Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

Knowledge glossary

The DPDP Act, defined

Every key concept in India's Digital Personal Data Protection Act and Rules, explained in plain language and linked to its exact source. Not an A to Z dictionary, a connected map of how the Act fits together.

38 knowledge objects6 topic clustersLinked to Sections, Rules and RightsPrimary-source citations

Browse by topic

Core Concepts

Personal DataDigital Personal DataDataProcessingSpecified PurposePersonal Data Breach

People & Roles

Data PrincipalData FiduciaryData ProcessorSignificant Data FiduciaryConsent ManagerData Protection OfficerData AuditorChildPerson

Consent & Notice

NoticeConsentConsent WithdrawalCertain Legitimate UsesVerifiable Consent

Rights & Duties

Right to Access InformationRight to Correction and ErasureRight of Grievance RedressalRight to NominateDuties of a Data Principal

Data Lifecycle & Security

Children's DataCross-border Data TransferData RetentionReasonable Security SafeguardsBreach NotificationData Protection Impact Assessment

Enforcement & Institutions

Data Protection Board of IndiaFinancial PenaltyThe ScheduleAppellate TribunalVoluntary UndertakingBlocking of AccessExemptions

The DPDP Act knowledge graph

Every term is a node in one connected graph, grouped into six clusters. Follow a line to see how a role, concept or obligation relates to the rest of the Act. Tap any node to open it.

Core ConceptsPeople & RolesConsent & NoticeRights & DutiesData Lifecycle & SecurityEnforcement & Institutions
CORE CONCEPTSPEOPLE & ROLESCONSENT & NOTICERIGHTS & DUTIESDATA LIFECYCLE & SECURITYENFORCEMENT & INSTITUTIONSPersonal DataDigital Personal DataDataProcessingSpecified PurposePersonal Data BreachData PrincipalData FiduciaryData ProcessorSignificant Data FiduciaryConsent ManagerData Protection OfficerData AuditorChildPersonNoticeConsentConsent WithdrawalCertain Legitimate UsesVerifiable ConsentRight to Access InformationRight to Correction and ErasureRight of Grievance RedressalRight to NominateDuties of a Data PrincipalChildren's DataCross-border Data TransferData RetentionReasonable Security SafeguardsBreach NotificationData Protection Impact AssessmentData Protection Board of IndiaFinancial PenaltyThe ScheduleAppellate TribunalVoluntary UndertakingBlocking of AccessExemptions

