THE BIG PICTURE
Personal data is part of almost every modern business. Protecting it is becoming a core legal responsibility.
The DPDP framework governs specified processing of digital personal data. It brings new expectations for notice, consent, security, individual rights and accountability. Importantly, the obligations take effect in phases, rather than all at once.
01 / IMPLEMENTATION
One law.
Several starting lines.
The commencement notification and the Rules create a staggered implementation programme. The dates below reflect the November 2025 notifications.
01 / ENACTMENT
11 Aug 2023The DPDP Act received presidential assent.
02 / FIRST PHASE
13 Nov 2025Specified institutional and enabling provisions commenced, alongside Rules 1, 2 and 17 to 21.
03 / CONSENT MANAGERS
13 Nov 2026Rule 4 on Consent Manager registration and obligations comes into force.
04 / CORE RULES
13 May 2027Rules 3, 5 to 16, 22 and 23 are scheduled to commence, with corresponding Act provisions under the commencement notification.
Dates should be checked against any subsequent official notifications before taking action.
02 / SCOPE
What data is covered?
The Act concerns digital personal data. This includes information collected digitally and information first collected on paper but later digitised. It can apply to processing in India and, in specified circumstances, processing outside India connected with offering goods or services to individuals in India.
01
Customer information
Names, mobile numbers, email addresses, account details and purchase histories where they relate to an identifiable individual.
02
Workforce information
Digitised employment records, payroll information and other personal information used in HR systems.
03
Digital identifiers
Device or online identifiers, location information and usage records when they identify an individual.
The Act excludes certain personal data made publicly available by the individual or under a legal obligation. Other statutory exclusions and exemptions require careful, fact-specific assessment.
04 / CORE DUTIES
From policy to practice.
For organisations acting as Data Fiduciaries, compliance is not just a privacy notice. It requires joined-up decisions across product design, procurement, security, records and customer support.
01 / TRANSPARENCY
Clear notices
Provide understandable, standalone notices identifying the personal data involved and the specified processing purposes.
02 / LAWFUL PROCESSING
Consent or permitted use
Identify an applicable legal basis under the Act, including valid consent or a recognised legitimate use.
03 / SECURITY
Reasonable safeguards
Plan access controls, encryption or equivalent protective measures, monitoring, backups and contractual safeguards.
04 / INDIVIDUALS
Rights and grievances
Prepare processes for access information, correction, erasure, grievance redressal and nomination where applicable.
05 / LIFECYCLE
Retention and deletion
Map retention requirements, erasure triggers and any applicable statutory recordkeeping obligations.
06 / VENDORS
Processor contracts
Review agreements and operating procedures with vendors handling personal data on your behalf.
06 / HEIGHTENED REQUIREMENTS
Not every business faces the same risks.
CHILDREN
Verifiable parental consent
Processing children's personal data can trigger verifiable consent requirements and restrictions on tracking, behavioural monitoring and targeted advertising, subject to specified exemptions.
SIGNIFICANT DATA FIDUCIARIES
Enhanced governance
Entities formally notified as Significant Data Fiduciaries face additional requirements including an India-based Data Protection Officer, independent audit and impact assessments.
INTERNATIONAL OPERATIONS
Cross-border transfers
The Act permits transfers subject to restrictions notified by the Central Government and any other applicable Indian law.
07 / ENFORCEMENT
Accountability has a price.
₹250 crore
The maximum statutory penalty for failure to take reasonable security safeguards to prevent a personal data breach. Other contraventions have different ceilings, including up to ₹200 crore for specified breach-notification and children's-data failures.
These are maximum penalties, not automatic fines. The Board assesses contraventions under the statutory framework and relevant factors.
PRIMARY LEGAL MATERIALS
Read the source law.
This original editorial guide is based on the official statutory framework. It is a general overview, not a substitute for advice on a particular processing activity.
Editorial date: 8 November 2026. This guide describes the notified phased framework and should be reviewed if subsequent amendments or notifications alter the position.
