DPDP frequently asked questions

In phases under Rule 1. Rules 1, 2 and 17 to 21 took effect on 13 November 2025, Consent Manager registration under Rule 4 starts on 13 November 2026, and core obligations begin on 13 May 2027. See the DPDP timeline.

G.S.R. 846(E), notified on 13 November 2025. G.S.R. 843(E) of the same date is the commencement notification, and G.S.R. 892(E) of December 2025 is a corrigendum. See DPDP Rules, 2025.

It is established under s.18 and its set-up rules are in force, but as of 4 November 2026 no Chairperson or Members have been appointed. See the Data Protection Board entry.

It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to Data Principals in India (s.3). Read the DPDP Act overview.

No. The Act has a single category of personal data; “sensitive personal data” comes from the SPDI Rules, 2011, which continue until s.44(2) of the Act commences. See DPDP vs the IT Act SPDI Rules.

Consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the personal data necessary for the specified purpose, and given against a notice (s.5, s.6). See consent under section 6.

Only for a legitimate use listed in s.7, such as employment purposes or a medical emergency. DPDP has no legitimate interest ground, and the 2022 draft Bill's deemed consent was replaced by s.7. See legitimate uses.

Rule 3 asks for a notice that is understandable on its own, with an itemised description of the personal data and specified purposes, and a link to withdraw consent, exercise rights and complain to the Board. See the privacy notice guide.

Access to information (s.11), correction and erasure (s.12), grievance redressal (s.13) and nomination (s.14), plus withdrawal of consent at any time (s.6(4)). See rights of the Data Principal.

Rule 14(3) caps the grievance response period you publish at 90 days. TruePrivacy runs every rights request and grievance against that outer limit, so you can close them sooner. See the rights FAQ.

Rule 7 requires intimation to each affected Data Principal and to the Board without delay, and a detailed report to the Board within 72 hours of becoming aware. See Rule 7 on breaches.

No. CERT-In's directions of 28 April 2022 require reporting specified cyber incidents to CERT-In within 6 hours, which is separate from Rule 7. See the 72-hour breach playbook.

Anyone under 18. Processing a child's data needs verifiable parental consent (s.9(1), Rule 10), and tracking, behavioural monitoring and targeted advertising directed at children are barred (s.9(3)) unless Rule 12 exempts the class or purpose. See children's data under section 9.

A Data Fiduciary the Central Government notifies under s.10. It must appoint an India-based DPO and an independent data auditor and carry out a DPIA and an audit every twelve months (Rule 13); no SDF has been designated that we know of. Try Am I an SDF?.

No. Only Significant Data Fiduciaries must appoint one (s.10(2)(a)). Every Data Fiduciary publishes the business contact of its DPO or of a person who can answer questions about processing (Rule 9); see how to appoint a DPO.

No. A Data Principal may give, manage, review or withdraw consent through a Consent Manager (s.6(7)), and consenting directly to the Data Fiduciary remains possible. See the Consent Manager FAQ.

Rule 4 starts on 13 November 2026, with conditions including being a company incorporated in India with a net worth of not less than ₹2 crore. As of 4 November 2026, the application form has not been published. See Rule 4.

The Schedule to the Act sets a maximum per instance for each type of breach, and the Board decides the amount after an inquiry, weighing the factors in s.33(2). No Board members have been appointed yet, so none has been imposed. See DPDP penalties and the penalties FAQ.

Data discovery and classification, data security posture (DSPM), a DSPM endpoint agent, Data Principal requests, grievances, breach management, records of processing (RoPA), DPIAs, vendors and processors, and retention. TruePrivacy is not a Consent Manager; it is software a Data Fiduciary uses to run its own DPDP programme. See the platform overview.

Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra; there is no per-source fee. See pricing.