DPDP Act 2023 and DPDP Rules 2025: Compliance Guide for IT Companies

The DPDP Act (Digital Personal Data Protection Act, 2023) is India's general personal data protection law, and with the DPDP Rules, 2025 it changes how every Indian company that collects personal data has to build and run its products. Unlike the GDPR, it arrived with a long runway: the Rules were notified on 13 November 2025 and the obligations come into force in three phases, the last of them in May 2027.

That runway is shorter than it looks for software teams. Consent notices, withdrawal, erasure schedules, one-year log retention, breach detection and 72-hour reporting all need product and infrastructure work. This guide explains who the Act applies to, the phased dates, the duties of data fiduciaries, the role of IT vendors as data processors, the security safeguards in Rule 6, breach reporting, rights, children's data, cross-border transfers, penalties, and a practical plan. Dates and rule numbers reflect the notified text at our last review; check this page's review date before relying on it, and confirm details with your counsel.

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) received Presidential assent on 11 August 2023. It is a short, principles-based statute; many operational details are set by the Digital Personal Data Protection Rules, 2025 made under it. Its key terms:

• Personal data: any data about an individual who is identifiable by or in relation to that data.
• Digital personal data: personal data in digital form. The Act covers data collected digitally and data collected offline and digitised later.
• Data principal: the individual the data relates to; for a child (under 18) or a person with a disability, this includes the parent or lawful guardian.
• Data fiduciary: a person who, alone or with others, determines the purpose and means of processing. The equivalent of a GDPR controller.
• Data processor: a person who processes personal data on behalf of a data fiduciary.
• Significant data fiduciary: a fiduciary or class of fiduciaries notified by the government on factors such as the volume and sensitivity of data and risk to rights, with extra duties.
• Consent manager: a person registered with the Board who provides a platform for people to give, manage, review and withdraw consent.

History and why the DPDP Act was introduced

Before the Act, personal data in India was protected mainly by section 43A of the Information Technology Act, 2000 and the 2011 SPDI Rules, which covered only "sensitive personal data or information" held by body corporates and offered compensation rather than a regulator. In 2017, the Supreme Court in Justice K.S. Puttaswamy v. Union of India held that privacy is a fundamental right under the Constitution and noted the need for a data protection law. A committee chaired by Justice B.N. Srikrishna produced a draft in 2018, a Personal Data Protection Bill was introduced in 2019 and withdrawn in 2022, and a shorter Digital Personal Data Protection Bill was passed in 2023.

The Act's purpose, stated in its preamble, is to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process it for lawful purposes. The Rules were published in draft in January 2025, consulted on, and notified in November 2025.

When does the DPDP Act apply? The phased dates

The government brought the Act and Rules into force in three phases through a commencement notification and the Rules, both dated 13 November 2025.

Phase	From	What applies
1	13 November 2025	Definitions, the Data Protection Board of India and its functioning (sections 18 to 26), powers to make rules and related provisions, and the corresponding Rules (Rules 1, 2 and 17 to 21). The Board exists; most duties on companies do not yet apply.
2	One year after notification (November 2026)	Registration and obligations of consent managers (section 6(9) and related provisions, Rule 4).
3	Eighteen months after notification (May 2027)	The substantive obligations: notice and consent, legitimate uses, general duties of data fiduciaries including security safeguards and breach intimation, children's data, significant data fiduciaries, rights of data principals, cross-border processing, exemptions, and penalties, with the corresponding Rules.

Section 44(1) and 44(3), which amend the TRAI Act and the Right to Information Act, came into force in the first phase. Section 44(2), which omits section 43A from the IT Act (and with it the basis of the SPDI Rules), is not part of the first phase, so section 43A and the SPDI Rules continue to apply until it takes effect. Check the commencement notification for the exact date of each provision.

Who must comply?

Section 3 applies the Act to processing of digital personal data within India, and to processing outside India if it is in connection with any activity related to offering goods or services to data principals within India. It does not apply to personal data processed by an individual for personal or domestic purposes, or to personal data that the data principal or someone under a legal obligation has made publicly available.

