India's Digital Personal Data Protection Act
DPDP Act compliance: what the Act and the 2025 Rules require, and when
Who the Act applies to, what a valid notice and consent look like, how the 72-hour breach report sits alongside CERT-In's six hours, and how the Rules phase in up to May 2027.
In short
The Digital Personal Data Protection Act, 2023 is India's law on digital personal data. It sets out when an organisation (a Data Fiduciary) may process personal data, what it must tell people (Data Principals) before asking for consent, the rights those people hold, and what must happen when personal data is breached. The DPDP Rules 2025, notified in November 2025, add the detail and phase the obligations in over 18 months. The Data Protection Board of India enforces the Act and can impose penalties of up to ₹250 crore per instance.
Who the DPDP Act applies to
The Act applies to the processing of digital personal data within India: personal data collected in digital form, or collected offline and then digitised. It also applies to processing outside India when that processing is connected with offering goods or services to Data Principals in India.
Obligations fall mainly on the Data Fiduciary, the organisation that decides why and how personal data is processed. A Data Processor processes data on a Fiduciary's behalf, and the Fiduciary stays responsible for what its processors do.
- Data Principal
- The individual the personal data relates to. For a child or a person with a disability, this includes their parent or lawful guardian.
- Data Fiduciary
- The organisation that, alone or with others, decides the purpose and means of processing.
- Data Processor
- An organisation that processes personal data on behalf of a Data Fiduciary.
- Significant Data Fiduciary
- A Data Fiduciary the Government designates as significant, for example because of the volume or sensitivity of data it processes. It carries extra obligations.
- Consent Manager
- A registered intermediary through which a Data Principal can give, manage, review and withdraw consent.
- Data Protection Board of India
- The body that adjudicates breaches of the Act and imposes penalties.
When the obligations take effect
The Act was enacted on 11 August 2023, but most of it waited for the Rules. The DPDP Rules 2025 were notified in November 2025 and set an 18-month phased commencement. The provisions establishing the Data Protection Board apply from publication. The Consent Manager provisions follow after 12 months. The substantive obligations on Data Fiduciaries, including breach notification, apply after 18 months, which falls in May 2027.
| Phase | When | What applies |
|---|---|---|
| On publication | November 2025 | Data Protection Board of India provisions |
| After 12 months | November 2026 | Consent Manager provisions |
| After 18 months | May 2027 | Substantive obligations on Data Fiduciaries, including breach notification |
What a valid notice and consent require
Where processing rests on consent, the Data Fiduciary must give a notice before or with the request. The consent has to be for a specified purpose, and the Fiduciary has to be able to prove both the notice and the consent if challenged.
- Itemised notice (s.5(1)). The personal data to be processed and the purpose, item by item.
- Rights and withdrawal (s.5(1)). How to withdraw consent, exercise rights and use grievance redressal.
- Complaint route (s.5(1)). How to complain to the Data Protection Board.
- Language (s.5(3)). The notice must be available in English or any of the 22 languages in the Eighth Schedule to the Constitution.
- Consent per purpose (s.6(1)). Consent is given for a specified purpose. A blanket agreement does not count.
- Easy withdrawal (s.6(4)). Withdrawing consent must be as easy as giving it.
- Consent Managers (s.6(7) to (9)). A Data Principal may give or withdraw consent through a registered Consent Manager.
- Proof (s.6(10)). The Data Fiduciary must be able to prove that notice was given and consent obtained.
Breach notification under DPDP and CERT-In
When a personal data breach occurs, the Data Fiduciary must inform each affected Data Principal and the Data Protection Board without delay. A detailed report to the Board follows within 72 hours of becoming aware of the breach, or longer if the Board allows it on written request. There is no materiality threshold: the duty applies to any personal data breach.
CERT-In's Directions under section 70B of the Information Technology Act, 2000 already require certain cyber incidents to be reported to CERT-In within six hours. That obligation is in force today and continues alongside DPDP. One incident can start both clocks.
| Report | To whom | Deadline |
|---|---|---|
| Intimation of breach | Data Protection Board | Without delay |
| Notice of breach | Each affected Data Principal | Without delay |
| Detailed report | Data Protection Board | Within 72 hours of becoming aware (extendable by the Board on request) |
| Cyber incident report | CERT-In | Within 6 hours (in force now, separate from DPDP) |
Extra duties for Significant Data Fiduciaries
The Government can designate a Data Fiduciary as significant. Under the Rules, a Significant Data Fiduciary must carry out a Data Protection Impact Assessment and an audit once every 12 months, and report the significant observations to the Board. Failing to meet Significant Data Fiduciary obligations carries a penalty of up to ₹150 crore.
