# DPDP Act 2023 full text, Rules 2025 and compliance checklist

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Free reference for India's Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and the DPDP Rules, 2025.

## At a glance

- Assent: 11 August 2023.
- Rules: notified 13 November 2025; 23 rules, 7 Schedules.
- Compliance deadline: 14 May 2027 for substantive business obligations; Consent Managers 14 November 2026; Board machinery live since 14 November 2025.
- Regulator: Data Protection Board of India; appeals to TDSAT within 60 days.
- Lawful bases: two, consent (s.6) or certain legitimate uses (s.7). No legitimate interests.
- Child: under 18 (s.2(f)). Targeted ads to children banned (s.9(3)).
- Breach: every breach to the Board and each affected person; Board report within 72 hours (Rule 7). No harm threshold (s.8(6)).
- Maximum penalty: Rs 250 crore (s.8(5) security safeguards).

## Myths and what the Act says

- Myth: We can rely on legitimate interests. The Act: There are only two lawful bases: consent (s.6) or the closed list of certain legitimate uses (s.7). Legitimate interests does not exist under the DPDP Act.
- Myth: Health and financial data are sensitive personal data. The Act: The DPDP Act has no sensitive data category at all. Sectoral law may still add duties.
- Myth: A child means anyone under 13. The Act: A child is anyone under 18 (s.2(f)), and processing needs verifiable parental consent (s.9(1)).
- Myth: We only report breaches that could cause harm. The Act: There is no harm threshold. Every breach goes to the Board and to each affected person (s.8(6)), and a ransomware lockout counts (s.2(u)).
- Myth: Every company needs a Data Protection Officer. The Act: Only notified Significant Data Fiduciaries must appoint one (s.10(2)(a)). Everyone else publishes a contact person (s.8(9)).
- Myth: Indian personal data has to stay in India. The Act: The Act does not mandate localisation. Transfers are allowed unless a country is restricted under s.16(1), though sector rules such as the RBI's still apply (s.16(2)).
- Myth: Affected users can sue us for compensation. The Act: Penalties go to the Consolidated Fund of India (s.34) and civil courts are barred (s.39). The Act gives individuals no compensation right.
- Myth: Parental consent lets us target ads at teenagers. The Act: Tracking, behavioural monitoring and targeted advertising directed at children are banned outright, consent or not (s.9(3)).

## Tools

- Readiness self-check: https://mksd0398.github.io/dpdp-act-skill/dpdp-compliance-checker/
- Free Claude Code skill that answers from this text and cites every section: https://mksd0398.github.io/dpdp-act-skill/claude-code-skill/