UpdatedBy Team DPDP Act India
What is DPDP Act? A Compliance Guide in 2027 for Indian Organizations
Easy words, clear pictures and the exact sections of the law. Learn what the DPDP Act asks of you and how to get ready.
Short answerDPDP Act compliance means following India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 whenever you handle digital personal data. You tell people what you collect and why, get valid consent (or use a listed legitimate use), keep data secure, report breaches, honour people's rights and keep proof. The core duties begin on 13 May 2027.
- 13 May 2027Core duties begin
- Rs 250 croreHighest penalty
- 72 hoursDetailed breach report
- 90 daysLongest grievance reply time you may publish
DPDP Act compliance in one picture
Compliance is not one document. It is eight habits that work together. Each number below is a part of the law, and you can read how to do it in the DPDP Act compliance checklist.
- 1Know your data
Map what you hold - 2Notice
Section 5, Rule 3 - 3Consent
Sections 6 and 7 - 4Security
Section 8(5), Rule 6 - 5Breach response
Section 8(6), Rule 7 - 6Erase and retain
Section 8(7), Rule 8 - 7Rights and grievance
Sections 11 to 14 - 8Children
Section 9, Rules 10 to 12
Two more things sit around these eight: control over your vendors (Section 8) and extra duties if you are a Significant Data Fiduciary (Section 10). Both are in the duties table below.
Does the DPDP Act apply to you?
Answer four questions. They take a minute and tell you which role you play.
- 1
Do you process digital personal data in India, or offer goods or services to people in India from abroad?
No: the Act does not cover that processing.Yes: go to question 2.
- 2
Is the data used only for personal or domestic purposes by one individual?
Yes: the Act does not cover it.No: go to question 3.
- 3
Do you decide why and how the data is processed?
No: you are a Data Processor. Your client, the Data Fiduciary, is responsible, and you work under a contract.Yes: you are a Data Fiduciary. Go to question 4.
- 4
Has the Government notified you as a Significant Data Fiduciary?
No: the core duties in this guide apply to you.Yes: you have extra duties too: an India-based DPO, an independent auditor and yearly assessments.
Who is who under the DPDP Act
The Act uses a few new words. Here they are in simple language. For more terms, see the DPDP Act glossary.
| Role | What it means | Where in the law |
|---|---|---|
| Data Fiduciary | Decides why and how personal data is used. Most businesses are one. | Section 2(i) |
| Data Principal | The person the data is about. For a child, this includes the parent or lawful guardian. | Section 2(j) |
| Data Processor | A vendor or tool that handles data for a Data Fiduciary, on its instructions. | Section 2(k) |
| Significant Data Fiduciary (SDF) | A Data Fiduciary the Government notifies as significant. It has extra duties, such as a Data Protection Officer in India. | Sections 2(z) and 10 |
| Consent Manager | A registered platform where a person can give, review and withdraw consent in one place. | Section 2(g), Rule 4 |
| Data Protection Board of India | The body that hears complaints, inquires into breaches and can impose penalties. | Section 2(c) |
The dates that matter
The Act and Rules do not start all at once. You have until 13 May 2027 for the core duties, but one part starts sooner.
- In forceParts of the Act began and the Data Protection Board was established.
- NextConsent Manager provisions (Section 6(9) and Rule 4) begin.
- DeadlineCore duties begin: notice, consent, security, breach, children, rights and penalties.
Source: commencement notifications G.S.R. 843(E) and G.S.R. 846(E), as corrected by G.S.R. 892(E). See every deadline in one table and the 2027 compliance roadmap.
The core duties, one by one
This table is the heart of compliance. The last column is something other guides skip: the proof you should keep, because you must be able to show you followed the law. Read our guides on valid consent and notice versus consent for more.
| Duty | Where in the law | What it means for you | Proof to keep |
|---|---|---|---|
| Give notice | Section 5, Rule 3 | Tell people what data you collect and why. Explain how to withdraw consent, use their rights and complain to the Board. Use clear, plain language. | Notice text, version history, where it is shown |
| Get valid consent, or use a legitimate use | Sections 6 and 7 | Consent must be free, specific, informed, unconditional and unambiguous. Withdrawing must be as easy as giving it. A few listed uses do not need consent. | Consent records: who, when, what notice, what purpose |
| Keep data accurate when it drives decisions | Section 8(3) | Make sure data is complete and accurate if you use it to decide something about a person or share it with another Data Fiduciary. | Data quality checks, correction logs |
| Protect the data | Section 8(5), Rule 6 | Keep reasonable security safeguards, such as encryption, access control and logs. Keep logs for one year. | Security policy, access reviews, log retention proof |
| Report breaches | Section 8(6), Rule 7 | Tell affected people and the Board without delay. Send the Board a detailed report within 72 hours. | Incident plan, drill records, breach register |
| Erase data you no longer need | Section 8(7), Rule 8 | Erase data when consent is withdrawn or the purpose is served, unless the law says to keep it. Some classes must warn people 48 hours before erasure. | Retention schedule, deletion logs |
| Control your vendors | Section 8(1) and 8(2) | You stay responsible for data your processors handle. Use a valid contract with each one. | Vendor list, signed contracts, vendor reviews |
| Protect children's data | Section 9, Rules 10 to 12 | Get verifiable consent from a parent or guardian before processing a child's data. A child is anyone under 18. Some classes and purposes are exempt. | Age check method, parent consent records |
| Honour rights and answer grievances | Sections 11 to 14, Rule 14 | People can ask for information, correction, completion, updating and erasure, and can nominate someone. Publish how to ask, and publish your reply time. | Request log, response times, grievance contact |
| Extra duties if you are an SDF | Section 10, Rule 13 | Appoint a Data Protection Officer in India, use an independent data auditor, and run a data protection impact assessment and audit every 12 months. | DPO appointment, audit and impact assessment reports |
The breach clock
A personal data breach starts a clock. This is the order of the steps under Section 8(6) and Rule 7. Use our breach reporting guide to plan it.
