DPDP Act guide
The DPDP Act, in plain words.
Short guides on what the Act and the Rules ask of you, written for the people who have to make it work: compliance heads, founders, CTOs and operations leads. Each guide is dated.
In short
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's law on how organisations process digital personal data. It applies to processing in India, and to processing outside India connected with offering goods or services to people in India. The DPDP Rules were notified on 13 November 2025 and apply in phases, with most duties of Data Fiduciaries due around 13 May 2027, as notified. The Schedule sets penalties of up to 250 crore rupees per instance.
Source: MeitY: Data protection framework
Contents
18 guides, one topic each
Start with the timeline if you are new to the Act. Each guide links to the TrustOS modules that carry that duty.
- DPDP Act timeline: when each part appliesWhen the DPDP Act and the DPDP Rules, 2025 apply, phase by phase, with the dates as notified and what could still change.
- Rights of Data Principals under the DPDP ActThe rights the DPDP Act gives individuals: access, correction, completion, updating, erasure, grievances and nomination, and how to handle requests.
- Notice and consent under the DPDP ActWhat a DPDP notice must cover, what valid consent looks like, how withdrawal works, and where consent is not the right basis.
- Personal data breach notification under the DPDP RulesWho to tell after a personal data breach under the DPDP Rules, how fast, and the 72 hour detailed report to the Board.
- Children's personal data under the DPDP ActVerifiable parental consent, the ban on tracking and targeted ads aimed at children, and what it means for schools, edtech and consumer apps.
- Significant Data Fiduciaries: who they are and what they must doHow the government notifies Significant Data Fiduciaries and the extra duties: an India based DPO, an independent auditor, yearly DPIAs and audits.
- Consent Managers under the DPDP ActWhat a Consent Manager is, who can register with the Data Protection Board, the 2 crore rupee net worth test, and what it means for Data Fiduciaries.
- DPDP Act penalties: the Schedule explainedThe maximum penalties in the Schedule to the DPDP Act, from 10,000 rupees to 250 crore rupees, and how the Data Protection Board decides the amount.
- Legitimate uses: processing without consent under section 7The closed list of legitimate uses in section 7 of the DPDP Act, where you can process personal data without consent, with examples and limits.
- Who the DPDP Act applies toWhich organisations and which data the DPDP Act covers, including processing outside India, and what section 3 leaves out.
- Data Protection Officers and contact persons under the DPDP ActThe contact person every Data Fiduciary must publish, the DPO a Significant Data Fiduciary must appoint, and the auditor and DPIA duties around it.
- Transferring personal data outside India under the DPDP ActHow section 16 of the DPDP Act handles transfers outside India, how sector rules such as RBI payment data storage still apply, and what to record.
- Data retention and erasure under the DPDP ActWhen the DPDP Act requires you to erase personal data, the three year rule for large platforms, the 48 hour notice and what processors must do.
- Reasonable security safeguards under the DPDP Act and RulesWhat section 8(5) and the DPDP Rules expect for security safeguards, from encryption and access control to logs kept for a year.
- Working with Data Processors under the DPDP ActWhy you stay responsible for your vendors under the DPDP Act, the valid contract section 8(2) requires, and what the contract should cover.
- DPDP Act and GDPR: the main differencesA plain comparison of the DPDP Act and the GDPR for teams that already run a GDPR programme, covering grounds, children, rights, breaches and penalties.
- The Data Protection Board of IndiaWhat the Data Protection Board of India does, how complaints reach it, voluntary undertakings, and appeals to the Appellate Tribunal within 60 days.
- DPDP Act glossary: the terms in plain EnglishPlain English meanings of the key terms in the DPDP Act and the DPDP Rules, 2025, from Data Fiduciary to Consent Manager.
The Schedule at a glance
Maximum penalties, per instance
The Data Protection Board decides the actual amount, considering the nature, gravity and duration of the breach and other factors.
- ₹250 crore
- Failing to take reasonable security safeguards
- ₹200 crore
- Failing to notify the Board or affected people of a breach
- ₹200 crore
- Breaching the additional duties for children's data
- ₹150 crore
- Breaching the additional duties of a Significant Data Fiduciary
- ₹50 crore
- Any other breach of the Act or the Rules
- ₹10,000
- Breach of a Data Principal's own duties
The basics
Four questions first
Short answers. Each guide goes further.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's law on how organisations collect and use digital personal data. It gives people rights over their data and places duties on the organisations that decide how it is used, called Data Fiduciaries.
Who does it apply to?
Any organisation that processes digital personal data in India, and organisations outside India that process such data in connection with offering goods or services to people in India. Size does not exempt you, though some duties apply only to Significant Data Fiduciaries notified by the government.
When does it apply?
The DPDP Rules, 2025 were notified on 13 November 2025 and commence in phases. Consent Manager provisions begin around November 2026 and most duties of Data Fiduciaries around May 2027, as notified, unless amended. See the timeline page for detail.
What are the penalties?
The Schedule to the Act sets maximum penalties per instance, up to 250 crore rupees for failing to take reasonable security safeguards. The Data Protection Board decides the actual amount. See the penalties page.
See it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.