The Act

The DPDP Act, explainedAll 9 chapters, 44 sections, in plain language Notice · Section 5 Consent · Section 6 Security safeguards · Section 8

The Rules 2025

The DPDP Rules 2025What the notified Rules require, visually Children's data · Section 9 Data Protection Officer · Section 10

Quick reference

Glossary FAQ Editorial policy

New to DPDP?

A plain-language walkthrough of India's data protection law: what it is, and who it applies to.

Understand · Step 1: know what the law asks before you act.

How DPDP lands in your sector

Fintech & Banking Healthcare & Pharma E-commerce & Retail SaaS & Technology EdTech Manufacturing Media & Entertainment Government & PSU NGO & Non-profit GCC & Global Capability Centres

Find your sector

The Act is horizontal; the data is not. See exactly what changes for your industry.

Browse all sectors

Orient · Same law, different obligations by sector.

Implement

DPDP implementationFrom readiness to operational compliance Fintech & digital lending GCC & global centres

Services

DPDP services & partnersGet matched with a vetted partner Virtual DPO Get certified

Where to start

Readiness assessmentSee your gaps in 2 minutes Gap assessment

Ready to scope it?

Answer a few questions and get a prioritised implementation plan matched to your gaps.

Scope your implementation

Do · A report does not implement DPDP. This is the operating work.

Assess & tools

Readiness assessmentFree, 2 minutes All tools Templates Directory

Learn

Guides Blog By role Glossary News

Where do you stand?

Take the free readiness assessment and get a prioritised, plain-English view of your gaps.

Start assessment

Assess & learn · Grounded in primary sources. Every summary links to the statute.

AboutEditorial policyContactFAQ

Readiness assessment

E-commerce & Retail · D2C

The DPDP Act for D2C Brands

D2C brands live on first-party data built through ads and CRM: emails, phone numbers and purchase history.

In short

D2C brands run on first-party data. The Act governs how you collect it, market with it, and let customers take it back. Penalties reach ₹250 crore.

Core impacts

What changes for this sub-sector.

First-party data and consent

Building a first-party list is fine; using it for marketing needs clear consent and an easy opt-out.

Ad pixels and tracking

Meta and Google pixels and conversion APIs send personal data to ad platforms; consent and disclosure apply.

CRM and segmentation

Profiling for segments and lookalikes is processing; be transparent and honour objections.

Customer rights

Handle access, correction and deletion, including from your email tool and CRM, on request.

Vendors

Your email platform, CDP, reviews and support tools are processors under contract.

Minimization and retention

Keep customer data only while it serves a stated purpose.

Where to start as a D2C brand

Fix marketing consent and pixel disclosure first.

Learn

Understand the rules for your sector.

Assess

See where you stand and find gaps.

Prepare

Map data, notices and consent.

Implement

Put safeguards in place.

Monitor

Review and stay compliant.

Check your marketing stack.

The readiness check flags consent, pixel and vendor gaps.

Take the readiness check →