Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Implementation
Training
Resources
About
Readiness assessment

Start by role

DPDP Act by role

The Digital Personal Data Protection Act lands differently depending on your role. Find the priorities, actions and resources that fit yours.

Understand. Check. Connect.

We match you with the right DPDP implementation partner, only when you ask.

What is here

Role-based starting points for India's DPDP Act, covering founders and startups, Data Protection Officers, HR and people teams, developers and engineering, legal teams and consultants, Data Fiduciaries, and Significant Data Fiduciaries. Each page gives that role's priorities, first actions, and the tools and services that fit.

Find your role

Founders and Startups

You are building a company, and the DPDP Act now applies to you as a Data Fiduciary. Here is.

DPDP Act for founder

Data Protection Officers

You own the data protection programme. Here is what the DPDP Act expects you to build, run and.

DPDP Act for DPO

HR and People Teams

Employee and candidate data is personal data. Here is what the DPDP Act changes for how your.

DPDP Act for HR

Developers and Engineering

The DPDP Act is a set of requirements you build into the product. Here is what to.

DPDP Act for developer

Legal Teams and Consultants

Whether you advise in-house or for clients, here is the DPDP Act surface area you need to.

DPDP Act for legal adviser

Data Fiduciaries

You decide why and how personal data is processed, which makes you the primary obligated party.

DPDP Act for Data Fiduciary

Significant Data Fiduciaries

The Significant Data Fiduciary tier carries extra obligations under Section 10. Here is what.

DPDP Act for SDF

Frequently asked questions

Where should I start with the DPDP Act?
Start from your role. Each role has different priorities, so pick the page that matches your job, then take the free readiness assessment for a tailored picture.
Who does the DPDP Act apply to?
Any organisation that decides the purpose and means of processing personal data is a Data Fiduciary and must comply, whatever its sector or size.