DPDP Act FAQ: compliance answers for India

The Digital Personal Data Protection Act, 2023 (also called DPDP Act or DPDPA) is India’s primary statute for protecting digital personal data. It balances Data Principal rights with lawful processing by Data Fiduciaries. Operational detail is in the Digital Personal Data Protection Rules, 2025. Read the full overview on The Act.

The Act is the statute passed by Parliament (assent 11 August 2023). The Rules prescribe how duties work in practice: notices, Consent Managers, security safeguards, breach intimation, and related procedures. Both matter for DPDP compliance in India.

A Data Fiduciary determines the purpose and means of processing personal data. If your organisation decides why customer, employee, or user data is collected and how it is used, you are likely a Data Fiduciary.

The individual to whom the personal data relates. Data Principals have rights including access, correction, erasure, withdrawal of consent, and grievance redressal under the Act’s framework.

An India-incorporated intermediary that enables individuals to give, manage, review, and withdraw consent. Consent Manager-related provisions are scheduled around November 2026 under the phased commencement notification.

Data Fiduciaries processing digital personal data, and entities processing such data in connection with offering goods or services to individuals in India (including certain processing outside India), subject to statutory scope and exemptions. When unsure, use the DPDP Need Assessor and confirm with counsel.

Clear purpose-bound notices and consent (or other lawful grounds), purpose limitation, reasonable security safeguards, breach intimation to the Board and affected individuals, Data Principal rights fulfilment, children’s data protections, and additional duties if notified as a Significant Data Fiduciary. See DPDP compliance solutions.

Yes, if they process digital personal data as Data Fiduciaries within the Act’s scope. Programme depth can scale, but core duties such as notices, consent, and security still apply when obligations commence.

No. Both protect personal data, but DPDP is India’s statute with its own roles, consent model, Board, and penalty structure. Organisations may need both DPDP and GDPR programmes if they operate across jurisdictions.

Indicative ceilings include up to ₹250 crore for failure of reasonable security safeguards, up to ₹200 crore for breach notification failures or children’s data violations, and up to ₹50 crore for certain other contraventions. Details: DPDP non-compliance risks.

The Act attaches its highest financial ceiling to failure to take reasonable security safeguards to prevent personal data breach. That makes security engineering and evidence central to DPDP readiness, not optional IT hygiene.

Phased under G.S.R. 843(E) (13 November 2025): Board/definitions from that date; Consent Manager provisions ~13 November 2026; most substantive Data Fiduciary obligations ~13 May 2027. Full dates: DPDP Act timeline.

Complete data and purpose mapping, redesign notices and consent, prepare Consent Manager integrations if needed, harden security and breach runbooks, and install compliance tracking before May 2027.

Specialised help to turn statute into enforceable controls: consent and notice systems, security safeguards, Board readiness, breach response, SDF governance, and continuous tracking. This site explains requirements and can introduce delivery vendors.

Start with the free Need Assessor, review solution areas, then request a vendor introduction via the programme desk at dpdp@curlsek.ai.

No. It is an independent information resource. See Privacy Policy for ownership. Official text is published in the Official Gazette.

No. Content is for general information. Confirm obligations with qualified legal counsel for your facts and sector.