Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

DPDP Act by role

DPDP Act for Legal Teams and Consultants

Whether you advise in-house or for clients, here is the DPDP Act surface area you need to cover.

Understand. Check. Connect.

We match you with the right DPDP implementation partner, only when you ask.

Free readiness checkGet the toolkit

At a glance

Legal teams and consultants operationalise the DPDP Act: drafting notices, consent and processor contracts, advising on cross-border transfers and sector overlaps with RBI, SEBI and IRDAI, assessing Significant Data Fiduciary obligations, and tracking the evolving Rules. The DPDP Act sits alongside, not above, sectoral regulation.

What the DPDP Act means for you

For legal advisers the DPDP Act is both a drafting exercise and a judgment exercise: getting notices, consent language and processor clauses right, and advising where the Act interacts with sectoral regimes and cross-border constraints. Staying current matters, because the Rules were notified in November 2025 and continue to develop.

Your priorities

Contracts and clauses

Draft and review processor agreements, notices and consent language to DPDP Act standards.

Sector and cross-border

Advise where DPDP Act overlaps with RBI, SEBI and IRDAI, and on cross-border transfer rules.

SDF assessment

Assess whether a client is, or may become, a Significant Data Fiduciary, and the Section 10 duties that follow.

Staying current

Track the Rules, deadlines and Board guidance as they evolve.

Where to start

Scope the exposure

Map the client's processing and where DPDP Act and sector rules apply.

Draft the documents

Notices, consent language and processor clauses, adapted to the client.

Assess SDF status

Determine whether Section 10 duties apply.

Set a review cadence

Keep pace with the Rules and Board guidance.

Tools and help

Move fast with ready-made resources, or get expert help where it matters:

Compliance ToolkitFree readiness assessmentServices and partnersGuides

Frequently asked questions

Does the DPDP Act override sector regulators?
No. It sits alongside them. Where RBI, SEBI or IRDAI impose stricter or specific requirements, those continue to apply on top of the DPDP Act.
Is there a legitimate-interest basis like the GDPR?
No. The DPDP Act does not have a general legitimate-interest basis. Processing rests on consent or specified legitimate uses.
Can I adapt these templates for clients?
The toolkit templates are editable and made to be adapted, though you should tailor and review them for each client's situation.

See where you stand

Take the free readiness assessment for a picture tailored to your organisation, then choose a tool or a partner.

Start free readiness assessmentSee the Compliance Toolkit

This page is educational and not legal advice. Confirm against the enacted Act and the DPDP Rules, or take professional advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.