Compare
DPDP vs IT Act and SPDI Rules
Many Indian privacy policies were built around the SPDI Rules, 2011. DPDP is set to replace that regime, but the switch has not happened yet.
Short answer
The SPDI Rules, 2011 rest on section 43A of the IT Act, and s.44(2) of the DPDP Act omits section 43A. But s.44(2) was not in the group of provisions that commenced on 13 November 2025, so the SPDI regime continues until s.44(2) commences; check the commencement notification G.S.R. 843(E). Keep meeting the SPDI Rules for now, and rewrite policies around the DPDP notice, consent, rights, security and breach duties, as core obligations begin on 13 May 2027.
Where the SPDI regime stands
Section 44(2) of the DPDP Act omits section 43A of the IT Act, which the SPDI Rules, 2011 rest on. Only s.44(1) and s.44(3) were in the group that commenced on 13 November 2025.
So the SPDI regime continues until s.44(2) commences. Check the commencement notification G.S.R. 843(E) with counsel, and do not assume a date. The timeline shows the dates that are fixed.
For a period, both regimes can apply to the same data. Check with counsel how they interact for your business.
What changes in substance
| Topic | What DPDP requires | What to check in an SPDI-era policy |
|---|---|---|
| Sensitive data | No separate sensitive category; the same duties apply to all personal data | Controls that protect only sensitive data and leave other personal data uncovered |
| Grounds | Consent (s.6) or certain legitimate uses (s.7) only (s.4) | Purposes that rest on neither |
| Consent standard | Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6) | Implied or bundled consent |
| Notice | Itemised data and purposes; links to withdraw, exercise rights and complain to the Board; English or Eighth Schedule languages (s.5, Rule 3) | A single policy page that does not itemise |
| Rights | Information, correction and erasure, grievance redressal, nomination (s.11 to s.14) | Missing routes for erasure or nomination |
| Security | Rule 6 safeguards, including one-year log retention and processor contract terms | Controls described only in general terms |
| Breach | The Board and each affected Data Principal without delay; detailed report within 72 hours (Rule 7) | No process for telling individuals |
| Children | Verifiable parental consent for under-18s (s.9) | No age check |
| Penalties | Decided by the Board under the Schedule to the Act (s.33) | Risk registers that cite only the old regime |
Policy rewrite priorities
Rewrite in the order below. The first two steps decide what every notice, contract and request process has to say, so do them before drafting text.
- 01Inventory first
Map all personal data, not only what the SPDI Rules treated as sensitive.
- 02Grounds and consent
Re-base each purpose on consent or a s.7 legitimate use, and fix the consent flows.
- 03Notices
Replace the privacy policy with a notice that meets Rule 3 (see the privacy notice guide), and plan the s.5(2) notice to existing users.
- 04Rights and grievances
Publish the request method, the identifier, the Rule 9 contact and a grievance period of no more than 90 days (Rule 14).
- 05Breach
Add Data Principal and Board intimation and the 72-hour detailed report to your incident plan (Rule 7).
- 06Contracts
Update processor contracts with Rule 6 security terms.
What else in the IT Act still applies
- CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours. This is separate from Rule 7.
- Sector regulators may have their own rules on data. Check your regulator's directions alongside DPDP.
- Until s.44(2) commences, keep your SPDI-era policies in force while the DPDP versions are prepared.
Transition checklist
- SPDI-era policies kept in force until s.44(2) commences
- Commencement notification checked with counsel
- Inventory covers all personal data
- Each purpose mapped to s.6 or s.7
- Rule 3 notices drafted
- Rule 7 steps in the incident plan, alongside CERT-In reporting
- Processor contracts updated for Rule 6
How TruePrivacy helps
Data discovery and classification find personal data of every kind, including Aadhaar numbers, PAN, UPI IDs and other Indian identifiers, not only what was once labelled sensitive. Notices and consent management support the move to DPDP notice and consent.
The DPDP checklist gives a readiness view of each control. TruePrivacy does not run a CERT-In track, so keep CERT-In reporting in your security process. Related tools: the privacy notice generator and the readiness quiz.
Do the SPDI Rules still apply?
Yes, for now. Section 44(2) of the DPDP Act omits section 43A of the IT Act, but s.44(2) was not in the group that commenced on 13 November 2025, so the SPDI regime continues until it commences.
Does DPDP have a sensitive personal data category?
No. The DPDP Act does not define sensitive personal data; the SPDI Rules did.
Does DPDP replace CERT-In reporting?
No. CERT-In's 6-hour reporting of specified cyber incidents, under its directions of 28 April 2022 under s.70B of the IT Act, is separate from Rule 7.
When does s.44(2) commence?
Check the commencement notification G.S.R. 843(E) with counsel. We do not give a date here.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin