Pillar guide
DPDPA compliance in India: what you have to do, and by when
India's data protection law is no longer a draft. The Rules were notified in November 2025, the clock is running and the main duties apply from 13 May 2027. This guide sets out what the law asks, what ignoring it can cost, what the breach data says about where the risk really sits, and how organisations are preparing.
Executive summary
The Digital Personal Data Protection Act, 2023 and the 2025 Rules apply to every organisation that processes digital personal data of people in India, with no size threshold.
- The deadline is real and close. Most duties, and the penalty provisions, apply from 13 May 2027.
- Security is where the money is. The largest penalty tier, up to ₹250 crore, is for failing to keep reasonable security safeguards.
- The risk sits with people and suppliers. In India, phishing and third-party compromise are the top two ways breaches begin.
- Evidence is the difference. The Board is told to weigh what you did to prevent and limit harm. A documented programme counts for more than good intentions.
01What the Act is, in plain words
The Digital Personal Data Protection Act, 2023 (DPDPA, also written the DPDP Act) says that if you collect or use digital personal data about people in India, you must tell them why, ask them properly, look after the data, and let them see it, correct it or ask you to delete it. The Digital Personal Data Protection Rules, 2025 are the rulebook that turns those promises into steps you can follow and an auditor can check.
It applies whether you are a bank, a hospital, an online shop or a ten-person start-up. It also applies to companies outside India that offer goods or services to people in India. Purely offline records fall outside it until they are digitised.
| Term in the law | What it means for you |
|---|---|
| Data Fiduciary | Your organisation, when you decide why and how personal data is used. Most duties land here. |
| Data Principal | The person the data is about: a customer, patient, employee or visitor. For a child, their parent or guardian. |
| Data Processor | A vendor handling data on your behalf, such as a payroll provider, cloud host or marketing agency. You stay responsible for what they do. |
| Consent Manager | A registered, India-based intermediary that lets people give, manage and withdraw consent in one place. |
| Significant Data Fiduciary | A larger or riskier fiduciary the Government notifies. It carries extra duties: an India-based data protection officer, an independent audit and yearly impact assessments. |
| Data Protection Board | The digital regulator that hears complaints and decides penalties. |
Source: Source: Digital Personal Data Protection Act, 2023.
02When it applies
The law was passed in 2023 but bites in stages. The Rules were notified in November 2025 with an 18-month runway for most duties. Count forward and you get the date to plan against: 13 May 2027.
- Nov 2025Rules 1, 2 and 17–21 take effect. The Data Protection Board begins to exist.
- 13 Nov 2026Rule 4 starts: consent managers can register with the Board.
- 13 May 2027Rules 3, 5–16, 22 and 23 start: notice, consent, safeguards, breach reporting, rights, children and the rest. 188 days from today.
Source: Digital Personal Data Protection Rules, 2025 (Gazette G.S.R. 846(E)), as summarised by S.S. Rana & Co. and SCC Online.
Eighteen months sounds generous until you list what has to change: notices, consent screens, vendor contracts, data inventory, breach plans and retention rules. Most organisations underestimate the data inventory alone. If you plan to use a Consent Manager, note that their rules start on 13 November 2026, so that market will only just be forming when your own deadline approaches.
03What the law asks of you
Strip away the legal wording and there are ten things to get right.
- 1NoticeSay what, why, how to withdraw and complain
- 2ConsentFree, specific, informed, a clear action
- 3Use for the purposeOnly what that purpose needs
- 4Protect and shareSafeguards; processors under contract
- 5Retain and eraseDelete when done; keep logs one year
- Give a proper notice. Before or when you ask for consent, say what data you want, why, how to withdraw, how to complain and how to reach the Board. In plain language, in English or any of the 22 languages of the Eighth Schedule.
- Get consent that means something. Free, specific, informed, unconditional and unambiguous, given by a clear action. Withdrawing must be as easy as giving it. A pre-ticked box does not count.
- Use data only for the stated purpose. Collect what that purpose needs and no more. The Act also lists “legitimate uses” where consent is not needed, such as a person voluntarily giving data for a specific purpose, or a medical emergency.
- Protect it. The Rules set a minimum: encryption or similar protection, access controls, logging and monitoring, backups, and a contract with every processor. This is the failure that carries the highest penalty.
- Report breaches to two audiences. Tell each affected person without delay and tell the Board without delay, followed by a detailed report within 72 hours. Every personal data breach counts, not only large ones.