Penalties under the Schedule
The Data Protection Board of India adjudicates breaches and imposes the penalties set out in the Schedule to the Act. The amounts are maximums per instance.
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board or affected Data Principals of a breach | ₹200 crore |
| Breach of obligations for children's data | ₹200 crore |
| Breach of Significant Data Fiduciary obligations | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
How DPDP compares with GDPR
Teams that already run GDPR will recognise the outline: a controller-like Data Fiduciary, notices, consent, rights and breach reporting. The details differ. DPDP is built around consent and a short list of legitimate uses. It requires notices in English or an Eighth Schedule language, introduces registered Consent Managers, and has no materiality threshold for breach notification. Reuse what you have, but check each obligation against the Act before assuming a GDPR process covers it.
Preparing for DPDP before May 2027
The substantive obligations arrive in May 2027. The slowest part of the work is finding out what personal data you hold and why.
-
01
Map your processing
Record what digital personal data you process, for which purposes, on what basis, and which processors handle it.
Your privacy team
-
02
Rewrite notices per purpose
Itemise the data for each purpose, add withdrawal, rights and Board-complaint instructions, and decide which languages you will offer.
Your privacy and legal teams
-
03
Record consent you can prove
Capture each consent and withdrawal against the exact notice version the person saw.
Your product and privacy teams
-
04
Rehearse the breach route
Agree who decides, and how the Board, affected people and CERT-In are each notified within their deadlines.
Your incident response team
-
05
Bind your processors
Review contracts and assess the Data Processors that handle personal data for you.
Your vendor management and legal teams
Who does what
The Data Protection Board enforces the Act, and the Data Fiduciary is responsible for compliance. Certifyi is a tool. It keeps records and does not notify the Board or CERT-In for you.
| Task | Your team | Certifyi | Data Protection Board |
|---|---|---|---|
| Notice and consent | Give itemised notices and prove consent per purpose | Holds your notices and consent evidence | Adjudicates complaints |
| Breach notification | Notify the Board and Data Principals; report within 72 hours | Keeps the incident record and its timeline | Receives the intimation and report |
| Processors | Remain responsible for processing done on your behalf | Holds processor assessments and questionnaire responses | Holds the Data Fiduciary responsible |
| Significant Data Fiduciary duties | Annual DPIA and audit, with a report to the Board | Holds the DPIA and audit report as evidence | Receives the report |
How Certifyi helps
Keep the DPDP record in one place
Certifyi does not make you DPDP compliant. It keeps your breach records, processor assessments and supporting evidence in one workspace with the rest of your programme.
-
Incident records
Log each breach in the incident register, assign response tasks and keep the timeline. The DPDP and CERT-In deadlines are yours to track.
-
Processor assessments
Assess the Data Processors that handle personal data for you in vendor risk management. Processors answer your questionnaires in their own portal, not by email.
Questions
DPDP, answered
When does the DPDP Act come into force?
In phases. The Act was enacted on 11 August 2023 and the Rules were notified in November 2025. The Board provisions apply from publication, the Consent Manager provisions after 12 months, and the substantive obligations on Data Fiduciaries, including breach notification, from May 2027.
What is the DPDP breach notification timeline?
Inform the Data Protection Board and each affected Data Principal without delay, then send the Board a detailed report within 72 hours of becoming aware. The Board can allow longer on written request. There is no materiality threshold.
Does DPDP replace CERT-In's 6-hour reporting?
No. CERT-In's six-hour reporting of cyber incidents under the IT Act is in force now and continues alongside DPDP. One incident can trigger both.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore per instance, for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach can cost up to ₹200 crore.
What is a Consent Manager under DPDP?
A registered intermediary through which a Data Principal can give, manage, review and withdraw consent. The Consent Manager provisions apply 12 months after the Rules were notified.
Who is a Significant Data Fiduciary?
A Data Fiduciary the Government designates as significant, for example because of the volume or sensitivity of the data it processes. It must run an annual DPIA and audit and report the significant observations to the Board.
Does the DPDP Act apply to companies outside India?
Yes, when the processing is connected with offering goods or services to Data Principals in India, even if it happens outside India.
Does Certifyi make us DPDP compliant?
No. Compliance depends on how you collect, use and protect personal data. Certifyi keeps the incident records, processor assessments and evidence that show what you did.
Get your DPDP record in order before May 2027.
Bring your current privacy notice and a list of the systems that hold personal data. We will show how breach records, processor assessments and evidence sit together in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them