Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

DPDP Act Implementation Guides for Indian Businesses

Practical, source-led guides that turn the DPDP Act and Rules into controls, checklists and implementation actions.

Where should I start?
Start here

DPDP Act 2027 Compliance Roadmap

End-to-end roadmap to build your DPDP Act compliance programme before full obligations apply.

Start the roadmap → Core guide

DPDP Act Consent Management

Build consent that is valid, provable and withdrawable across all your channels and systems.

Explore the collection →Collection

DPDP Act Data Mapping

Ten guides and six free Excel worksheets: inventory, data flows, retention, consent, rights and breach mapping.

Explore the collection →Sector guide

DPDP Act Compliance for Schools

Complete 2026–27 implementation guide for Indian schools: children's data, consent, Rule 12, EdTech, CCTV, breaches and a roadmap.

Open the guide → Specialist guide

Valid Consent Under Section 6

Deep dive into the legal and practical test for valid consent under the DPDP Act.

Read the guide →How-to guide

How to Report a Personal Data Breach

Step-by-step Rule 7 breach response: notify Data Principals and the Board without delay, then file the 72-hour Board submission.

Open the guide →Checklist

DPDP Act Compliance Checklist

Everything to put in place before the DPDP obligations take full effect, in one working checklist.

Open the checklist →
Browse by implementation area

Consent & Notices

8 guides

Data Mapping

10 guides

Security & Breach Response

1 guide

Data Principal Rights

Coming soon

Processors & Vendors

Coming soon

Retention & Erasure

Coming soon

Children's Data

Coming soon

Cross-Border Transfers

Coming soon

Implementation & Governance

Hub

Try our tools

DPDP Act Compliance ChecklistWork through the major controls step by step.Open the checklist → DPDP Act Readiness AssessmentScore your organisation's DPDP Act readiness.Take assessment → Consent Notice GeneratorBuild a Section 5 consent notice to copy or download.Open the generator →

Need help implementing?

Get connected with verified partners who can own the delivery.

Find an implementation partner →
Grounded in primary sources · Plain-English implementation guidance · Reviewed regularly