- Delete data when its job is done. When the purpose is served or consent is withdrawn, erase it unless a law says you must keep it. There is a catch: keep processing logs and related traffic data for at least one year.
- Honour people's rights. A summary of their data, correction and erasure, grievance redressal and the right to nominate someone. Publish how to ask, and reply within the Rules' outer limit of 90 days.
- Handle children's data with care. Verifiable consent from a parent or guardian, and no tracking, behavioural monitoring or targeted advertising aimed at children. The Rules list narrow exemptions, for example health, education and safety.
- Control your vendors. You answer for your processors. Put data protection terms in the contract and know where your data goes.
- Name a contact. Publish the details of someone who can answer questions. Significant Data Fiduciaries must appoint a Data Protection Officer based in India.
Sending data abroad is generally permitted, except to countries the Government restricts. Significant Data Fiduciaries face tighter limits, including on certain traffic data.
How to read it. These run in parallel, not one after another. Teams that rehearse the first six hours usually meet the 72-hour report without drama. Teams that start the conversation on day two do not. Sector regulators such as the RBI and SEBI add their own reporting rules; check the current circular for your sector.
Source: CERT-In directions of 28 April 2022 under section 70B of the IT Act (6-hour reporting); DPDPA Rules 2025 as summarised by S.S. Rana & Co..
04What getting it wrong costs
Fines are the headline, and they are large because they are meant to change behaviour.
How to read it. Security safeguards sit at the top. A company that gets the basics of protection wrong faces the largest exposure, ahead of failing to report. “Up to” means the Board sets the amount case by case.
Source: Press Information Bureau summary of the DPDPA Rules. The Act's Schedule also sets ₹10,000 for a Data Principal who breaches their own duties, such as filing a false complaint. 1 crore = 10 million.
The Board does not simply pick the biggest number. The Act directs it to weigh the nature, seriousness and length of the failure, the kind of data, whether it has happened before, what you did to limit the damage, and whether the penalty is proportionate. A company that can show a sensible programme, honest reporting and fast fixes is in a very different position from one that did nothing.
What usually hurts more is the breach itself. IBM's yearly study puts the average cost of a breach to an Indian organisation at ₹22 crore in 2025, a record for India, and Indian organisations took longer than the global average to find and contain one.
How to read it. The national average rose 13% in a year to a record. Research and transport organisations paid roughly 30% more than average (₹289 m and ₹288 m against ₹220 m).
Source: IBM Cost of a Data Breach Report 2025, India edition (press release, 7 August 2025). ₹220 million = ₹22 crore.
How to read it. Indian organisations take about three weeks longer than the global average. In IBM's global data, organisations making extensive use of security AI and automation contained breaches 80 days faster and saved about US$1.9 million. The 72-hour reporting clock starts when you become aware, not when you finish investigating.
Source: IBM India 2025 (263 days); IBM global 2025 via Help Net Security (241 days; extensive use of security AI and automation shortened breaches by 80 days and cut costs by about US$1.9 million, compared with organisations using none).
05Where the risk really sits
If the law's biggest penalty is for weak security, the useful question is where breaches actually start. Three independent datasets give a consistent answer.
How to read it. The first two are about people and suppliers. Neither is fixed by buying another firewall. Together with a third of breaches, they point the same way the DPDPA duties do: control your vendors, train your people, patch your systems.
Source: IBM Cost of a Data Breach Report 2025, India. The three most common vectors; other causes make up the rest.
How to read it. Almost one breach in three now involves a supplier or partner, up from one in seven. Your vendors' security is part of your security, and under the DPDPA it is part of your legal duty.
Source: Verizon 2025 Data Breach Investigations Report, executive summary: 22,052 incidents and 12,195 confirmed breaches from 139 countries. The human element was involved in roughly 60% of breaches.
How to read it. After a flat 2022, incidents rose 14% in 2023 and 28% in 2024. Over two years that is 46.7% more incidents. Part of that is better reporting, which is itself a sign that the CERT-In reporting rules are working.
Source: Ministry of Electronics & IT reply in the Rajya Sabha, via PIB, 28 March 2025 (2022–2024); CERT-In Annual Report 2022 (2021).
- Vulnerable services8,75,892 (62.9%)
- Network scanning and probing3,24,620 (23.3%)
- Virus or malicious code1,61,757 (11.6%)
- Website defacement19,793 (1.4%)
- Others (DDoS, data breaches, ransomware)5,517 (0.4%)
- Website intrusion and malware spread2,164 (0.2%)
- Phishing1,714 (0.1%)
How to read it. Most reported incidents are automated: exposed services and scanning. The costly breaches, the ones that start with a phishing email or a supplier, are a tiny fraction of the count but most of the loss. Counts and cost measure different things, and a risk register needs both.
