access process
- Verify identity before disclosure
- s.12
Correct, complete, update or erase personal data when the person asks, unless retention is legally required.
What you do
- Provide a correction form
- Log each action and the reason for any refusal
- s.13
Respond to grievances within the prescribed period before the person goes to the Board.
What you do
- Track response time per ticket
- Escalate unresolved cases
- s.14
Let people nominate someone to exercise their rights if they die or become incapacitated.
What you do
- Offer a nominee field
- Define the verification process
Evidence to keep
- Rights request log
- Response timelines
- Nominee records
R2Duties of data principals (s. 15)People must follow the law, not impersonate, not file false complaints and give verifiable information.1 obligation
- s.15
Make clear in terms and notices that individuals must not give false information, impersonate others or lodge false complaints.
What you do
- Add short wording in terms of use
- Reject abusive requests with a documented reason
Evidence to keep
- User terms referencing misuse
G4Children and persons with disabilityExtra protection for children under 18 and for persons with a lawful guardian.1 topic · 4 obligations
K1Children's data (s. 9)Get a parent's verified consent and avoid harmful processing of children's data.4 obligations
- s.9(1) and Rule 10
Get verifiable consent of a parent or lawful guardian before processing a child's data (under 18) or data of a person with disability who has a guardian.
What you do
- Add age check and parent verification at sign-up
- Keep verification records
- s.9(2)
Do not process children's data in a way likely to cause detrimental effect on their well-being.
What you do
- Review features that may harm minors
- Run a risk review before launch
- s.9(3)
Do not track or monitor children's behaviour or direct targeted advertising at them.
What you do
- Turn off ad profiling for minors
- Avoid behavioural analytics on child accounts
- s.9(4)-(5)
Apply the exemptions only where the Rules allow, such as for certain healthcare, education and safety uses.
What you do
- Document any claimed exemption
- Review it against Rules updates
Evidence to keep
- Age gate design
- Parent verification records
G5Significant data fiduciariesExtra duties for large or high-risk processors designated by the Government.1 topic · 4 obligations
S1Additional obligations (s. 10, Rule 13)Appoint a DPO and independent auditor and assess impact.4 obligations
- s.10(2)(a)
Appoint a Data Protection Officer based in India who reports to the board and is the point of contact for grievances.
What you do
- Make the appointment formal and published
- Give the DPO direct board access
- s.10(2)(b)
Appoint an independent data auditor to evaluate compliance.
What you do
- Engage an auditor with no conflicts
- Share findings with the board
- s.10(2)(c) and Rule 13
Carry out a data protection impact assessment and an audit at least once every twelve months and send the Board a report.
What you do
- Schedule yearly DPIA and audit
- File summaries as the Rules require
- Rule 13 (Rules 2025)
Check that algorithmic software you use does not risk the rights of data principals and follow any data localisation restrictions on specified data.
What you do
- Review algorithmic tools for rights risk
- Check any localisation notice
Evidence to keep
- DPO appointment
- Audit and DPIA reports
G6Cross-border transferTransfers abroad are allowed unless a Government notification restricts the country.1 topic · 1 obligation
X1Transfers outside India (s. 16)Check the restricted-country list and stricter laws that continue to apply.1 obligation
- s.16
Transfer personal data outside India only to countries not restricted by Government notification, while sector rules that are stricter still apply.
What you do
- Maintain a list of overseas processors and locations
- Monitor notifications for restricted countries
Evidence to keep
- Transfer register
- Vendor location list
G7Board, enforcement and penaltiesThe Data Protection Board of India and what non-compliance costs.3 topics · 6 obligations
B1Data Protection Board (ss. 18-28)The independent body that investigates and decides on complaints and breaches.2 obligations
- ss.18-26 and Rules 17-21
Understand the Board is a digital-first body that hears complaints, orders inquiries and may issue directions.
What you do
- Name a Board liaison
- Prepare to respond digitally
- s.28(1)-(2)
Cooperate with Board inquiries and consider a voluntary undertaking that can close proceedings.
What you do
- Keep evidence ready to produce
- Seek legal advice before offering an undertaking
Evidence to keep
- Board correspondence log
- Voluntary undertakings
B2Penalties (s. 33 and Schedule)Financial penalties scale with the type of breach.3 obligations
- s.33 and Schedule (security)
Failure to take reasonable security safeguards can bring a penalty of up to INR 250 crore.
What you do
- Prioritise security spend against this risk
- Document safeguards
- s.33 and Schedule (breach, children)
Failure to notify a breach or breaching children's duties can bring up to INR 200 crore each.
What you do
- Test the breach reporting workflow
- Audit child data handling
- s.33 and Schedule (significant fiduciary, others)
Breach of significant data fiduciary duties can bring up to INR 150 crore, other breaches up to INR 50 crore, and breach of a person's duties up to INR 10,000.
What you do
- Record the highest-risk obligations in the risk register
- Review yearly
Evidence to keep
- Penalty risk register
B3Phased commencement (Rules 2025)The Rules switch on in stages.1 obligation
- Rules 2025 commencement
Plan against the staged dates: Board provisions took effect on notification, consent manager provisions later, and most data fiduciary duties after a longer transition period.
What you do
- Build a dated DPDP readiness plan
- Re-check dates against the official gazette
Evidence to keep
- Implementation plan with dates
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from Ministry of Electronics and IT: Digital Personal Data Protection Act 2023 and Rules, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Find your personal data
List what you hold and where it came from.
- 2
Rework notices and consent
Plain-language notices, in the languages your users need.
- 3
Set up rights and grievance handling
Name a contact and set timelines.
- 4
Secure and monitor
Safeguards plus a breach plan.
- 5
Check your vendors
Contracts that carry the same duties.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Notice and consent | Consent and notice records |
| Purpose and minimisation | Data inventory with purposes and retention |
| Rights of individuals | Request and grievance tracker |
| Security safeguards | Controls library with evidence |
| Breach notification | Incident log and notification workflow |
| Special duties | Role checks and assessment records |
Free DPDP readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Consent notice template
- Data inventory starter
- Grievance handling procedure
- Breach response checklist
Share or cite this page
Writing about DPDP? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/dpdp-act/">DPDP explained in plain English - Optimus CyberX</a>Common questions
Is the DPDP Act in force?
Yes, in phases. The Data Protection Board provisions started on 13 November 2025 and the Rules were notified on 14 November 2025 with an 18-month phased timeline for the main duties. Check the official site for the current dates.
Does it apply to foreign companies?
Yes, where they process data of people in India to offer them goods or services.
How is it different from GDPR?
It is shorter, centres on consent, and has fewer legal bases for using data.
Who enforces it?
The Data Protection Board of India, a digital-first body set up under the Act.
Related frameworks
See how ready you are for DPDP
Answer questions across every area. We email you a report showing where you comply and where you do not.