India’s privacy law, drawn out step by step.
Who the Digital Personal Data Protection Act covers, when you need consent, what people can demand, what to do in a breach, and what it costs to get it wrong. Every point carries its section or rule number so you can check it against the official text.
DPDP Act and Rules — official texts
Always rely on the official text. These links open the Government of India sources:
- 1The Digital Personal Data Protection Act, 2023 (Act 22 of 2023)
The principal legislation governing the processing of digital personal data in India.
Read the Act (PDF) · meity.gov.in - 2Digital Personal Data Protection Rules, 2025
The notified Rules specify operational requirements, including provisions concerning notices, consent, security safeguards, breach notifications, children’s data and individual rights.
Read the Rules · meity.gov.in
From Act to enforcement
The Act was passed in 2023 but switched on only when the final Rules were notified in November 2025. Obligations then arrive in three waves over 18 months.
Act receives assent
Passed by Parliament; on the statute book but not yet in force.
Draft Rules published
Released for public consultation. Not binding.
Phase 1: Rules notified
Definitions, the Data Protection Board and its procedures come into force.
Phase 2: Consent Managers
Registration and obligations of Consent Managers take effect.
Phase 3: Full compliance
Notice, consent, rights, security, breach, children, SDF duties and penalties all apply.
Five players, one data flow
Almost every obligation in the Act sits with the Data Fiduciary. The diagram shows who hands data to whom and who answers to whom.
Fiduciary or Processor?
Ask who decides the purpose. A retailer collecting addresses to ship orders is the Fiduciary. The courier software firm storing those addresses for it is a Processor.
Processor liability
The Act places duties on the Fiduciary, which stays responsible even for what its Processor does (§8(1)). The Processor's exposure runs through its contract.
Consent Manager
A distinctly Indian feature, modelled on Account Aggregators. Must be an Indian company with net worth of at least ₹2 crore, and act in a fiduciary capacity for the individual.
Does the Act apply to this data?
Walk through the scope test in §3 and the exemptions in §17. Answer each question and the flowchart takes you to a verdict.
Two lawful routes: consent or legitimate use
Personal data may be processed only for a lawful purpose, and only on one of two grounds (§4). There is no general "legitimate interests" ground as in the GDPR.
- Person voluntarily gave data for a specific purpose and didn't object
- State subsidies, benefits, licences, certificates
- State functions under law; sovereignty and security
- Legal obligation to disclose; court judgments
- Medical emergency, epidemic, disaster, breakdown of public order
- Employment purposes, incl. protecting the employer from loss
- Give a notice first (or with the request)
- Obtain consent that meets all five tests below
- Process only data necessary for that purpose
- Let them withdraw as easily as they gave it
- On withdrawal, stop and erase (and make processors erase) within a reasonable time
What makes consent valid? §6(1)
Tap each test to see what passes and what fails. All five must hold, and consent must come by a clear affirmative action.
The notice
§5 · Rule 3- Stand-alone and understandable on its own, not buried in terms of service
- Itemised list of the personal data and the specific purpose for each
- How to withdraw consent, exercise rights, and complain to the Board
- Reader can choose English or any of the 22 Eighth Schedule languages
- For data collected before the Act started: a notice as soon as reasonably practicable
Withdrawal
§6(4)–(6)- Available at any time, and as easy as giving consent
- Processing done before withdrawal stays lawful
- The person bears the consequences (e.g. a service that needs the data stops)
- Fiduciary must cease processing and have its Processors do the same
What individuals can demand, and what they owe
Four rights and a short list of duties. The rights apply where the person gave consent or volunteered data under §7(a).
Access
A summary of their data and the processing done; the identities of other fiduciaries and processors it was shared with.
Correction & erasure
Correct, complete or update data; erase it unless retention is needed for the purpose or required by law.
Grievance redressal
A readily available complaint channel. Must be used before approaching the Board. Rules set a 90-day outer limit for a response.
Nomination
Nominate someone to exercise these rights on death or incapacity.
Not in the Act
No right to data portability, and no standalone right to object to automated decisions. Both exist under the GDPR.
Duties of the individual
§15Follow the law, don't impersonate anyone, don't suppress material facts when submitting documents, don't file false or frivolous complaints, give only verifiably authentic information when seeking correction. Breach: penalty up to ₹10,000.
The Data Fiduciary's checklist
General obligations under §8, made concrete by the Rules. These apply to every fiduciary, large or small, unless an exemption says otherwise.
Security safeguards
§8(5) · R6Encryption, masking or tokenisation; access controls; logs and monitoring; backups for continuity; matching clauses in processor contracts. Logs kept at least one year.