- 1. DetectYou find a personal data breach.
- 2. Tell peopleInform each affected person without delay.
- 3. Tell the BoardInform the Data Protection Board without delay.
- 4. Send the reportDetailed report to the Board within 72 hours, or later if the Board allows in writing.
Do not mix the two times. You first tell people and the Board without delay. The 72 hours is the limit for the detailed report to the Board.
What it can cost to get it wrong
These are the maximum amounts in the Schedule to the Act. The Board decides the actual amount after a hearing.
The Board can impose a penalty only after an inquiry finds a significant breach and the person has been heard (Section 33). Penalties apply from 13 May 2027.
Three simple examples
Examples are for learning. Your facts may differ, so check with your counsel.
Online shop
A shop collects name, phone and email at checkout and wants to send offers.
- Show a notice before you ask for consent.
- Ask for marketing consent separately from the order.
- Let people withdraw as easily as they agreed.
- List the courier and payment vendors you share data with.
Employer and HR
A company holds staff records for payroll and hiring.
- Section 7 lists employment as a legitimate use, so consent may not be needed for it.
- Use the data only for that purpose.
- Keep it safe and erase it when you no longer need it.
Software startup
A customer database is exposed by a mistake in a cloud setting.
- Tell affected customers without delay.
- Tell the Board without delay, then send the detailed report within 72 hours.
- Show the logs and the fix. This is why you keep logs for one year.
Myths and facts
Many teams start with a wrong idea. Here are six, and the facts.
| Myth | Fact |
|---|---|
| Only big companies need to comply. | The Act covers any Data Fiduciary that processes digital personal data in India. Extra duties apply to Significant Data Fiduciaries. |
| Every business needs a Data Protection Officer. | Only Significant Data Fiduciaries must appoint one (Section 10). Every Data Fiduciary must still publish a contact for questions (Section 8(9)). |
| Consent is always required. | Section 7 lists certain legitimate uses where consent is not needed. The list is closed, so you cannot add to it. |
| I have until May 2027, so I can wait. | Consent Manager rules begin on 13 November 2026. Mapping your data, fixing notices and signing vendor contracts take months. |
| Reporting a breach means one report in 72 hours. | You must first inform people and the Board without delay. The 72-hour limit is for the detailed report to the Board. |
| A privacy policy on the website is enough. | You also need valid consent, security safeguards, a breach plan, a way to answer rights requests and proof that you did all of this. |
A 6-step plan to be ready by 13 May 2027
The law gives dates, not a plan. This is our suggested order, spread over the months you have left. The timing and owners are advice, not a legal rule. For a longer plan, start with the free 90-day plan.
- 1
Map your data
When Now to December 2026Who Data owner, IT
List what personal data you hold, where it lives, why you use it and who receives it.
Keep as proof: Data inventory and data flow map
Data mapping guide - 2
Fix notice and consent
When January to February 2027Who Legal, product, marketing
Write a clear notice. Rebuild consent screens. Record each consent. Make withdrawal easy.
Keep as proof: Notice, consent records, withdrawal flow
Consent notice generator - 3
Secure data and vendors
When March 2027Who IT, security, procurement
Put safeguards in place. Review vendors and sign processor contracts. Set retention and erasure rules.
Keep as proof: Security controls, contracts, retention schedule
Retention and erasure guide - 4
Set up rights and grievance
When March 2027Who Support, legal
Publish how to make a request. Build a simple workflow, a log and a response time under 90 days.
Keep as proof: Request workflow, log, published reply time
Rights request guide - 5
Prepare for a breach
When April 2027Who Security, legal, comms
Write an incident plan. Name who calls the Board. Run one practice drill.
Keep as proof: Incident plan, contact list, drill report
Breach reporting guide - 6
Prove it and keep it current
When May 2027 and afterWho DPO or compliance lead
Run the checklist, keep evidence in one place and review every year or after a change in law.
Keep as proof: Evidence folder, review dates
Compliance checklist
Quick self-check: ten questions
Tick what is true for you today. Each item you cannot tick is a gap to fix.
- I know which personal data we hold and where it is stored.
