DPDP Act 2023: frequently asked questions
Direct answers, each with the section or rule it rests on.
Status and deadlines
Is the DPDP Act in force?
Partly. The Act received Presidential assent on 11 August 2023, but section 1(2) permits staggered commencement. Data Protection Board machinery has been live since 14 November 2025. Consent Manager rules commence 14 November 2026. The substantive obligations on businesses, covering notice, security, breach reporting, retention, children's data and rights, commence on 14 May 2027.
Source: s.1 Commencement
What is the DPDP compliance deadline?
14 May 2027 for nearly every business obligation. That is when Rules 3, 5 to 16 and 22 to 23 commence: notice, security safeguards, breach intimation, retention and erasure, children's consent, Significant Data Fiduciary duties, rights machinery and transfers. Consent Manager registration under Rule 4 commences earlier, on 14 November 2026.
Source: Commencement
When were the DPDP Rules notified?
The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, published 14 November 2025. They contain 23 rules and 7 Schedules and commence in three tranches: 14 November 2025, 14 November 2026 and 14 May 2027.
Source: DPDP Rules 2025
When did the DPDP Act become law?
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) received Presidential assent on 11 August 2023 and was published in the Gazette of India the same day. Its provisions come into force on the dates the Central Government notifies under section 1(2).
Source: Full text
Scope
Does the DPDP Act apply to companies outside India?
Only where the processing is connected to offering goods or services to Data Principals within India, under section 3(b). Unlike the GDPR, merely monitoring the behaviour of people in India is not a trigger.
Source: s.3
Does the DPDP Act apply to paper records?
Not unless they are digitised. The Act applies to personal data collected in digital form, or collected in non-digital form and digitised subsequently, under section 3(a). Records that stay on paper are outside it.
Source: s.3
Does the DPDP Act apply to publicly available personal data?
Not to personal data that the individual herself made, or caused to be made, publicly available, or that someone was legally obliged to publish, under section 3(c)(ii). The Act's own Illustration is a person who blogs her views on social media. Purely personal or domestic processing by an individual is also outside the Act.
Source: s.3
Does the DPDP Act apply to employee data?
Yes. Employee data is personal data. Section 7(i) lets an employer process it without consent for the purposes of employment, or to safeguard the employer from loss or liability, such as preventing corporate espionage, keeping trade secrets, intellectual property and classified information confidential, or providing a service or benefit the employee seeks. Uses outside that still need consent.
Source: s.7
Do startups have to comply with the DPDP Act?
Yes, by default. Section 17(3) lets the Central Government notify Data Fiduciaries, including startups, to whom sections 5, 8(3), 8(7), 10 and 11 do not apply, but no such notification had been issued as at the last check. Even then, consent, security safeguards, breach notification and children's protections would still apply.
Source: s.17
Lawful basis, notice and consent
What lawful bases exist under the DPDP Act?
Exactly two, under section 4(1): the Data Principal's consent meeting section 6, or one of the closed list of certain legitimate uses in section 7(a) to (i). There is no legitimate interests balancing test.
What makes consent valid under the DPDP Act?
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose, under section 6(1). Pre-ticked boxes, bundled consent and consent inferred from continued use fail. Withdrawal must be as easy as giving consent (section 6(4)), and the business carries the burden of proving valid notice and consent (section 6(10)).
Source: s.6
What must a privacy notice contain under the DPDP Act?
Under section 5(1) and Rule 3, the notice must accompany or precede the consent request, stand on its own apart from other terms, and in clear and plain language give an itemised description of the personal data, the specified purpose and the specific goods, services or uses it enables, plus a link to withdraw consent, exercise rights and complain to the Data Protection Board. It must be available in English or any of the 22 Eighth Schedule languages (section 5(3)).
What is a Consent Manager under the DPDP Act?
A person registered with the Data Protection Board that acts as a single point of contact for individuals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (section 2(g)). It is accountable to the Data Principal, not to the business. Registration under Rule 4 commences on 14 November 2026 and requires a company incorporated in India.
Children
What age is a child under the DPDP Act?
Anyone who has not completed 18 years, under section 2(f). Processing a child's data requires verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright under section 9(3), which consent cannot cure.
How do you obtain verifiable parental consent under the DPDP Rules?
Rule 10 requires due diligence that the person giving consent as parent is an identifiable adult, using reliable identity and age details the business already holds, or details voluntarily provided by the individual or through a virtual token issued by an authorised entity, which includes DigiLocker. Rule 12 and the Fourth Schedule exempt specified classes and purposes; verify the Fourth Schedule before relying on one.
Source: Rules 10 and 11
Security, breaches and retention
What security safeguards does the DPDP Act require?
Reasonable security safeguards to prevent a personal data breach, under section 8(5). Rule 6 sets the minimum: encryption, obfuscation, masking or tokenisation; access controls; logging, monitoring and review; backups and continuity measures; one-year retention of logs; security clauses in processor contracts; and organisational measures. Failure carries the highest penalty ceiling in the Act, Rs 250 crore.