Data fiduciaries

Any company deciding why and how personal data is processed: e-commerce, fintech, ed-tech, health-tech, HR platforms, SaaS companies for their own customer and employee data, and employers. Size does not exempt you, although the government can exempt certain classes, such as startups, from some provisions by notification (section 17(3)).

IT companies as data processors

The Act places its duties on data fiduciaries. A data processor is not directly given most obligations; instead, section 8(2) says a fiduciary may engage a processor only under a valid contract, and section 8(1) makes the fiduciary responsible for compliance, including for processing done by its processors. Rule 6 requires the fiduciary's contracts with processors to include provisions for reasonable security safeguards. In practice, Indian IT service companies, cloud and SaaS vendors processing client data will receive DPDP clauses in their contracts covering security, breach notice to the client, deletion and audit.

Industries

All industries are covered. Sector regulators keep their own rules: banking and payments data under the RBI, market data under SEBI, health data under the ABDM framework, and so on. The DPDP Act applies alongside those rules, and section 38 says it is in addition to other laws but prevails over them in case of conflict.

Key requirements for data fiduciaries

Grounds for processing (sections 4, 6 and 7)

Personal data may be processed only for a lawful purpose with the data principal's consent or for a legitimate use listed in section 7. Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose. Legitimate uses include data the person voluntarily provided for a specified purpose without indicating objection, certain state functions, compliance with law or court orders, medical emergencies, disasters, and specified employment purposes. There is no general "legitimate interests" basis as in the GDPR.

Notice (section 5 and Rule 3)

A request for consent must come with a notice that is understandable on its own, gives an itemised description of the personal data and the specified purpose, and explains how to withdraw consent, exercise rights and complain to the Board. Notices must be available in English or any language in the Eighth Schedule of the Constitution, at the person's option.

Withdrawal of consent (section 6)

Withdrawing consent must be as easy as giving it. After withdrawal, the fiduciary and its processors must stop processing within a reasonable time unless processing is required or authorised by law.

General obligations (section 8)

• Ensure completeness, accuracy and consistency where data is used to make a decision about the person or disclosed to another fiduciary.
• Implement appropriate technical and organisational measures.
• Protect personal data with reasonable security safeguards to prevent a personal data breach.
• Intimate personal data breaches to the Board and to each affected data principal.
• Erase personal data, and make processors erase it, when consent is withdrawn or it is reasonable to assume the specified purpose is no longer served, unless retention is required by law.
• Publish the contact details of a data protection officer (for significant data fiduciaries) or a person able to answer questions.
• Establish an effective grievance redressal mechanism.

Children and persons with disability (section 9 and Rules 10 and 11)

Processing a child's data (anyone under 18) needs verifiable consent of a parent. Fiduciaries must not process data in a way likely to cause a detrimental effect on a child's well-being, and must not track or behaviourally monitor children or target advertising at them. The Rules describe how to verify that the person giving consent is an identifiable adult, and set out classes of fiduciaries and purposes that are exempt from some of these conditions.

Significant data fiduciaries (section 10 and Rule 13)

Must appoint a data protection officer based in India who reports to the board or similar body, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits. The Rules add annual assessments and audits, due diligence that algorithmic software does not pose risks to rights, and allow the government to require that certain personal data and related traffic data are not transferred outside India based on a committee's recommendations.

Security safeguards and log retention (Rule 6 and Rule 8)

Rule 6 sets out minimum reasonable security safeguards that a data fiduciary must take for personal data in its possession or under its control, including data processed by a processor. In summary they are:

1. Securing personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to the data.
2. Appropriate measures to control access to the computer resources used for processing.
3. Visibility of access through logs, monitoring and review, to detect, investigate, remediate and prevent unauthorised access.
4. Measures for continued processing if confidentiality, integrity or availability is compromised, including data backups.
5. Retaining such logs and personal data for one year, for detection and remediation of unauthorised access and investigation, unless another law requires otherwise.
6. Appropriate provisions in contracts with data processors for taking reasonable security safeguards.
7. Appropriate technical and organisational measures to ensure the safeguards are observed.