- Every collection point shows a clear notice.
- We keep a record of each consent.
- A person can withdraw consent as easily as they gave it.
- We have written security safeguards and keep logs for a year.
- We have a breach plan and know who tells the Board.
- Every vendor that handles personal data has a contract with us.
- We can answer an access or erasure request on time.
- We have a rule for when to delete data.
- We check the age of users and get parent consent for children.
DPDP Act and GDPR: the main differences
If you already follow the EU GDPR, you have a head start, but the two laws differ. This is a high level view only.
| Topic | DPDP Act, India | GDPR, EU |
|---|---|---|
| Basis for processing | Consent, or a closed list of legitimate uses (Sections 6 and 7). | Six legal bases, including legitimate interests. |
| Data Protection Officer | Only for Significant Data Fiduciaries, based in India (Section 10). | Required for certain organisations, such as large scale monitoring. |
| Breach notice | People and the Board without delay, then a detailed report within 72 hours. | Authority within 72 hours where feasible. |
| Who counts as a child | Under 18 (Section 2(f)). | Age set by each member state, between 13 and 16. |
| Top penalty | Up to Rs 250 crore (Schedule). | Up to 20 million euros or 4 percent of worldwide turnover. |
Compliance for your sector
The Act applies to every sector, but the data and the rules around it do not.
- Fintech and lendingDPDP Act with RBI digital lending rules.
- HealthcareWhat the Act asks of hospitals and clinics.
- EducationChildren's data, consent and Rule 12.
- Global capability centresClassify first, then comply.
- All sectorsE-commerce, SaaS, government, manufacturing, media and more.
- RolesFounders, DPOs, HR, developers and legal teams.
Tools and help for the next step
Start free, then add help where you need it. Everything below links to a page on this site.
- Free readiness assessmentScore your readiness in about 2 minutes.
- Starter KitReadiness checklist, privacy notice template and a 12-month calendar.
- Compliance ToolkitNine editable templates for Indian teams.
- Compliance assessmentA review of your gaps against the Act and Rules.
- Data mapping servicesScope your mapping project with a specialist partner.
- RoPA servicesTurn your data map into a record of processing.
- Privacy audit servicesTest whether your controls work.
- Implementation partnerGet matched with a partner who can own delivery.
Keep reading:
DPDP Act compliance: frequently asked questions
What is DPDP Act compliance?
DPDP Act compliance means following India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 when you handle digital personal data. You tell people what you collect and why, get valid consent or use a listed legitimate use, keep data secure, report breaches, honour people's rights and keep proof.
Who is required to comply with the DPDP Act?
Any Data Fiduciary that processes digital personal data in India must comply. The Act also applies outside India when the processing relates to offering goods or services to people in India (Section 3).
Is DPDP compliance mandatory?
Yes. The core duties on notice, consent, security, breach, children and rights, and the penalties, begin on 13 May 2027. Parts of the Act already began on 13 November 2025.
What is the compliance timeline for the DPDP Act?
There are three dates. Parts of the Act and the Data Protection Board began on 13 November 2025. Consent Manager provisions begin on 13 November 2026. The core duties begin on 13 May 2027.
What is a DPDP compliance assessment?
It is a review that compares what you do today with what the Act and Rules require, and lists the gaps to fix. You can start with the free readiness assessment on this site.
What is not covered by the DPDP Act?
The Act does not cover personal data processed by an individual for personal or domestic purposes. It also does not cover personal data that the Data Principal made public, or that someone made public under a legal duty (Section 3).
What are the penalties under the DPDP Act?
Maximum penalties are up to Rs 250 crore for failing to keep reasonable security safeguards, Rs 200 crore for breach notification or children's data failures, Rs 150 crore for Significant Data Fiduciary duties, and Rs 50 crore for other provisions. The Board can impose a penalty only after an inquiry finds a significant breach and the person has been heard (Section 33 and the Schedule).
Does every business need a Data Protection Officer?
No. Only Significant Data Fiduciaries must appoint a Data Protection Officer, who must be based in India (Section 10). Every Data Fiduciary must still publish contact details for questions (Section 8(9)) and run a grievance process.
How fast must a personal data breach be reported?
Inform affected Data Principals without delay. Inform the Board without delay, then send a detailed report within 72 hours, or later if the Board allows it in writing (Section 8(6) and Rule 7).
Where should I start with DPDP Act compliance?
Take the free readiness assessment to see your gaps, then map your data. Consent, rights, retention and breach response all depend on knowing what data you hold and where it flows.
Sources and how we checked
- Digital Personal Data Protection Act, 2023. Gazette of India.
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)). Gazette of India.
- Commencement notification G.S.R. 843(E), 13 November 2025. Gazette of India.
Dates, section numbers, rule numbers and penalties were read from the Gazette text. Last reviewed 18 October 2026 by Team DPDP Act India. Read our editorial policy.
Not sure where you stand?
Take the free readiness assessment for a view of your gaps, or get matched with an implementation partner who can own the delivery.
This guide is general information, not legal advice. Check the Gazette text and speak to your counsel before acting on it.