01
The Act
What the DPDP Act and Rules require of Data Fiduciaries, Consent Managers, and Significant Data Fiduciaries.
Read the overview →India’s DPDP framework · Information resource
DPDP Act compliance for India: clarity before the deadlines.
The Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 reshape how organisations collect, use, and protect personal data in India. This independent guide covers the Act, compliance timeline, penalties, solution patterns, a free readiness quiz, and introductions to specialised DPDP consulting vendors.
DPDP milestone journey
Act assent
- Aug 2023 Act assent DPDP Act becomes law; commencement awaits notification.
- Nov 2025 Rules & Board Rules notified; Board and definitions commence.
- Nov 2026 Consent Managers Consent Manager provisions take effect.
- May 2027 Full duties Notice, consent, safeguards, breach & rights apply.
Follow the Act’s phased runway - then check where you stand.
DPDP Act India
What is the DPDP Act, and who needs compliance?
The Digital Personal Data Protection Act, 2023 (DPDP Act / DPDPA) is India’s primary law for digital personal data. Together with the DPDP Rules, 2025, it sets duties for Data Fiduciaries: purpose-bound notices and consent, reasonable security safeguards, breach intimation, Data Principal rights, and additional obligations for Significant Data Fiduciaries.
Information seekers
Use this site to understand DPDP Act scope and roles, the 2025–2027 compliance timeline, and penalties up to ₹250 crore for security failures. Answers are also collected on the DPDP Act FAQ.
Consulting & services seekers
When you need implementation, explore DPDP compliance services patterns (consent, tracking, Board readiness, safeguards) and request a specialised vendor introduction. Start with the free DPDP compliance readiness quiz.
- Act + Rules: statute and operational Rules for India
- Deadlines: Board 2025, Consent Managers 2026, core duties May 2027
- Penalties: highest ceiling on security safeguard failures
- Action: assess gaps, then engage delivery partners
Natural path to readiness
Understand the law. Own the timeline. Close the risk. Deploy controls.
Follow a clear journey from legal context to enforceable security and compliance operations.
02
Timeline
Phased commencement through 2025–2027 - so you can plan boards, notices, consent, and safeguards in the right order.
See key dates →03
Risks
Penalties up to ₹250 crore for security failures - plus operational, reputational, and board-level exposure.
Understand exposure →04
Solutions
Consent, compliance tracking, board readiness, security safeguards, and breach response - scaled to your estate.
View capabilities →Self-discovery
Not sure where you stand? Calculate your DPDP need.
Our free Need Assessor is a nine-question activity that scores applicability, consent, security, and governance gaps. You get a need index, priority actions, and recommended next steps, all in your browser.
- Mobile-first quiz with instant scoring
- Gap profile for consent, security, and rights
- Optional email to request a vendor introduction
- No account and no server-side storage of answers
How we help
From clear information to implementable controls.
We publish practical guidance on the Act, timelines, and risks. When you are ready to implement, you can request an introduction to specialised compliance and security vendors who deliver enforceable controls - not documentation theatre.
DPDP is treated as a control problem: notices that systems can enforce, consent that can be proven, safeguards that withstand scrutiny, and evidence your board can stand behind.
Request vendor introduction- Translate statutory obligations into technical and organisational controls
- Stand up consent and notice flows that match how your products actually work
- Prepare for Data Protection Board engagement and Significant Data Fiduciary duties
- Align security safeguards with breach intimation and rights fulfilment
- Run continuous compliance tracking - not a one-off checklist exercise
The regulatory landscape
India’s DPDP framework is live and phased.
The Digital Personal Data Protection Act, 2023 received presidential assent on 11 August 2023. The DPDP Rules, 2025 and commencement notifications in November 2025 operationalise the framework - with board provisions already in force and substantive obligations phased through May 2027.
₹250 Cr
Max penalty - security safeguards
18 mo
Phased compliance runway
May 2027
Core obligations commence
Who this affects
Any organisation that determines the purpose and means of processing digital personal data in India - or processes such data outside India in connection with offering goods or services to individuals in India.
Capabilities
State-of-the-art controls for every scale.
From early-stage products to multi-entity regulated groups - same control philosophy, right depth of deployment.
Consent & notice
Purpose-bound consent, clear notices, withdrawal, and Consent Manager patterns aligned to the Rules.
Compliance tracking
Living inventories, obligation maps, evidence trails, and executive status for continuous readiness.
Board readiness
Governance, documentation, and response posture for engagement with the Data Protection Board of India.
FAQ
Questions organisations ask first
Does this site provide legal advice?
No. This is an information resource only. It does not provide legal advice. Use qualified counsel for legal determinations. For implementation, request a specialised vendor introduction.
When do core DPDP obligations apply?
Board and definitional provisions commenced in November 2025. Consent Manager provisions apply from November 2026. Most substantive Data Fiduciary obligations - including notice, consent, security safeguards, and breach intimation - are scheduled from 13 May 2027 under the phased commencement notification.
What is the highest DPDP penalty?
Failure to take reasonable security safeguards to prevent personal data breach may attract a penalty of up to ₹250 crore. Breach notification failures and children’s data violations may attract up to ₹200 crore each.
Do you work with startups and large enterprises?
Yes. Programmes are scaled - from lean consent and notice foundations for growing products to Significant Data Fiduciary-ready governance for complex estates - with delivery partners who scale controls to your estate.
What is the DPDP Need Assessor?
A free interactive quiz on this site that helps you self-discover DPDP priorities. It produces a need index, gap bars, and recommended solution areas. Open the Need Assessor.
Who must comply with the DPDP Act in India?
Organisations that determine the purpose and means of processing digital personal data (Data Fiduciaries), and those processing such data in connection with offering goods or services to individuals in India, subject to the Act’s scope and exemptions.
How does vendor introduction work?
When you request help, your enquiry can be routed to specialised vendors in the DPDP service catalogue who implement consent systems, safeguards, breach response, and evidence programmes.
How do I request compliance help?
Next step
When learning turns into implementation
The guides above stay free and educational. If you need operational tools or managed support, the DPDP Compliance Kit offers five focused modules.
-
SaaS
Automated Consent Manager
Multilingual notices, minor’s data, consent lifecycle, and grievances.
Learn more → -
SaaS / Managed
Automated Breach Management
Lifecycle tracking and structured DPBI reporting pathways.
Learn more → -
Managed boutique
Data Security Policy Consulting
Hands-on policies for reasonable security safeguards.
Learn more → -
Managed service
SDF-as-a-Service
Outsourced DPO operating model and SDF compliance support.
Learn more → -
Assurance
Audits, VAPT & DPIA Engine
Policy stress testing plus third-party audits and VAPT.
Learn more →
Get compliant · or start with the free Need Assessor.
Disclaimer
Independent resource, not a government website
This site is an independent information and compliance-enablement resource. It is not an official website of the DPDP Act, the Data Protection Board of India, MeitY, or any Government of India institution. See Privacy Policy and Terms of Use.
Align before the clock forces you to.
Use the phased runway to build durable controls - not last-minute documentation. Request an introduction to a specialised compliance vendor.