Accuracy
§8(3)Ensure data is complete, accurate and consistent where it drives a decision about the person or is shared with another fiduciary.
Erasure
§8(7) · R8Erase once the purpose is served or consent is withdrawn, unless law requires retention. Large e-commerce, gaming and social media platforms: erase after 3 years of user inactivity, with 48 hours' warning.
Contact point
§8(9)Publish the business contact of a DPO (for SDFs) or a person who can answer questions about processing.
Processors under contract
§8(2)Engage a processor only through a valid contract. The fiduciary remains answerable for its processors.
Breach reporting
§8(6) · R7Report every personal data breach to the Board and to each affected person. See the breach chapter below.
Children's data: a stricter regime
A child is anyone under 18, with no lower age for digital consent as in the GDPR. Penalty for breach of these duties: up to ₹200 crore.
Parental consent and/or tracking restrictions lifted to the extent the Schedule allows, and only within the stated purpose.
- Verifiable consent of a parent or lawful guardian (Rule 10: verify the adult's identity and age via existing records or a token such as DigiLocker)
- No processing likely to harm the child's well-being
- No tracking, behavioural monitoring or targeted advertising aimed at children
For a person with a disability who has a lawful guardian, consent comes from that guardian, after the fiduciary checks the guardianship (Rule 11).
Significant Data Fiduciaries
The Government can notify any fiduciary, or a class of them, as an SDF. Designation brings a second layer of duties. Penalty for breaching them: up to ₹150 crore.
What triggers designation
§10(1)- Volume and sensitivity of data processed
- Risk to the rights of Data Principals
- Potential impact on sovereignty and integrity of India
- Risk to electoral democracy
- Security of the State and public order
Extra obligations
§10(2) · R13- DPO based in India, answerable to the board of directors
- Independent data auditor
- Data Protection Impact Assessment and audit every 12 months, findings reported to the Board
- Due diligence that algorithmic software doesn't harm Data Principals' rights
- Possible restriction on transferring specified data outside India
When a breach happens
There is no materiality threshold: every personal data breach is reportable. Two clocks run. The first says "without delay"; the second gives 72 hours for the detailed report.
Breach discovered
- Unauthorised processing, accidental disclosure, loss of access or integrity
- Contain and preserve logs
Tell each affected person
- What happened, extent, timing
- Likely consequences
- Steps taken and safety measures they can take
- Contact who can answer
Initial intimation to the Board
- Description: nature, extent, timing, location
- Likely impact
Detailed report to the Board
- Facts and probable cause
- Mitigation and remediation
- Who caused it, if known
- Proof the individuals were informed
The Board can allow more than 72 hours on a written request. Failure to notify: up to ₹200 crore. Failure of security that led to the breach: up to ₹250 crore, assessed separately. §8(6) · Rule 7
Cross-border transfers
India uses a negative list. Data can go anywhere unless the Government blocks a country.
Subject to any conditions the Government sets on making data available to foreign States (Rule 15), and to all other DPDPA duties.
No adequacy decisions or standard contractual clauses route around it.
Exemptions
Outside the Act entirely (§3), or inside it with most obligations switched off (§17). Security safeguards under §8(5) continue to apply under §17(1).
Out of scope
§3(c)- Personal or domestic use by an individual
- Data made public by the person themselves
- Data made public under a legal obligation
- Non-digital data that is never digitised
Partial exemption
§17(1)- Enforcing legal rights or claims
- Courts, tribunals and regulators performing their functions
- Prevention and investigation of offences
- Indian firms processing foreigners' data under contract (outsourcing)
- Court-approved mergers, demergers and amalgamations
- Finding the assets and liabilities of a loan defaulter
Notified exemptions
§17(2)–(3)- Notified State instrumentalities (security, public order)
- Research, archiving or statistics, if no decision is taken about the individual
- Notified classes, including startups, can be relieved of notice, accuracy, erasure, SDF and access duties
Complaint to final appeal
The Board is a digital-first body with no civil-court route around it (§39). A complaint follows this path.
Blocking as a last resort
§37If a fiduciary has been penalised in two or more instances, the Board can recommend that the Government block public access to its platform in India.
Penalties under the Schedule
Maximum amounts per instance, drawn to scale (the voluntary-undertaking item has no fixed figure: its cap follows the breach that started the proceedings). These are civil penalties paid into the Consolidated Fund of India; they are not compensation to the affected person.
Common misreadings, corrected
These errors show up often in summaries and FAQs, including widely shared ones. Each correction cites the text.
Self-check
Eight questions. If you get all of them, you have the key features down.
Let’s talk about your business.
Start with a confidential, no-obligation discovery conversation. We’ll understand the problem, agree a scope and tell you plainly whether we are the right fit.