Privacy & data protection
DPDP Act
India's Digital Personal Data Protection Act (DPDP)
The DPDP Act is India's law governing the processing of digital personal data. We help you understand your obligations as a Data Fiduciary, put the right controls in place, and demonstrate compliance.
What DPDP Act is
India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data. It is built around consent and notice, requires a lawful basis for processing, and places obligations on Data Fiduciaries, the entities that determine the purpose and means of processing, towards Data Principals, the individuals the data relates to.
The DPDP Act is a regulation you demonstrate compliance with, not a standard you are certified against. It introduces concepts such as consent managers, obligations around children's data, and the potential for certain organisations to be designated as Significant Data Fiduciaries with additional duties. Its detailed operation is shaped by rules made under the Act, so compliance means staying aligned with both the Act and its implementing rules.
The structure of the Act
Notice and consent
A Data Fiduciary must give a clear itemised notice and obtain free, specific, informed and unambiguous consent before processing personal data, with consent as easy to withdraw as it was to give.
Lawful grounds
Processing must rest either on consent or on defined legitimate uses, such as a purpose the person has voluntarily provided data for or specified state and employment functions.
Data Fiduciary duties
The entity deciding the purpose and means of processing must keep data accurate, retain it only as long as needed, apply reasonable security safeguards and report personal data breaches.
Data Principal rights
Individuals can access and correct their data, request erasure, nominate another person to act on their behalf and raise grievances with the Data Fiduciary.
Children and guardians
Processing the data of children and persons with a lawful guardian requires verifiable guardian consent, with tracking, behavioural monitoring and targeted advertising generally restricted.
Significant Data Fiduciary
Organisations the government designates in this class carry extra duties including appointing a Data Protection Officer in India, an independent data auditor and periodic data protection impact assessments.
Consent Managers
The Act provides for registered Consent Managers through which individuals can give, manage, review and withdraw consent via an accessible platform.
Data Protection Board of India
An independent Board hears complaints, directs remedial and mitigation measures on breaches and can impose monetary penalties for non compliance.
Who needs it
- Organisations in India that process the digital personal data of individuals
- Companies outside India that process personal data in connection with offering goods or services to individuals in India
- SaaS and platform businesses handling Indian user data as a Data Fiduciary or on a fiduciary's behalf
What you get
- A data mapping exercise and assessment of your role under the Act
- Consent and notice mechanisms and Data Principal rights processes
- Governance and policies aligned with the Act and its rules
- Security safeguards with penetration test evidence
Timelines depend on the volume and sensitivity of the data you process and your current maturity. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The governing law is the Digital Personal Data Protection Act, 2023. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and give the Act its operational detail, with provisions coming into force in phases rather than all at once. Some obligations applied from notification while others, including several core compliance duties, follow after a transition window, so the practical date your organisation must meet a given requirement depends on which provision it falls under. We track the phasing and tell you what applies to you and when rather than treating the whole framework as live on day one.
What it costs
The DPDP Act is a law you demonstrate compliance with, not a standard you are certified against, so there is no certificate to buy and no accredited certification body in the picture. The costs that sit side by side are our scoped advisory and implementation fee, quoted up front once we understand your size, your role under the Act and your starting point, and any separate spend you choose on independent input such as a data auditor, external legal counsel or a Data Protection Officer, which is especially relevant if you are designated a Significant Data Fiduciary. Those parties set their own fees on their own schedules, and we are never the auditor, Board or regulator. We scope it with you rather than quote blind.
How tr3labs gets you there
Scope and gap assessment
We map your processing of digital personal data, confirm your role under the Act, and measure your current practices against its consent, notice and security obligations.
Build the controls and notices
We help you implement lawful consent and notice mechanisms, processes for Data Principal rights, and the governance the Act expects, including obligations around children's data where relevant.
Secure the data
We assess and strengthen your security safeguards and use penetration testing to evidence that personal data is appropriately protected against breaches.
Readiness and ongoing support
We assemble the documentation that demonstrates compliance and keep you aligned as the rules under the Act develop, including any additional duties if you are a Significant Data Fiduciary.
India DPDP Act and GDPR side by side
Both are consent and rights based privacy laws with similar roles and duties, so teams often assume aligning with one covers the other.
| India DPDP Act | GDPR | |
|---|---|---|
| Covers | Digital personal data of people in India | Personal data of people in the EU and EEA |
| Who enforces it | Data Protection Board of India | National supervisory authorities in each member state |
| Core idea | Consent led duties on Data Fiduciaries | Lawful basis and accountability for controllers |
| Lawful grounds | Consent or defined legitimate uses | Six lawful bases including legitimate interests |
| Audit model | No certificate; compliance evidenced through records | No certificate; compliance evidenced through records |
| Often held with | ISO 27001 and HIPAA programmes | ISO 27001 and sector privacy work |
DPDP Act FAQ
- How much does DPDP Act compliance cost?
- The DPDP Act is a law, not a certification, so there is no certificate to buy. You pay our scoped advisory and implementation fee, quoted up front, plus any separate spend you choose on a data auditor, external counsel or a Data Protection Officer, which is especially relevant if you are a Significant Data Fiduciary.
- How long does DPDP compliance take?
- It depends on the volume and sensitivity of the data you process and your current maturity. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Who does the DPDP Act apply to?
- It applies to the processing of digital personal data in India, and to processing outside India where it is connected with offering goods or services to individuals in India. We help you confirm whether and how it applies during scoping.
- What is a Data Fiduciary?
- A Data Fiduciary is the entity that determines the purpose and means of processing personal data, broadly similar in concept to a controller under the GDPR. Certain organisations may be designated Significant Data Fiduciaries with additional obligations. Establishing your role is one of the first things we do.
- Is DPDP compliance a certification?
- No. The DPDP Act is a regulation you demonstrate compliance with, not a certifiable standard. Compliance is shown through consent and notice mechanisms, documented processes, security safeguards and records. We help you build and maintain that evidence.
The services that get you there
Related standards
Related reading
India's DPDP Act: A Practical Compliance Guide (2025)
What India's Digital Personal Data Protection (DPDP) Act requires, who counts as a data fiduciary, what the 2025 Rules add, the penalties, and a practical path to compliance.
9 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read