The Act is being brought into force in stages. Most operational duties described below are scheduled for 13 May 2027, calculated from the Gazette publication date. The explanations describe the notified framework; they do not imply that every duty is already enforceable.
This is a dated educational guide, not legal advice or a compliance determination. Check later official instruments and your organisation’s circumstances.
One framework. A phased start.
The DPDP Act governs processing of digital personal data within its statutory scope. Personal data is information about an individual who can be identified by or in relation to it. The Act sets the legal framework; the Rules provide operational detail.
13 November 2025
Definitions, institutional provisions and specified other sections commenced. Rules 1, 2 and 17–21 also commenced. Commencement of the Board-related provisions does not by itself confirm appointments or operational readiness.
13 November 2026
Section 6(9), section 27(1)(d) and Rule 4 form the Consent Manager phase. This is not a promise that a registration portal will open on that date.
13 May 2027
Most operational Data Fiduciary duties, individual rights, inquiry and penalty provisions, and Rules 3, 5–16, 22–23 are in the eighteen-month phase.
See the exact provision groups and date basis
First phase: Act section 1(2), section 2, sections 18–26, 35, 38–43 and section 44(1) and (3).
One-year phase: section 6(9) and section 27(1)(d).
Eighteen-month phase: sections 3–5, section 6(1)–(8) and (10), sections 7–17, the rest of section 27, sections 28–34, 36–37 and section 44(2).
The two future dates are calculated from the printed Gazette date of 13 November 2025 plus one year or eighteen months. The notification states periods rather than those calendar dates. Rule 1 sets the corresponding Rules phases; read it with the December 2025 corrigendum. Later operative instruments take precedence.
Start with the processing, not the label.
Digital personal data
Section 3 covers processing in India where data is collected digitally, or collected in non-digital form and subsequently digitised. It also covers processing outside India connected with offering goods or services to Data Principals within India.
Specific exclusions
Personal or domestic processing by an individual is excluded. So is data made publicly available by the individual concerned, or by another person under a legal obligation to make it public. Finding information online is not, by itself, enough to establish this exclusion.
Being a startup, small business, university or not-for-profit institution does not automatically remove an activity from scope. Identify the processing purpose, organisational role and any applicable section 17 exemption.
Act: sections 3 and 17Know who is responsible.
Data Principal
The individual to whom the data relates. The statutory definition includes the parent or lawful guardian in the relevant child or disability circumstances.
Data Fiduciary
The person who determines the purpose and means of processing, alone or jointly. Accountability is not transferred away simply by outsourcing processing.
Data Processor
A person who processes data on behalf of a Data Fiduciary. One organisation may have different roles for different activities.
Consent Manager
A person registered with the Board who enables individuals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. A consent banner alone does not establish this status.
Significant Data Fiduciary
A Data Fiduciary or class designated by Central Government notification under section 10. A business cannot infer this legal status from its size or a calculator score.
Data Protection Board
The statutory body established under the Act. Its inquiry, direction and penalty functions must be read with the phased commencement provisions.
Translate duties into working processes.
These summaries describe the operational framework scheduled for the eighteen-month phase, subject to applicability and exemptions. Expand a topic to separate the legal requirement from a practical implementation suggestion.
01Lawful purpose and processing basis
Sections 4, 6 and 7
Legal framework · operational phaseProcessing needs a lawful purpose and either consent or an applicable “certain legitimate use” under section 7. The latter is a defined list, not a general business-interest exception.
Map each processing purpose to its legal basis and keep the reasoning with your data inventory.
02Notices and consent journeys
Sections 5–6 · Rule 3
Legal framework · operational phaseWhere consent is sought, the notice and request must meet the statutory requirements. Consent must be free, specific, informed, unconditional and unambiguous, with clear affirmative action. Withdrawal must be as easy as giving consent.
Test what the person sees, accepts and can withdraw. Keep the notice version and consent evidence.
03Processor engagement and accuracy
Section 8(1)–(3)
Legal framework · operational phaseThe Fiduciary remains responsible for processing on its behalf. Section 8(2) requires a valid contract for the described processor engagement related to offering goods or services. Completeness, accuracy and consistency are required where data is likely to inform a decision affecting the person or be disclosed to another Fiduciary.
Record vendor roles and contracts, and check data quality at the points where decisions or disclosures occur.
04Reasonable security safeguards
Section 8(4)–(5) · Rule 6
Legal framework · operational phaseThe framework requires appropriate technical and organisational measures and reasonable security safeguards. Rule 6 addresses data protection measures, access controls, monitoring, continuity, logs and processor-contract provisions.
