The Digital Personal Data Protection Act, 2023 (DPDP Act or DPDPA) is India's data protection law. It applies to any business that processes digital personal data of individuals in India, with no minimum size. The DPDP Rules, 2025 were notified on 13 November 2025, and most duties (notice, consent, security, breach reporting within 72 hours, data rights) apply from 13 May 2027. Penalties go up to ₹250 crore per breach.
- Law
- DPDP Act, 2023 + DPDP Rules, 2025
- Rules notified
- 13 November 2025
- Main duties apply from
- 13 May 2027
- Maximum penalty
- ₹250 crore per breach
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (DPDP Act) governs how organisations collect, use, store, share and delete personal data of individuals. It received Presidential assent on 11 August 2023. The detailed rules that make it workable, the Digital Personal Data Protection Rules, 2025, were notified on 13 November 2025 with a phased start.
The law uses its own vocabulary. The business that decides why and how data is used is a Data Fiduciary. The individual the data is about is the Data Principal. A vendor that processes data for the business (a CRM, a payroll provider, a cloud host) is a Data Processor. Disputes and penalties go to the Data Protection Board of India, with appeals to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
When does the DPDP Act come into force?
| From | What applies | Rules |
|---|---|---|
| 13 November 2025 | Definitions and the Data Protection Board of India (set-up, procedure, appeals) | Rules 1, 2, 17–21 |
| 13 November 2026 | Registration and duties of consent managers | Rule 4 |
| 13 May 2027 | All remaining duties: notice, consent, security, breach reporting, retention, children's data, rights, significant data fiduciaries, cross-border transfer | Rules 3, 5–16, 22, 23 |
In January 2026 MeitY consulted on shortening the 18-month window to 12 months. As of October 2026 that change had not been notified, so 13 May 2027 remains the date for the main duties. Building consent records, notices and breach processes takes months, so most businesses are starting now.
Who does the DPDP Act apply to?
- Any business, of any size, that processes digital personal data in India, or personal data collected offline and later digitised.
- Businesses outside India that process personal data to offer goods or services to people in India.
- Both B2C and B2B businesses: the name, phone number and work email of a client's employee are personal data.
- Employers, for employee and candidate data.
It does not apply to personal data used by an individual for personal or domestic purposes, or to data the individual has made publicly available themselves (or that is published under a legal obligation). It covers only individuals' data; company data such as a GSTIN or turnover is not personal data. See does the DPDP Act apply to my business.
Key obligations for businesses
| Obligation | What it means in practice | Where |
|---|---|---|
| Lawful ground | Process data only with valid consent or for a listed 'legitimate use' (such as employment or a legal duty) | Sections 4, 6, 7 |
| Notice | Give a clear, standalone notice listing the data collected, the purpose, and how to withdraw consent, use rights and complain to the Board | Section 5, Rule 3 |
| Consent | Free, specific, informed, unconditional and unambiguous, through a clear action (no pre-ticked boxes). Withdrawal must be as easy as giving it | Section 6 |
| Security | Encryption or masking, access control, logging and monitoring, backups, and contracts with processors | Section 8(5), Rule 6 |
| Breach reporting | Tell affected individuals and the Board without delay, and send the Board a detailed report within 72 hours | Section 8(6), Rule 7 |
| Retention and erasure | Delete data once the purpose is served or consent is withdrawn; keep logs for at least one year | Section 8(7), Rule 8 |
| Contact person | Publish the contact details of a DPO or a person who can answer data questions | Section 8(9), Rule 9 |
| Children's data | Verifiable parental consent for anyone under 18; no tracking or targeted ads aimed at children | Section 9, Rule 10 |
| Rights requests | Let people access, correct and erase their data and raise grievances; respond within 90 days at most | Sections 11–14, Rule 14 |
| Significant Data Fiduciaries | Extra duties: India-based DPO, independent audit and annual data protection impact assessment | Section 10, Rule 13 |
DPDP Act penalties
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)) | ₹250 crore |
| Failure to notify the Board and affected individuals of a personal data breach (Section 8(6)) | ₹200 crore |
| Breach of obligations for children's data (Section 9) | ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary (Section 10) | ₹150 crore |
| Breach of a voluntary undertaking accepted by the Board (Section 32) | Up to the penalty for the underlying breach |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of duties by an individual (Section 15), e.g. a false complaint | ₹10,000 |
The Board decides the amount case by case, considering the nature, gravity and duration of the breach, the type of data, repetition, any gain or loss, and steps taken to mitigate. Penalties are civil, not criminal. More on DPDP penalties.
How to start: a 6-step plan
- Map your data. List every place you collect personal data (website forms, WhatsApp, CRM, HR, vendors) and why.
- Pick the lawful ground for each purpose: consent, or a legitimate use such as employment.
- Rewrite notices and consent flows. A standalone notice, an unticked opt-in box, and an easy way to withdraw.
- Fix security and vendor contracts. Access control, encryption, logs kept for a year, and data processing clauses with every processor.
- Write a breach plan that can produce the Board's 72-hour report.
- Set retention periods and a process to answer access, correction and erasure requests.
The full list is in our DPDP compliance checklist.
Frequently asked questions
Is the DPDP Act in force?
Partly. The Act and the DPDP Rules, 2025 were notified on 13 November 2025. Provisions on the Data Protection Board apply from that date, consent manager rules from 13 November 2026, and the main duties for businesses (notice, consent, security, breach reporting, rights, children's data) from 13 May 2027.
What is the deadline for DPDP compliance?
13 May 2027 for most obligations of Data Fiduciaries. A proposal to bring this forward to 13 November 2026 was consulted on in January 2026 but had not been notified as of October 2026.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Other ceilings are ₹200 crore (breach notification and children's data), ₹150 crore (Significant Data Fiduciary duties) and ₹50 crore (any other breach).
Does the DPDP Act apply to small businesses and startups?
Yes. There is no turnover or size threshold. The government can exempt notified classes of Data Fiduciaries, including startups, from some duties under Section 17(3), so check whether such a notification covers you.
Does the DPDP Act cover offline or paper records?
Only if the data is digitised later. Purely paper records that are never digitised are outside the Act.
Is there a 'sensitive personal data' category under the DPDP Act?
No. Unlike the old SPDI Rules under the IT Act and the EU GDPR, the DPDP Act treats all personal data alike, with extra protection for children's data and for Significant Data Fiduciaries.
Who enforces the DPDP Act?
The Data Protection Board of India, an independent body that hears complaints, investigates breaches and imposes penalties. Appeals go to TDSAT.
Can individuals claim compensation under the DPDP Act?
No. Penalties are paid to the government, not to individuals. Individuals can complain to the Board after first using the business's grievance process.
More DPDP Act guides
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.