Disclaimer: this is not legal advice

Read this before relying on anything in this repository or on the accompanying website at https://mksd0398.github.io/dpdp-act-skill/

1. Not legal advice

This repository, the dpdp-analyze skill, the reference documents, the commentary and the website are provided for general information, education and compliance-reference purposes only.

They are not legal advice. They are not a substitute for advice from a qualified lawyer who has considered your specific facts, your sector, your data flows and your contractual position.

2. No lawyer-client relationship

No lawyer-client relationship, no advocate-client relationship, and no professional or fiduciary relationship of any kind is created by:

• viewing, cloning, forking or using this repository;
• installing or running the dpdp-analyze skill;
• reading the website;
• opening an issue or pull request, or receiving a reply to one.

Do not send confidential or privileged information through GitHub issues, pull requests or any other channel associated with this project. Anything you post publicly is public, is not privileged, and cannot be treated as confidential.

3. The author is not a lawyer

The author is not an advocate enrolled with any Bar Council, is not a lawyer, and is not authorised to practise law in India or in any other jurisdiction. Nothing in this repository is offered as, or should be construed as, the practice of law or a solicitation to provide legal services.

4. Machine-generated output can be wrong

The dpdp-analyze skill is a prompt and reference pack for a large language model. Its output is machine-generated. Large language models can and do:

• state provisions that do not exist;
• misattribute a requirement to the wrong section or rule;
• carry over concepts from other regimes such as the GDPR that have no equivalent in Indian law;
• miss facts that are decisive in your particular case.

Every statutory citation in any output must be independently verified before you rely on it. Treat the skill's findings as a starting hypothesis for a professional to check, never as a conclusion.

5. Accuracy and provenance of the text

• The Act text in skills/dpdp-analyze/references/act-full-text.md is reproduced from the Gazette of India, Extraordinary, Part II, Section 1, No. 25, dated 11 August 2023 (CG-DL-E-12082023-248045). It is believed to be accurate and complete, but no warranty of accuracy is given, and transcription errors are possible.
• The Rules content in skills/dpdp-analyze/references/rules-2025.md was assembled from the PIB release and cross-checked secondary sources, not transcribed from the Gazette. It is working knowledge, not a primary source. Verify it against the notified Gazette text before relying on it for any purpose.
• The commentary in doctrine.md, compliance-checklist.md and the website's explanatory pages is the author's interpretation. Reasonable practitioners may disagree with it.

The authoritative text of any Indian statute or rule is the version published in the Gazette of India. Where anything here differs from the Gazette, the Gazette prevails.

6. The law is unsettled and still commencing

The DPDP framework is being brought into force in stages, and important pieces are still missing:

• Substantive obligations on businesses do not commence until 14 May 2027.
• No Significant Data Fiduciary has been notified under section 10(1).
• No country has been restricted under section 16(1).
• No startup relief has been notified under section 17(3).
• The word "significant" in section 33(1), which gates every penalty, is undefined.
• There is no Data Protection Board jurisprudence at all.

Nothing here can predict how the Board or the courts will interpret the Act. Any statement about likely enforcement outcomes is speculation, and penalty figures quoted are statutory ceilings, not predictions.

7. No jurisdiction beyond India, and no sectoral coverage

This resource addresses the DPDP Act, 2023 and the DPDP Rules, 2025 only. It does not cover:

• sectoral regulation that may impose stricter duties on you, including RBI, IRDAI, SEBI, TRAI, CERT-In and UIDAI requirements;
• other Indian laws affecting personal data, including the Information Technology Act, 2000, the Telecommunications Act, 2023 and contract, employment and consumer law;
• the GDPR or any other non-Indian data protection regime, beyond high-level comparison offered for orientation only.

8. No warranty and no liability

This material is provided "as is" and "as available", without warranty of any kind, express or implied, including without limitation any warranty of accuracy, completeness, currency, merchantability or fitness for a particular purpose.

To the fullest extent permitted by law, the author shall not be liable for any direct, indirect, incidental, consequential, special or exemplary loss or damage, including without limitation regulatory penalties, loss of profit, loss of data, business interruption or reputational harm, arising out of or in connection with the use of, or reliance on, this repository, the skill, the website or any output produced by them, whether in contract, tort, statute or otherwise, and whether or not the author was advised of the possibility of such loss.

9. No endorsement

This project is not affiliated with, endorsed by, or connected to the Government of India, the Ministry of Electronics and Information Technology, the Data Protection Board of India, or any regulatory authority. It is not affiliated with or endorsed by Anthropic.

10. What you should actually do

If you need to know your obligations under the DPDP Act:

1. Read the statutory text, and verify it against the Gazette of India.
2. Check the current commencement notifications, because staggered commencement means an obligation may not yet be live.
3. Check whether a sectoral regulator imposes stricter requirements on you.
4. Engage qualified Indian legal counsel on your specific facts.

Use this repository to prepare for that conversation, not to replace it.