⚖ DPDP Act 2023 Reference

202 days until the DPDP Rules fully commence

Get ready for India’s DPDP Act.

The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, verbatim and section by section. Check your readiness in three minutes, then ask an AI that cites the section for every answer.

Check your readiness Get the free AI skill

Free and open source · nothing you type leaves your browser · not legal advice

Countdown to 14 May 2027

202days
00hours
00mins
00secs

When notice, consent, security, breach reporting, retention, children’s data and rights all become enforceable.

See the commencement dates
44sections of the Act, verbatim from the Gazette
23Rules and 7 Schedules, with their commencement dates
78compliance checks, each anchored to a section or rule
Rs 250 crhighest penalty ceiling, for security failures

Readiness self-check

How ready is your organisation?

Short questions drawn from the 78-point checklist. Your score, your gaps ranked by the penalty ceiling behind them, and the section or rule for each. Nothing you answer leaves this page.

Free readiness self-check

How ready are you for 14 May 2027?

Answer up to 22 quick questions about your organisation. You get a readiness score, your gaps ranked by the penalty ceiling behind them, and the section or rule behind every one.

  • About 3 minutes
  • Answers never leave your browser
  • Every question cites the law

Commencement

When does the DPDP Act come into force?

In three tranches. 14 May 2027 is the date that matters for a compliance programme.

  1. 14 Nov 2025Board machineryRules 1, 2 and 17 to 21. The Data Protection Board can be constituted.
  2. 14 May 2027Everything elseRules 3, 5 to 16, 22 and 23: notice, security, breach reporting, retention, children, SDF duties, rights and transfers.

The AI skill

Ask AI about the DPDP Act. Get the section number back.

General-purpose AI answers Indian privacy questions with GDPR concepts the DPDP Act does not contain. The free dpdp-analyze skill for Claude Code pins the verbatim Act and Rules, so every answer is anchored.

  • Quotes only the verbatim Gazette text
  • Cites a section or rule for every claim
  • Checks commencement before calling anything binding
  • Reviews notices, consent flows, contracts and codebases
/plugin marketplace add mksd0398/dpdp-act-skill
/plugin install dpdp-analyze@dpdp

See what it can do Also runs in Claude.ai, Copilot, Gemini CLI and Codex.

claude

Do we need a DPO in India?

Using skill: dpdp-analyze

No, unless the Central Government has notified you as a Significant Data Fiduciary.

Only SDFs must appoint a DPO, based in India and responsible to the board s.10(2)(a).

Everyone else publishes a contact person who can answer questions s.8(9) Rule 9.

Trap: size alone does not make you an SDF s.10(1).

Not legal advice. Verify against the Gazette of India and consult qualified Indian legal counsel.

Myth vs the Act

What most people, and most AI tools, get wrong

Tap a card to see what the statute actually says.

Myth

“We can rely on legitimate interests.”

What the Act says

There are only two lawful bases: consent (s.6) or the closed list of certain legitimate uses (s.7). Legitimate interests does not exist under the DPDP Act.

Myth

“Health and financial data are sensitive personal data.”

What the Act says

The DPDP Act has no sensitive data category at all. Sectoral law may still add duties.

Myth

“A child means anyone under 13.”

What the Act says

A child is anyone under 18 (s.2(f)), and processing needs verifiable parental consent (s.9(1)).

Myth

“We only report breaches that could cause harm.”

What the Act says

There is no harm threshold. Every breach goes to the Board and to each affected person (s.8(6)), and a ransomware lockout counts (s.2(u)).

Myth

“Every company needs a Data Protection Officer.”

What the Act says

Only notified Significant Data Fiduciaries must appoint one (s.10(2)(a)). Everyone else publishes a contact person (s.8(9)).

Myth

“Indian personal data has to stay in India.”

What the Act says

The Act does not mandate localisation. Transfers are allowed unless a country is restricted under s.16(1), though sector rules such as the RBI's still apply (s.16(2)).

Myth

“Affected users can sue us for compensation.”

What the Act says

Penalties go to the Consolidated Fund of India (s.34) and civil courts are barred (s.39). The Act gives individuals no compensation right.

Myth

“Parental consent lets us target ads at teenagers.”

What the Act says

Tracking, behavioural monitoring and targeted advertising directed at children are banned outright, consent or not (s.9(3)).

The reference

Everything in one place

The Act, section by section

All 44 sections and 9 chapters, verbatim, with every Illustration.

The Rules, 2025

23 rules, 7 schedules and the three commencement dates.

The Act explained

The five gates, consent, exemptions, enforcement and 16 traps.

Compliance checklist

78 checks, every one anchored to a section or rule.

Penalties

The full Schedule, up to Rs 250 crore, and how the Board decides.

DPDP vs GDPR

The 17 differences that change what you build.

Glossary

Data Fiduciary, Data Principal and every defined term.

FAQ

32 direct answers: deadline, DPO, consent, breaches, transfers.

The DPDP Act at a glance

Full name
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
Assent
11 August 2023
Rules
DPDP Rules, 2025, notified 13 November 2025: 23 rules, 7 Schedules
Deadline
14 May 2027 for substantive business obligations
Regulator
Data Protection Board of India; appeals to TDSAT
Lawful bases
Two: consent (s.6) or certain legitimate uses (s.7)
Child
Anyone under 18 (s.2(f))
Breaches
Every breach, to the Board and each affected person; Board report within 72 hours (Rule 7)
Max penalty
Rs 250 crore, for security failures (s.8(5))

Popular questions

All 32 questions →

Two ways to start

Find your gaps in three minutes, or let Claude audit your product against the actual sections.

Run the self-check Install the AI skill

Last updated . Report an error.