All terms

ABCDEFGHIJKLMNOPQRSTUVWXYZ
Appellate TribunalEnforcement & InstitutionsThe Appellate Tribunal is the body that hears appeals against the Board's orders. Under the Act it is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).Read definition →Blocking of AccessEnforcement & InstitutionsBlocking of access is the government's power to order that a repeatedly penalised fiduciary's service be blocked from public access in the public interest.Read definition →Breach NotificationData Lifecycle & SecurityBreach notification is the duty to inform the Data Protection Board and every affected individual when a personal data breach occurs.Read definition →Certain Legitimate UsesConsent & NoticeCertain legitimate uses are the situations in Section 7 where a Data Fiduciary may process personal data without separate consent.Read definition →ChildPeople & RolesUnder the DPDP Act a child is anyone who has not completed 18 years of age. Processing their data carries extra safeguards.Read definition →Children's DataData Lifecycle & SecurityProcessing children's data carries special duties: verifiable parental consent, no processing harmful to the child, and no tracking, behavioural monitoring or targeted advertising directed at children.Read definition →ConsentConsent & NoticeConsent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs.Read definition →Consent ManagerPeople & RolesA Consent Manager is a Board-registered intermediary that gives people one interoperable dashboard to give, manage, review and withdraw consent.Read definition →Consent WithdrawalConsent & NoticeConsent withdrawal is the right to take back consent at any time, as easily as it was given, after which processing must stop.Read definition →Cross-border Data TransferData Lifecycle & SecurityCross-border transfer is the movement of personal data outside India for processing. The Central Government may restrict transfers to notified countries.Read definition →DataCore ConceptsData is any representation of information, facts, opinions or instructions in a form suitable for communication, interpretation or processing.Read definition →Data AuditorPeople & RolesA data auditor is the independent auditor a Significant Data Fiduciary must appoint to evaluate its compliance with the Act.Read definition →Data FiduciaryPeople & RolesA Data Fiduciary is any person or organisation that decides why and how personal data is processed. It carries the Act's primary responsibilities.Read definition →Data PrincipalPeople & RolesA Data Principal is the individual whose personal data is processed, and the holder of the rights the Act grants.Read definition →Data ProcessorPeople & RolesA Data Processor processes personal data on behalf of a Data Fiduciary, under that fiduciary's instructions and a valid contract.Read definition →Data Protection Board of IndiaEnforcement & InstitutionsThe Data Protection Board of India is the independent regulator established under Section 18 to enforce the Act, inquire into breaches and impose penalties.Read definition →Data Protection Impact AssessmentData Lifecycle & SecurityA Data Protection Impact Assessment (DPIA) is a periodic risk process that Significant Data Fiduciaries must run to assess and manage risks to Data Principals' rights.Read definition →Data Protection OfficerPeople & RolesA Data Protection Officer (DPO) is the India-based individual a Significant Data Fiduciary must appoint to represent it and be the point of contact for grievances.Read definition →Data RetentionData Lifecycle & SecurityData retention rules require a Data Fiduciary to erase personal data once consent is withdrawn or the specified purpose is no longer served, unless a law requires keeping it.Read definition →Digital Personal DataCore ConceptsDigital personal data is personal data in digital form. It is the precise subject the DPDP Act regulates.Read definition →Duties of a Data PrincipalRights & DutiesThe Act places duties on Data Principals too, including not impersonating others and not filing false grievances.Read definition →ExemptionsEnforcement & InstitutionsExemptions are the situations in Section 17 where some or all of the Act's obligations do not apply, such as legal claims, crime investigation, and research.Read definition →Financial PenaltyEnforcement & InstitutionsA financial penalty is the monetary penalty the Board may impose for a significant breach, in the amounts set out in the Schedule.Read definition →NoticeConsent & NoticeA notice is the clear, itemised information a Data Fiduciary must give before or with any request for consent, setting out what data, why, and how to exercise rights and complain.Read definition →PersonPeople & RolesPerson is defined broadly to include individuals, companies, firms, associations, the State and artificial juristic persons.Read definition →Personal DataCore ConceptsPersonal data is any data about an individual who can be identified from it, or in relation to it. The DPDP Act applies to such data in digital form.Read definition →Personal Data BreachCore ConceptsA personal data breach is any unauthorised or accidental event that compromises the confidentiality, integrity or availability of personal data.Read definition →ProcessingCore ConceptsProcessing is almost anything you do with personal data, from collecting and storing it to using, sharing or deleting it, where the operation is wholly or partly automated.Read definition →Reasonable Security SafeguardsData Lifecycle & SecurityReasonable security safeguards are the technical and organisational measures a Data Fiduciary must take to protect personal data and prevent breaches.Read definition →Right of Grievance RedressalRights & DutiesThis right entitles a Data Principal to a readily available way to raise grievances with a Data Fiduciary or Consent Manager.Read definition →Right to Access InformationRights & DutiesThe right to access lets a Data Principal obtain a summary of the personal data being processed about them and who it has been shared with.Read definition →Right to Correction and ErasureRights & DutiesThis right lets a Data Principal have their personal data corrected, completed, updated or erased.Read definition →Right to NominateRights & DutiesThe right to nominate lets a Data Principal appoint someone to exercise their rights if they die or become incapacitated.Read definition →Significant Data FiduciaryPeople & RolesA Significant Data Fiduciary is a Data Fiduciary the Central Government notifies as higher-risk under Section 10, carrying extra obligations.Read definition →Specified PurposeCore ConceptsThe specified purpose is the exact reason for processing that a Data Fiduciary states in its notice. Consent and data collected are limited to it.Read definition →The ScheduleEnforcement & InstitutionsThe Schedule is the table at the end of the Act that fixes the maximum penalty for each type of breach.Read definition →Verifiable ConsentConsent & NoticeVerifiable consent is the parental or guardian consent a Data Fiduciary must obtain, in a verifiable way, before processing a child's or protected person's data.Read definition →Voluntary UndertakingEnforcement & InstitutionsA voluntary undertaking is a commitment a person can offer the Board to take or refrain from certain action, which, if accepted, bars further proceedings on that matter.Read definition →

Popular terms

Personal DataPersonal Data BreachData FiduciaryConsent ManagerConsentRight to Correction and ErasureChildren's DataReasonable Security SafeguardsData Protection Board of IndiaFinancial Penalty

Compare terms

Side-by-side breakdowns of the pairs people most often confuse. See all comparisons →

Data Fiduciary vs Data ProcessorThe difference comes down to control. A Data Fiduciary decides why and how personal data i...Compare →Consent vs Certain Legitimate UsesBoth are lawful bases for processing under the DPDP Act. Consent is an active agreement fr...Compare →Data Fiduciary vs Significant Data FiduciaryEvery Significant Data Fiduciary is first a Data Fiduciary. The 'significant' label is add...Compare →Personal Data vs Digital Personal DataPersonal data is any data about an identifiable individual. Digital personal data is that ...Compare →