Assign control owners and collect evidence that access, protection, detection and recovery arrangements operate.
05Breach notification
Section 8(6) · Rule 7
Legal framework · operational phaseOn becoming aware of a personal data breach, notify affected people and give the Board initial information without delay. Detailed information goes to the Board within 72 hours of awareness, unless it allows a longer period on a written request. The 72-hour window does not replace initial notification without delay.
Practise escalation, preserve evidence and prepare separate Board and affected-person communications.
06Retention and erasure
Section 8(7)–(8) · Rule 8
Legal framework · operational phaseErasure on withdrawal or when the purpose is no longer served must be read with legally required retention. Rule 8 contains specified inactivity periods and a separate minimum one-year retention requirement for personal data and processing logs for Seventh Schedule purposes, followed by erasure unless further retention is legally required or notified.
Reconcile purpose-based deletion with applicable retention duties. Avoid promising immediate or universal deletion.
07Contact, rights and grievances
Section 8(9)–(10), sections 11–14 · Rules 9 and 14
Legal framework · operational phasePublish the business contact information of the DPO, if applicable, or another person able to answer processing questions. Provide the required rights routes and an effective grievance mechanism. Rule 14(3) addresses a published reasonable grievance-response period not exceeding 90 days.
Define request ownership, identity checks, response records and escalation. Do not apply the grievance limit indiscriminately to every right.
Make individual rights usable.
Access
A summary of data and processing activities, and specified information about sharing, within section 11’s scope and exceptions.
Correction & erasure
Correction, completion, updating and erasure under section 12, including its consent-based scope and lawful-retention exceptions.
Grievance redressal
An accessible route to raise concerns. The person must exhaust that opportunity before approaching the Board under section 13.
Nomination
A route to nominate another individual to exercise rights in the event of death or incapacity, under section 14.
Sections 11 and 12 are not unconditional rights against every organisation: their wording refers to previously given consent, including the situation in section 7(a). Applicability and exemptions still matter. Consent withdrawal is separately addressed in section 6.
Section 15 covers matters such as not impersonating another person, not suppressing material information in specified circumstances, avoiding false or frivolous complaints and providing verifiably authentic information for correction or erasure.
Additional care for children and guardians.
A child is an individual under 18. Section 9 addresses verifiable parental consent, processing likely to harm a child’s well-being, tracking or behavioural monitoring of children, and targeted advertising directed at children.
The restrictions must be read with their exact exceptions. Section 9(4), Rule 12 and the Fourth Schedule provide conditional relief for specified classes or purposes from section 9(1) and (3). Section 9(5) also permits notification-based relief. A school or healthcare label is not a blanket exemption, and section 9(2)’s detrimental-effect prohibition is distinct.
Where a person with disability has a lawful guardian, section 9(1) and Rule 11 address verifiable guardian consent and due diligence on the guardian’s appointment. Disability alone should not be treated as proof that a person lacks legal capacity.
Map child and guardian-related journeys, verify applicable consent arrangements and document the precise conditions of any exemption relied on.
Read section 9(1) with the October 2026 Removal of Difficulties Order, which corrects its wording.
Act: sections 2(f) and 9 Rules: rules 10–12 and Fourth Schedule S.O. 5458(E)Additional duties follow designation.
Central Government notification determines SDF status under section 10. Relevant factors include data volume and sensitivity, risks to individuals and specified public-interest considerations.
- An India-based DPO who represents the SDF and is responsible to its Board of Directors or equivalent governing body.
- An independent data auditor and periodic data protection impact assessments and data audits.
- Additional measures under Rule 13, including an annual DPIA and audit cycle, algorithmic due diligence and notification-dependent restrictions on specified data transfers.
The October 2026 Order clarifies “data audit” in section 10(2)(c)(ii). This guide does not establish whether any particular organisation has been designated.
Act: section 10 Rules: rule 13 S.O. 5458(E)Check the conditions behind the exception.
Cross-border processing
Section 16 enables notified restrictions. Rule 15 makes transfers subject to requirements specified by general or special order concerning availability of data to foreign States or related entities. Rule 13(4) contains an additional SDF mechanism for specified data and traffic data.
Other applicable laws offering a higher degree of protection or restriction remain relevant. Overseas hosting alone does not establish a DPDP breach, and this guide does not supply a restricted-country list.
Purpose-specific relief
Section 17 contains different exemptions with different effects. Some relieve only specified duties; others depend on an operative notification or prescribed safeguards.