Rule 8 adds that personal data, associated traffic data and other logs of processing must be retained for at least one year from the date of processing for purposes set out in the Rules, and sets erasure timelines for classes listed in the Third Schedule (large e-commerce, online gaming and social media intermediaries), with at least 48 hours' notice to the person before erasure for inactivity. For software teams, the one-year log retention is often the most immediate engineering change, and it must be balanced against the erasure duties: logs must be kept, secured and access-controlled, not used for other purposes.

These requirements sit alongside the CERT-In Directions, which already require logs of ICT systems to be kept for 180 days within Indian jurisdiction and incidents to be reported within six hours.

Personal data breach intimation (section 8(6) and Rule 7)

A personal data breach is any unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. There is no materiality threshold in the Act: every breach must be intimated.

• To each affected data principal: without delay, in a concise, clear and plain manner, describing the breach, its likely consequences, the mitigation measures, the safety measures the person can take, and a contact person.
• To the Board: without delay, with a description of the breach; and within 72 hours of becoming aware of it (or a longer period the Board allows on request), updated information including the facts, circumstances and reasons, mitigation measures, findings about the person responsible, remedial measures and a report on the intimations given to affected people.

A cyber security incident may also need to be reported to CERT-In within six hours under its Directions, and to sector regulators. Build one incident playbook that meets all of them.

Rights and duties of data principals

• Right to access information (section 11): a summary of the personal data processed and the processing activities, and the identities of other fiduciaries and processors it has been shared with.
• Right to correction and erasure (section 12): correction, completion, updating and erasure of data processed on the basis of consent, subject to legal retention.
• Right of grievance redressal (section 13): the fiduciary or consent manager must respond within the period prescribed; the person must use this route before approaching the Board.
• Right to nominate (section 14): another person to exercise rights in the event of death or incapacity.

The Rules require fiduciaries to publish on their website or app how people can make requests, and the details needed to identify them. Data principals also have duties under section 15, such as not filing false or frivolous complaints, with a penalty of up to 10,000 rupees.

Cross-border transfers

Section 16 allows transfer of personal data outside India except to countries or territories the central government restricts by notification. This is a "negative list" model, unlike the GDPR's adequacy and contract mechanisms. Sector rules that require local storage (for example the RBI's payment data storage directive) continue to apply, and the Rules allow the government to impose requirements on transfers by order, including for significant data fiduciaries.

How to implement DPDP Act compliance step by step

1. Classify your role for each data set: fiduciary, processor, or both. Identify whether you might be notified as a significant data fiduciary.
2. Map personal data across products, internal systems and vendors, with purpose and ground (consent or which legitimate use).
3. Rewrite notices to the Rule 3 standard: itemised data, specific purposes, how to withdraw and complain, and language options.
4. Rebuild consent flows: no pre-ticked boxes or bundled consent, purpose-level choices, consent records, and withdrawal as easy as giving. Plan integration with registered consent managers from Phase 2.
5. Implement retention and erasure: a retention schedule per purpose, automated deletion including at processors, and the Third Schedule timelines and 48-hour notice if you fall in those classes.
6. Apply Rule 6 safeguards: encryption or tokenisation, access control, logging and monitoring, backups, and one-year retention of access logs.
7. Update processor contracts with security, breach notice, deletion and audit clauses, and review your own vendor list.
8. Build a breach response that covers immediate intimation, the 72-hour report to the Board, notices to people, and CERT-In reporting.
9. Handle children's data: age assurance, verifiable parental consent, and removal of tracking and targeted ads for minors.
10. Stand up rights handling and grievance redressal, with published contact details.
11. Train staff and assign accountability, including a DPO in India if you are significant.

