Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsEvery section in plain language, a clear picture of what is already in force, and one place to start instead of forty-four.
Understand. Check. Connect.
We match you with the right DPDP implementation partner, only when you ask.
In short
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data-protection law. It sets out how organisations may collect, use and protect the personal data of people in India, and it is enforced by the Data Protection Board of India, with penalties up to ₹250 crore. The Rules took effect on 13 November 2025; full compliance is due by 13 May 2027.
Almost every organisation that handles the personal data of people in India, from a two-person startup to a multinational, including companies based abroad that offer goods or services to people in India.
Wherever you are in the journey, start there. Each stage links to the guidance, tools and sections that fit.
Understand the Act in plain language.
Start guide →See where you stand and find your gaps.
Readiness check →Map data, write notices, fix consent.
The roadmap →Put controls and safeguards in place.
Tools & partners →Review and stay compliant over time.
Stay updated →Most teams can read the law. Far fewer have mapped their data, wired consent and rights into live systems, and built the evidence a regulator will ask for. The implementation hub lays out the full path from readiness to operational compliance, and how partner-led delivery gets you there before 13 May 2027.
Six roles the whole law turns on. Knowing which one you are is the first compliance decision.
Terms that look alike but carry different obligations. Pick the pair you are unsure about.
The Act sets a lifecycle, not a fixed number of years: keep personal data only while its purpose lives.
All nine chapters and 44 sections, each in plain language with the statutory citation underneath.
The Act says what; the Rules say how. Notified and in force from 13 November 2025, they carry the operational detail behind every obligation.
Read the DPDP Rules 2025 →Same Act, different data. See what the DPDP Act means for your sector.
A hand-picked few to get you moving. Everything else lives in the resource hub.
Answer a short set of questions and get a personalised gap report, private and with no sign-up.
Start the check →Board and Data Principal notice templates, ready to adapt before an incident.
Get the pack →How to build notice, consent capture and withdrawal that actually meet Sections 5 and 6.
Read the guide →What the Rules add on top of the Act, and what they change for you.
Read the guide →Fintech, health, edtech, SaaS and more, each with its own data-stream map.
Find yours →Vetted consultants and tools, matched to your size and sector.
Browse partners →DPDP Compliance Certification is an independent mark that shows customers, partners and regulators your organisation meets the Act's requirements, not just claims to.
From "are we even compliant?" to a mark you can show, in four steps.
Take the free readiness check and see your gaps.
Follow your prioritised roadmap to close them.
Have your controls and evidence reviewed.
Earn your certification and renew as you grow.
23 guides, 6 articles, 12 tools and templates and a 38-term glossary.
Updated 7 Oct 2026Recent additions from across the whole knowledge base.
Step-by-step, plain-English walkthroughs of notice, consent and compliance.
Short explainers and news as the Rules and deadlines take shape.
Interactive checklists, a notice generator and editable template packs.
Clear, cite-able definitions for every key term in the Act.
Side-by-side explainers of terms people often confuse.
Short, cite-able answers to what people ask most.
Consultant-led and partner-backed.