For research, archiving or statistics, section 17(2)(b) includes a condition against using the data to take decisions specific to an individual; Rule 16 and the Second Schedule add standards. Startup relief under section 17(3) is notification-dependent.
Know the ceilings. Understand the process.
Once section 33 commences, the Board may impose a monetary penalty after inquiry, a determination that a breach is significant, and an opportunity to be heard. The Act’s Schedule sets ceilings, not automatic charges.
| Category | Section | Maximum specified |
|---|---|---|
| Reasonable security safeguards | 8(5) | ₹250 crore |
| Breach notification | 8(6) | ₹200 crore |
| Additional obligations relating to children | 9 | ₹200 crore |
| Significant Data Fiduciary obligations | 10 | ₹150 crore |
| Data Principal duties | 15 | ₹10,000 |
| Breach of a Board-accepted voluntary undertaking | 32 | Ceiling applicable to the underlying breach |
| Other provisions of the Act or Rules | Residual entry | ₹50 crore |
Section 33(2) requires consideration of the breach’s nature, gravity and duration; the data involved; repetition; gain or avoided loss; mitigation; proportionality and deterrence; and the likely impact on the person. Adding all ceilings together does not establish a statutory overall maximum for an organisation.
Explore DPDP RiskIQ
Review self-reported readiness gaps and hypothetical penalty scenarios using transparent assumptions.
Prepare for implementation, one process at a time.
DPCI recommended practice
This sequence is an implementation aid, not a statutory checklist or an assessment of your organisation.
- Establish scope and ownership. Identify the processing, roles, applicable duties and accountable business owners.
- Build the data inventory. Connect purposes, data categories, systems, recipients, processors and retention.
- Design the people-facing workflows. Review notices, processing bases, consent, withdrawal, rights and grievances.
- Test safeguards and incident response. Verify controls in operation and rehearse notifications and recovery.
- Retain implementation evidence. Keep decisions, contracts, control tests and remediation records ready for review.
A college reviews its admissions process.
It maps applicant data and its CRM provider, checks whether applicants include children, identifies the basis and purpose for each use, reviews retention and tests request handling. It examines any education-related exemption against its precise conditions rather than assuming the institution is exempt.
Questions that matter in practice.
Is the entire DPDP Act already enforceable?
No. G.S.R. 843(E) sets phased commencement. Most operational duties and section 33 are in the eighteen-month group, calculated as 13 May 2027 from the printed Gazette date. Check subsequent official instruments before relying on the schedule.
Does every organisation need a Data Protection Officer?
The section 10 DPO requirement applies to a notified Significant Data Fiduciary. Section 8(9) and Rule 9 separately address publishing a contact able to answer processing questions, using the DPO where applicable.
Is a privacy notice or consent banner enough?
No. A notice or banner is only one part of implementation. Applicable duties also address processing bases, accountability, safeguards, processors, individual rights, retention and incident handling.
Is 72 hours the deadline for every breach notification?
No. Rule 7 requires initial Board intimation and communication to affected Data Principals without delay. Detailed Board information is due within 72 hours of awareness, unless the Board permits a longer period on a written request.
Does DPDP RiskIQ certify compliance?
No. It is a DPCI educational screening and scenario tool. Its score is not a statutory rating, an audit opinion, certification or a predicted penalty.
Read the primary sources.
The official instruments control. This page summarises selected provisions and is not a substitute for the full text. DPCI suggestions and illustrative scenarios are clearly identified separately.
- Digital Personal Data Protection Act, 2023 — official text ↗Published: 11 August 2023
Reviewed: 28 October 2026 - Commencement notification — G.S.R. 843(E) ↗Published: 13 November 2025
Reviewed: 28 October 2026 - DPDP Rules, 2025 — G.S.R. 846(E), read with G.S.R. 892(E) ↗Published: 13 November 2025; corrigendum dated 10 December 2025
Reviewed: 28 October 2026 - Rules corrigendum — G.S.R. 892(E) ↗Published: Gazette: 11 December 2025; notification: 10 December 2025
Reviewed: 28 October 2026 - Removal of Difficulties Order, 2026 — S.O. 5458(E) ↗Published: Gazette: 6 October 2026; order: 5 October 2026
Reviewed: 28 October 2026
Published and reviewed on 28 October 2026. Covers the Act, the final 2025 Rules, their December 2025 corrigendum, the commencement notification and the October 2026 Order. This page is not a live legislative update service. Any later amendment, notification or order must be considered before applying the guidance.
Data Privacy Council is a private initiative of Paryoma Foundation and is not a government or regulatory authority.