Source: CERT-In Annual Report 2022, as reported by MediaNama. Categories sum to the stated total.
What the data adds up to. The volume of incidents in India is rising fast (up 47% in two years), but most of what gets reported is automated: exposed services and scanning. The breaches that cost money tend to start with a phishing email or a supplier, and globally the supplier route has doubled to 30% of breaches in a year. If you are prioritising effort, put people and vendors first, then patching and exposure.
06Where organisations get stuck
Almost nobody fails because they do not care. They stall at the same few places.
- Nobody can say where the personal data is. It sits in the main system, and also in old exports, shared drives, WhatsApp groups, a vendor portal and a spreadsheet the sales team keeps. You cannot protect, delete or report what you have not found.
- Consent was collected years ago in a way that no longer qualifies. A “by using this site you agree” line will not meet the new test. Old data may need fresh consent, or a basis you can defend.
- Retention and deletion collide. The law says delete when the purpose ends and also keep logs for a year. Different datasets need different rules, written down and applied.
- Vendors are a black box. Contracts predate the law and say nothing about breach notice, deletion or sub-processors.
- No evidence. The team did the work but cannot show it. When the Board or an enterprise customer asks, “we think so” is not an answer. Dated, owned, retrievable records are.
How to read it. Exposure follows the penalty tiers in the Schedule to the Act (security safeguards ₹250 cr, breach reporting and children ₹200 cr, everything else ₹50 cr). Effort is our judgement from delivery experience and will differ for you. Use it to sequence work, not to skip anything.
07A realistic 90-day plan
This is not the only way, but it is a sequence that works for most mid-sized organisations. It front-loads discovery, because everything else depends on it.
- Name an owner and a board sponsor
- List every system and vendor that holds personal data
- Mark what is sensitive, what is children's data, what leaves India
- Run a readiness check to see the gaps
- Rewrite notices and consent screens in plain language
- Set retention and deletion rules per dataset
- Sign data protection terms with each processor
- Write the breach runbook with a 72-hour clock
- Switch on rights requests and grievance handling with due dates
- Rehearse a breach with the people who would respond
- Collect evidence in one place
- Brief the board on what is done and what is left
Ninety days will not make you perfect. It takes you from “we are exposed” to “we know our gaps, we have owners and we can show our work”, which is the position you want on 13 May 2027. The DPDPA Readiness Playbook turns this into templates and a 12-point checklist.
Six questions on consent, rights, breach readiness and vendors. No sign-up needed to see the result.
?Frequently asked questions
Does the DPDPA apply to small businesses?
What is the DPDPA compliance deadline?
What is the penalty under the DPDPA?
Is the DPDPA the same as GDPR?
Do I need a Data Protection Officer?
Do I have to report every data breach?
§Sources
- Digital Personal Data Protection Rules, 2025 notified (Press Information Bureau)
- DPDPA Rules 2025: commencement and key changes (S.S. Rana & Co.)
- DPDPA Rules 2025: key highlights (SCC Online)
- Cost of a Data Breach Report 2025, India (IBM)
- Cost of a Data Breach Report 2025, global (IBM, via Help Net Security)
- 2025 Data Breach Investigations Report, executive summary (Verizon)
- Cyber security incidents 2022 to 2024 (Ministry of Electronics & IT via PIB)
- CERT-In Annual Report 2022 (via MediaNama)
Figures are quoted from the sources above and were checked on 6 November 2026. Laws and rules change; confirm the current text before relying on any of it. This is general information, not legal advice. Illustrative exhibits are marked as such.
Keep reading
DPDPA compliance checklist: 25 things to check before 13 May 2027
Work through the checklist, tick what you can honestly evidence, and see how ready you are.
6 min read →AnalysisDPDPA penalties explained: what is at stake and how the Board decides
The headline figure is ₹250 crore.
7 min read →ComparisonDPDPA vs GDPR: the differences that matter in practice
If you already comply with the GDPR, you have a head start on the DPDPA, but not a finish.
8 min read →Playbook · PDFThe DPDPA Readiness Playbook
From "where is our data?" to "here is our evidence" in 90 days. A working document for the people who will do the job.
Free download · 8 pages →