Documentation and policies required

The Act does not list mandatory documents the way the GDPR's Article 30 does, but you will need evidence to show compliance to the Board and to clients:

• Data inventory with purposes and grounds.
• Notices in the required form and languages, and consent records.
• Privacy policy and contact details for queries and grievances.
• Information security policy describing the Rule 6 safeguards, and log retention settings.
• Retention and erasure schedule.
• Processor contracts with DPDP clauses.
• Breach response plan, breach register and copies of intimations.
• Rights request and grievance logs.
• For significant data fiduciaries: DPIAs, audit reports, DPO appointment and algorithmic due diligence records.

Audits, assessments and enforcement

There is no certification under the Act. Significant data fiduciaries must commission independent data audits and impact assessments. Everyone else should expect client audits under processor contracts and, after Phase 3, inquiries by the Data Protection Board, which acts on complaints, references from the government or courts, or breach intimations. The Board is designed as a "digital office": complaints and proceedings are handled online. It can impose penalties after an inquiry, accept voluntary undertakings, and direct mediation. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal.

Timeline and cost considerations

Treat May 2027 as the deadline for products and contracts, and November 2026 as the date consent managers can start operating. Work that touches data models (erasure across systems, consent per purpose) takes longest, so it should start first. Cost factors include legal review of notices and contracts, engineering for consent, rights, retention and logging, storage for one-year log retention, security tooling, a consent management platform, staff training, and, for significant data fiduciaries, a DPO, auditors and DPIAs.

Benefits and consequences of non-compliance

Compliance reduces the volume of data you hold, lowers breach exposure, and is now a requirement in enterprise contracts. Indian companies that already meet the GDPR will find much reusable, though the grounds for processing, children's age and transfer rules differ.

The Schedule to the Act sets maximum penalties per instance, imposed by the Board after an inquiry:

Breach of	Maximum penalty
Obligation to take reasonable security safeguards to prevent a personal data breach	250 crore rupees
Obligation to give notice of a personal data breach to the Board and affected people	200 crore rupees
Additional obligations for children	200 crore rupees
Additional obligations of significant data fiduciaries	150 crore rupees
Duties of data principals	10,000 rupees
Any other provision of the Act or Rules	50 crore rupees

Section 33 lists factors the Board must consider, including the nature, gravity and duration of the breach, the type of data affected, repetition, any gain or loss avoided, mitigation, and the proportionality of the penalty. The government can also, on the Board's reference, block access to a fiduciary's information after repeated penalties (section 37).

Common mistakes and challenges for IT companies

• Waiting for May 2027. Data model changes for erasure and purpose-based consent take months, and clients will ask earlier.
• Copying GDPR consent text. The DPDP Act has no legitimate interests ground, uses 18 as the age for children, and requires notices in specific form and languages.
• Logs that are either deleted too early or kept forever. Rule 6 and Rule 8 require one-year retention for specific purposes; CERT-In requires 180 days; erasure duties limit indefinite retention.
• Treating every breach as optional to report. The Act requires intimation of every personal data breach, not only serious ones.
• Analytics and ad tools on products used by minors. Tracking and targeted advertising directed at children is prohibited.
• Processor contracts without security and deletion clauses. Rule 6 makes these clauses part of the fiduciary's safeguards.
• Assuming SPDI compliance is enough. SPDI covers sensitive data only and will fall away when section 44(2) takes effect.

Best practices, tools and technologies

• Design consent as data: purpose-level consent records with timestamps, notice version and channel.
• Tokenise or encrypt identifiers, and mask personal data in admin interfaces and logs.
• Centralise access logs with one-year retention, integrity protection and restricted access.
• Automate retention: scheduled jobs that erase or anonymise data per purpose, with notifications where the Rules require them.
• Use identity and access management with role-based access and MFA for staff access to personal data.
• Build a rights portal or in-app flows for access, correction, erasure and nomination.
• Use ISO/IEC 27001 and ISO/IEC 27701 to structure security and privacy management.

We build these features for Indian web applications and SaaS products.

