- Home
- DPDP Act
DPDP Act
Digital Personal Data Protection Act, 2023: India guide
Plain-English pages on the Act, the Rules and the dates that matter, with the section or rule cited beside each point.
Short answer
The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025, and the Act's provisions come into force in three groups under the commencement notification G.S.R. 843(E). Under Rule 1, Consent Manager registration (Rule 4) starts on 13 November 2026 and core obligations for Data Fiduciaries begin on 13 May 2027. No members of the Data Protection Board have been appointed yet.
Start here
DPDP Act, 2023 overview for Indian companies
What the Digital Personal Data Protection Act, 2023 means for Indian data fiduciaries: scope, roles, lawful grounds, duties, rights and key dates.
Rules 2025DPDP Rules, 2025 explained
The DPDP Rules, 2025 (G.S.R. 846(E)), notified 13 Nov 2025: all 23 rules, when each starts, and what Indian companies must prepare.
TimelineDPDP compliance timeline for Indian companies
DPDP dates: Rules notified 13 Nov 2025, Consent Manager registration from 13 Nov 2026, core obligations from 13 May 2027. Status and a prep plan.
Section 2DPDP definitions for Indian teams
Core DPDP Act definitions in plain English: Data Fiduciary, Data Principal, Consent Manager, SDF, personal data and more, with glossary links.
Consent and notice
Consent under DPDP section 6
DPDP s.6 consent: free, specific, informed, unconditional and unambiguous, with a clear affirmative action. How Indian apps can build it.
Section 7Legitimate uses under the DPDP Act
The nine legitimate uses in s.7 of the DPDP Act that allow processing without consent, and how Indian fiduciaries should document each reliance.
Section 6 and Rule 4Consent Managers under the DPDP Act and Rule 4
Consent Managers under DPDP s.2, s.6(7) to s.6(9) and Rule 4: role, registration from 13 Nov 2026, ₹2 crore net worth, form not yet published.
Rule 4DPDP Rule 4: Consent Manager registration
DPDP Rule 4 Consent Manager registration starts 13 Nov 2026: a company incorporated in India with net worth of at least ₹2 crore. Form not yet published.
Rights and duties
Rights of the data principal under DPDP
Access, correction, erasure, grievance and nomination rights for individuals under ss.11 to 14 of India's DPDP Act, and how Rule 14 applies.
Section 8Duties of data fiduciaries in India
The duties Indian data fiduciaries owe under the DPDP Act and Rules: notice, consent, security, breach intimation, erasure, grievances and more.
Rule 14Rule 14 data principal requests
DPDP Rule 14: publish how Data Principals exercise their rights, and a grievance response period of no more than 90 days. Build SLAs that finish sooner.
Rule 7DPDP Rule 7 breach notification
DPDP Rule 7: intimate each affected Data Principal and the Board without delay, then give the Board a detailed report within 72 hours.
Children, disability and SDFs
Children's data under DPDP section 9
Section 9 protections for children's data in India: verifiable parental consent (Rule 10), lawful guardians (Rule 11) and Rule 12 exemptions.
Rule 11Rule 11 guardian consent for persons with disability
DPDP Rule 11: verify a lawful guardian's appointment before accepting consent for a person with disability. Practical steps for Indian fiduciaries.
Rule 12Rule 12 exemptions for children's data
DPDP Rule 12 lifts s.9(1) and s.9(3) for some fiduciaries and purposes, only within Fourth Schedule conditions. How to read and document it.
Section 10Significant Data Fiduciary under DPDP
SDF duties under DPDP s.10 and Rule 13: an India-based DPO, an independent data auditor, and a yearly DPIA and audit. What designation means.
Rule 13Rule 13 Significant Data Fiduciary duties
DPDP Rule 13 for Significant Data Fiduciaries: a yearly DPIA and audit, algorithmic due diligence, and keeping specified data in India.
Transfers and penalties
Cross-border transfers under DPDP law
How the DPDP Act treats transfers of personal data outside India: s.16 restrictions by notification, Rule 15, Rule 13 localisation and a checklist.
PenaltiesDPDP penalties for data fiduciaries
DPDP Act penalties in plain English: Schedule maximums up to ₹250 crore, how the Board decides, and what lowers risk. Educational, not legal advice.
Sections 27 to 33DPDP penalty chapters in detail
A detailed walk-through of the DPDP Schedule of penalties, the Board's inquiry, s.33(2) factors, voluntary undertakings (s.32) and appeals to TDSAT.
The instruments behind the DPDP regime
| Instrument | Number | Date | What it does |
|---|---|---|---|
| Digital Personal Data Protection Act, 2023 | Act No. 22 of 2023 | Gazette, 11 August 2023 | The Act |
| Commencement notification | G.S.R. 843(E) | 13 November 2025 | Brings the Act's provisions into force in three groups (s.1(2)) |
| Digital Personal Data Protection Rules, 2025 | G.S.R. 846(E) | 13 November 2025 | The Rules: 23 rules and seven Schedules |
| PIB release on the Rules | None | 14 November 2025 | Government announcement |
| Corrigendum to the Rules | G.S.R. 892(E) | December 2025 | Corrects the English text of the Rules |
| Removal of Difficulties Order, 2026 | S.O. 5458(E) | Gazette, 6 October 2026 | Editorial changes to s.9(1) and s.10(2)(c)(ii); adds no new duty |
New to the law? Start with the overview and the timeline, then work through the May 2027 checklist. To see how each duty maps to software, go to the TruePrivacy platform.
When does the DPDP Act apply to companies?
Core obligations for Data Fiduciaries, such as notice, consent, security safeguards, breach intimation and rights, begin on 13 May 2027 under Rule 1. Consent Manager registration (Rule 4) starts earlier, on 13 November 2026.
Are the DPDP Rules G.S.R. 843(E) or G.S.R. 846(E)?
The Rules are G.S.R. 846(E). G.S.R. 843(E) is the commencement notification issued the same day, 13 November 2025.
Has the Data Protection Board started work?
No Chairperson or Members of the Board have been appointed yet. The Rules on its set-up (Rules 17 to 21) have applied since 13 November 2025.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin