India's DPDP Act: A Practical Compliance Guide (2025)

The Digital Personal Data Protection Act, 2023 regulates the processing of digital personal data, any data about an identifiable individual that is collected in digital form, or collected on paper and later digitised. It applies to processing inside India, and to processing outside India where it relates to offering goods or services to people in India.

The Act is built around consent and accountability: you may process someone's personal data only for a lawful purpose, with their consent or under a small set of 'legitimate uses', and you remain accountable for keeping that data secure and deleting it once the purpose is served.

The Act uses three key roles. A Data Principal is the individual the data is about. A Data Fiduciary is the organisation that decides why and how the data is processed, the equivalent of a 'controller' under GDPR. A Data Processor processes data on a fiduciary's behalf, under contract.

If your organisation decides what personal data to collect and why, you are a Data Fiduciary and carry the primary obligations. Larger or higher-risk organisations can be notified as Significant Data Fiduciaries, which adds duties such as appointing a Data Protection Officer in India, commissioning independent data-protection audits and carrying out periodic impact assessments.

Consent and notice: collect personal data on the basis of free, specific, informed and unambiguous consent, preceded by a clear notice that states what you collect and why. Consent must be as easy to withdraw as it is to give.

Purpose limitation and minimisation: collect only what the stated purpose needs, use it only for that purpose, and erase it once the purpose is met or consent is withdrawn, unless a law requires you to retain it.

Security safeguards: take reasonable technical and organisational measures to protect personal data. The failure to do so is the single most heavily penalised breach in the Act.

Breach notification: on a personal-data breach, notify both the Data Protection Board of India and every affected Data Principal.

Data-principal rights: give people a way to access, correct and erase their data, a grievance-redressal route, and the ability to nominate someone to act for them.

The Act set the framework; the operational detail lives in the Rules. The draft Digital Personal Data Protection Rules were published for public consultation in January 2025 and are expected to be brought into force in phases, giving organisations a transition window rather than a single overnight deadline.

The draft Rules flesh out how notices must be worded, how consent managers register and operate, the specifics of breach notification, additional safeguards for children's and Significant Data Fiduciary data, and the reasonable security practices expected of every fiduciary. Treat them as the implementation checklist the Act points to.

Penalties are set out in a schedule and assessed by the Data Protection Board of India. The largest, up to ₹250 crore per instance, attaches to failing to take reasonable security safeguards to prevent a personal-data breach. Failure to notify a breach, and breaches of children's-data duties, carry penalties up to ₹200 crore.

Because the headline penalty is tied to security safeguards, the fastest way to reduce DPDP risk is the same work that reduces breach risk generally: find and fix the exploitable weaknesses in the systems that hold personal data, before an attacker or regulator does.

Map your data: list the personal data you collect, where it lives, who can access it, and why. You cannot protect or delete what you have not mapped.

Fix the consent and notice flow: make notices clear, consent granular and withdrawal easy, and record consent so you can prove it.

Harden the systems that hold personal data: enforce least-privilege access, encryption, logging and a tested breach-response plan, and verify it with a penetration test rather than assuming it holds.

Set retention and deletion: define how long each category of data is kept and automate erasure when the purpose ends or consent is withdrawn.

Stand up governance: assign ownership, prepare breach-notification runbooks, and, if you are a Significant Data Fiduciary, appoint a DPO and schedule independent audits.

Map DPDP to frameworks you may already run: much of the security evidence overlaps with SOC 2 and ISO 27001, so a single programme can serve all three.