How the DPDP Act relates to other laws and frameworks

Law or framework	Relationship
IT Act, 2000	The DPDP Act removes section 43A once section 44(2) takes effect; other IT Act provisions continue.
SPDI Rules, 2011	Apply until section 43A is omitted.
CERT-In Directions	Separate duties: six-hour incident reporting and 180-day log retention for ICT systems.
GDPR	Similar structure (fiduciary/controller, processor, rights, breach notice) with different grounds, child age, transfers and penalties.
RBI directions	Sector rules for regulated financial entities that continue alongside the Act.
ISO/IEC 27701	Privacy management system that can organise DPDP controls; not legal compliance on its own.

Real-world implementation examples

At our last review, the substantive duties had not yet come into force, so there were no penalty decisions under the Act to cite. The practical examples are in how companies are preparing. Large Indian consumer platforms have started rolling out itemised consent screens and data-download and deletion options. Banks and fintechs, already subject to RBI rules on data and outsourcing, are adding DPDP clauses to vendor contracts and asking vendors for breach notice periods shorter than 72 hours so that they can meet the Board's timeline themselves.

An illustrative case for an ed-tech app: most users are under 18, so the company must add age assurance, verifiable parental consent, and remove behavioural tracking and targeted ads for minors. Its analytics SDKs and ad networks are the hardest part to change, not its own code.

Next steps

1. Map personal data and decide your role for each data set.
2. Plan product changes for consent, rights, erasure and log retention to finish well before May 2027.
3. Update notices, privacy policy and processor contracts.
4. Write a combined breach playbook for the Board, affected people, CERT-In and regulators.
5. Track MeitY and Board notifications; this guide is reviewed every three months.

Need the product work done? Talk to our team.

Frequently asked questions

Is the DPDP Act in force?

Partly. The Board and related provisions have applied since 13 November 2025, consent manager provisions apply from November 2026, and most obligations on data fiduciaries, including penalties, apply from May 2027.

Does the DPDP Act apply to foreign companies?

Yes, to processing outside India in connection with offering goods or services to data principals in India.

Does the DPDP Act apply to IT service companies?

For their own employee and customer data they are data fiduciaries. For client data they are usually data processors, bound by contracts that the client's DPDP duties require.

What is the age of a child under the DPDP Act?

Anyone under 18. Processing their data needs verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are not allowed, subject to exemptions in the Rules.

How quickly must a data breach be reported?

To the Board and affected people without delay, with a detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board allows longer. CERT-In may also need a report within six hours.

What are the DPDP Act penalties?

Up to 250 crore rupees for failing to take reasonable security safeguards, up to 200 crore for failing to notify breaches or meet children's obligations, up to 150 crore for significant data fiduciary duties, and up to 50 crore for other breaches.

Is there a legitimate interests basis like the GDPR?

No. Processing needs consent or one of the legitimate uses listed in section 7, which are narrower.

Can personal data be transferred outside India?

Yes, except to countries the government restricts by notification, and subject to sector rules and any requirements set under the Rules.

What is a consent manager?

A company registered with the Data Protection Board that offers a platform through which people give, manage and withdraw consent across fiduciaries. Registration and obligations apply from November 2026.

Who is a significant data fiduciary?

A fiduciary or class notified by the government based on factors such as volume and sensitivity of data, risk to rights, and impact on sovereignty, security and public order. They must appoint an India-based DPO, an independent auditor and run DPIAs.

Does the DPDP Act replace the SPDI Rules?

It will. Section 44(2) omits section 43A of the IT Act, on which the SPDI Rules rest. Until that provision takes effect, the SPDI Rules continue to apply.

Do we need to keep logs for one year?

The Rules require logs and relevant personal data to be retained for one year for detecting and investigating unauthorised access, unless another law requires a different period. CERT-In separately requires 180 days for ICT system logs.

Does the DPDP Act apply to non-digital data?

It applies to personal data collected in digital form and to data collected in non-digital form that is later digitised. Purely paper records that are never digitised fall outside it.