How fast must we report a data breach under the DPDP Act?
Affected individuals must be told without delay under Rule 7(1). The Data Protection Board gets an initial intimation without delay, then a detailed report within 72 hours of you becoming aware, under Rule 7(2). There is no harm or materiality threshold, so every personal data breach is reportable, including loss of access, which brings ransomware into scope.
How long can personal data be retained under the DPDP Act?
Until consent is withdrawn or the specified purpose is no longer served, whichever is earlier, unless a law requires retention (section 8(7)). For large e-commerce entities, online gaming intermediaries and social media intermediaries, the Third Schedule deems the purpose expired three years after the user last engaged, with 48 hours' notice before erasure (Rule 8). Rule 8(3) separately requires keeping associated logs for at least one year.
Do we need a Data Protection Officer in India?
Only if you are notified as a Significant Data Fiduciary. That DPO must be based in India, be an individual, and be responsible to the board of directors or similar governing body, under section 10(2)(a). Every other Data Fiduciary need only publish the business contact information of a person who can answer questions about processing, under section 8(9) and Rule 9.
Who is a Significant Data Fiduciary?
Only an entity that the Central Government has notified as one under section 10(1). You cannot self-classify, and size alone does not make you one. The Government assesses factors including volume and sensitivity of data, risk to Data Principal rights, sovereignty, risk to electoral democracy, security of the State and public order.
Rights of individuals
What rights do individuals have under the DPDP Act?
Four: access to information about their personal data (section 11); correction, completion, updating and erasure (section 12); grievance redressal (section 13); and nomination of someone to exercise their rights on death or incapacity (section 14). There is no right to data portability, no general right to object, and no right against automated decision-making.
Is there a right to be forgotten under the DPDP Act?
There is a right to erasure rather than a broad right to be forgotten. Under section 12(3) a business must erase personal data on request unless retention is necessary for the specified purpose or for compliance with law.
Source: s.12
Can individuals claim compensation under the DPDP Act?
No. Penalties imposed by the Board are credited to the Consolidated Fund of India under section 34, civil courts are barred from matters the Board is empowered over under section 39, and the old IT Act section 43A compensation route was repealed.
Transfers and localisation
Does the DPDP Act require data localisation?
No, not in the Act itself. Section 16 is a negative list: the Central Government may notify countries to which transfer is restricted, and none has been notified. Rule 13(4) creates a targeted localisation duty for notified Significant Data Fiduciaries only, over categories the Government specifies on a committee's recommendation. Sectoral regulators such as the RBI localise independently, preserved by section 16(2).
Can personal data be transferred outside India under the DPDP Act?
Yes, by default. Section 16(1) only lets the Central Government restrict transfers to notified countries, and none has been notified. Rule 15 adds requirements the Government may specify for making data available to a foreign State or its agencies. Stricter sectoral rules, such as RBI payment-data storage, still bind under section 16(2).
Enforcement and penalties
What is the maximum penalty under the DPDP Act?
Rs 250 crore, for failing to take reasonable security safeguards under section 8(5). Failure to notify a breach and breaches of children's data obligations each carry up to Rs 200 crore, Significant Data Fiduciary breaches up to Rs 150 crore, and any other breach up to Rs 50 crore. All figures are ceilings, not tariffs.
Who enforces the DPDP Act?
The Data Protection Board of India, established under section 18. It inquires into breaches, imposes penalties and can accept voluntary undertakings, but it has no rule-making power: the Central Government makes the Rules. Appeals go to TDSAT within 60 days under section 29, and onward to the Supreme Court.
Is there criminal liability under the DPDP Act?
No. The DPDP Act creates no criminal offences and no imprisonment. Penalties are civil and monetary, imposed by the Data Protection Board.
Source: Penalties
Does the DPDP Act have a sensitive personal data category?
No. Unlike the GDPR and unlike the earlier SPDI Rules, the DPDP Act creates no special category. Health, biometric, financial and caste data receive no additional treatment under this Act, although sectoral law may still impose extra duties.
Source: Glossary
Are the SPDI Rules 2011 still valid?
Their footing is materially undermined. Section 44(2) of the DPDP Act omitted both section 43A of the IT Act, which the SPDI Rules implemented, and section 87(2)(ob), the rule-making power behind them. Do not cite them as unqualified live obligations.
Source: s.44
What did the DPDP Act change in the RTI Act?
Section 44(3) replaced section 8(1)(j) of the Right to Information Act, 2005 with a flat exemption for information which relates to personal information, removing the earlier public-interest override.
Source: s.44
What are the main differences between the DPDP Act and the GDPR?
The DPDP Act has no legitimate interests ground, no sensitive data category, a child age of 18, an outright ban on targeted advertising to children, breach notification with no harm threshold, no portability or automated-decision rights, no compensation for individuals, and enforceable duties on individuals themselves.
Source: DPDP vs GDPR
Last updated . Report an error.