India's Digital Personal Data Protection Act, 2023 is now backed by the DPDP Rules, notified on 14 November 2025. Obligations phase in over 12 to 18 months, which means most organisations have until 2027 to be fully compliant. That sounds like plenty of time. It is not, if you have not yet mapped where personal data lives.
Who the DPDP Act applies to
The Act applies to the processing of digital personal data within India, and to processing outside India if it relates to offering goods or services to people in India. If you collect names, phone numbers, email addresses, Aadhaar or PAN details, health records, student records or employee information in digital form, it applies to you.
The Act uses three key roles:
- Data Principal: the individual the data is about. For children, this includes the parent or lawful guardian.
- Data Fiduciary: the organisation that decides why and how personal data is processed.
- Data Processor: a party that processes data on behalf of a fiduciary, such as an IT or cloud provider.
The phased timeline
The Rules were notified in November 2025 with staggered commencement. Provisions establishing the Data Protection Board took effect immediately. The framework for consent managers follows at around 12 months, and most substantive obligations on data fiduciaries, including notices, security safeguards, breach notification and data principal rights, apply at around 18 months.
Practical reading: treat 2026 as your build year. The organisations that will struggle are the ones that start their data mapping in 2027.
Key obligations for data fiduciaries
- Lawful basis and consent: process personal data only with valid consent or for specified legitimate uses. Consent must be free, specific, informed, unconditional and unambiguous.
- Clear notices: tell people what data you collect, why, and how they can exercise their rights or complain.
- Reasonable security safeguards: protect personal data against breaches with appropriate technical and organisational measures, such as encryption, access control, logging and monitoring.
- Breach notification: inform the Data Protection Board and affected individuals of personal data breaches.
- Data principal rights: support access, correction, erasure, grievance redressal and nomination.
- Retention limits: erase data once the purpose is served, subject to legal retention requirements.
- Children's data: obtain verifiable parental consent and avoid tracking or targeted advertising directed at children.
Organisations notified as Significant Data Fiduciaries have additional duties, including appointing a Data Protection Officer in India, periodic data protection impact assessments and independent audits.
Penalties
The Act sets financial penalties by type of breach. The highest, up to 250 crore rupees, applies to failure to take reasonable security safeguards to prevent a personal data breach. Failure to notify breaches and violations involving children's data also carry penalties of up to 200 crore rupees.
A seven-step readiness plan
- Appoint an owner. Someone senior must be accountable for DPDP readiness.
- Map personal data. List every system, spreadsheet and vendor that collects, stores or shares personal data.
- Classify and minimise. Identify sensitive categories and stop collecting what you do not need.
- Review consent and notices. Rewrite notices in plain language and fix consent capture.
- Close security gaps. Prioritise access control, MFA, encryption, DLP, logging and tested backups.
- Build breach response. Define detection, assessment and notification steps, and rehearse them.
- Train your people. Most data breaches involve human error. Awareness training is a safeguard in its own right.
Where security fits in
"Reasonable security safeguards" is where the largest penalty sits, and it is where IT and security teams carry the load. Expect auditors and the Board to ask for evidence: who can access personal data, how access is reviewed, whether data is encrypted, how breaches are detected and how quickly you can respond.
If you are unsure where to start, a structured DPDP readiness assessment will give you a data map, a gap analysis and a prioritised roadmap you can act on.
This article is general information, not legal advice. Consult qualified legal counsel for advice on your specific obligations.