DPDP Act 2023: Requirements, Penalties and Data Principal Rights
Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 is India's law on the processing of digital personal data. It sets the duties of Data Fiduciaries, who decide the purpose and means of processing, and the rights of Data Principals, the individuals the data relates to. Rules 3 and 5 to 16 of the DPDP Rules 2025, which set out most Data Fiduciary duties, come into force on 13 May 2027.
Source: IQWorks Research | Last updated: 2026-10-01
Covers the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Reviewed by IQWorks Research.
Enacted
Aug 11, 2023
Jurisdiction
India
Max Penalty
INR 250 crore
Enforced By
Data Protection Board of India
Who Does the DPDP Act Apply To?
The DPDP Act applies to digital personal data processed in India, whether it was collected in digital form or digitized later, and to processing outside India connected with offering goods or services to Data Principals in India. It does not apply to personal data an individual processes for a personal or domestic purpose, or to personal data made publicly available by the Data Principal or by someone legally required to publish it.
Data Fiduciary Obligations Under the DPDP Act
Notice before consent (section 5, Rule 3)
Every request for consent must be accompanied or preceded by a notice that itemizes the personal data, states the specified purpose and the goods, services or uses it enables, and links to the way the Data Principal can withdraw consent, exercise their rights and complain to the Board. The Data Principal must have the option to read it in English or any language of the Eighth Schedule to the Constitution.
Valid consent (section 6)
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data the specified purpose needs. Withdrawing it must be as easy as giving it. If consent is questioned in a proceeding, the Data Fiduciary has to prove that notice was given and consent obtained.
Legitimate uses (section 7)
Some processing needs no consent: personal data the Data Principal volunteered for a specified purpose without objecting, State benefits and functions, legal obligations to disclose, court orders, medical emergencies, epidemics, disasters, and employment.
Reasonable security safeguards (section 8(5), Rule 6)
At a minimum: encryption, masking or tokenization; access control; logs and monitoring that detect unauthorized access; backups for continued processing; one year of log retention; and security clauses in every Data Processor contract.
Breach intimation (section 8(6), Rule 7)
On becoming aware of a personal data breach, tell each affected Data Principal and the Board without delay, then send the Board a detailed report within 72 hours.
Erasure and retention (section 8(7), Rule 8)
Erase personal data once consent is withdrawn or the specified purpose is no longer served, unless a law requires it to be kept, and have Data Processors erase it too. For the classes in the Third Schedule, warn the Data Principal at least 48 hours before erasure. Keep the personal data, its traffic data and the logs of each processing for at least one year from the date of processing.
Data Processors (section 8(1) and 8(2))
The Data Fiduciary stays responsible for processing done on its behalf, and may engage a Data Processor only under a valid contract.
Contact point and grievances (section 8(9) and 8(10), Rules 9 and 14)
Publish the business contact of a Data Protection Officer or of a person who can answer questions on processing, and run a grievance mechanism that responds within a published period of no more than 90 days.
Significant Data Fiduciary Obligations
The Central Government can notify a Data Fiduciary, or a class of them, as a Significant Data Fiduciary, weighing the volume and sensitivity of the personal data, the risk to Data Principals, and the risks to sovereignty, electoral democracy, the security of the State and public order (section 10). A Significant Data Fiduciary carries these duties on top of the rest:
Data Protection Officer
Based in India, responsible to the board of directors or a similar governing body, and the point of contact for grievance redressal.
Independent data auditor
Appointed to evaluate the Significant Data Fiduciary's compliance with the Act.
DPIA and audit every 12 months
A Data Protection Impact Assessment and an audit once in every 12 months, with a report of the significant observations furnished to the Board (Rule 13).
Due diligence on algorithms
Verify that technical measures, including algorithmic software, used to handle personal data are not likely to pose a risk to the rights of Data Principals.
Specified data stays in India
Personal data the Central Government specifies on a committee's recommendation, and the traffic data of its flow, must not be transferred outside India.
Children's Data Under the DPDP Act
A child is anyone under 18. Section 9 and Rules 10 to 12 add three duties for a child's personal data:
Verifiable parental consent
Before processing a child's personal data, obtain the verifiable consent of a parent, and check that the person consenting is an identifiable adult, using reliable identity and age details already held, details the parent provides, or a virtual token from an authorized entity, which includes a Digital Locker service provider. A person with disability who has a lawful guardian needs the guardian's verifiable consent, and Rule 11 requires checking that the guardian was appointed by a court, a designated authority or a local level committee.
No tracking or targeted advertising
No tracking or behavioral monitoring of children, and no targeted advertising directed at them.
No detrimental processing
No processing likely to cause any detrimental effect on the well-being of a child. Rule 12 and the Fourth Schedule exempt named classes of Data Fiduciaries and purposes from the consent and tracking limits, subject to conditions.
Consent Managers
A Data Principal can give, manage, review and withdraw consent through a Consent Manager, which acts on their behalf and is accountable to them (section 6(7) and 6(8)). Every Consent Manager must register with the Board (section 6(9)). Under Rule 4 and the First Schedule, an applicant must be a company incorporated in India with a net worth of at least INR 2 crore, among other conditions, and the Board publishes the particulars of each one it registers. Registration opens on 13 November 2026.
Transfers Outside India and Exemptions
Transfers outside India (section 16, Rule 15)
Personal data may be transferred outside India except to a country or territory the Central Government restricts by notification, and subject to any requirements it sets for making personal data available to a foreign State. A sectoral law with stricter transfer rules still applies.
Exemptions (section 17)
Most duties do not apply to processing needed to enforce a legal right or claim, by courts and regulators performing their functions, to prevent or investigate offences, for court-approved mergers and restructurings, to trace the assets of a loan defaulter, or to personal data of people outside India processed under a contract with a foreign party. The duty to take reasonable security safeguards still applies.
Notified Data Fiduciaries and startups (section 17(3))
The Central Government can exempt notified Data Fiduciaries, including startups, from the notice duty, the accuracy and erasure duties in section 8(3) and 8(7), the Significant Data Fiduciary duties and the right of access. An exemption applies only once a notification covers that class.
Enforcement by the Data Protection Board
The Data Protection Board of India acts on a breach intimation from a Data Fiduciary, on a complaint from a Data Principal, or on a reference from the government or a court (section 27). It works as a digital office:
- A Data Principal must use the Data Fiduciary's grievance redressal before complaining to the Board (section 13(3))
- After a breach intimation, the Board can direct urgent remedial or mitigation measures
- The Board decides whether there are sufficient grounds for an inquiry, and can close the proceedings if there are not (section 28)
- It can accept a voluntary undertaking at any stage, which bars proceedings on its contents (section 32), or refer a dispute to mediation (section 31)
- An order of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (section 29)
Penalties Under the DPDP Act
The Data Protection Board may impose a monetary penalty when it finds, at the end of an inquiry and after hearing the person, that a breach is significant (section 33(1)). The Schedule to the Act caps each penalty:
| Breach | Section | Maximum penalty |
|---|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | 8(5) | INR 250 crore |
| Failing to give the Board or an affected Data Principal notice of a breach | 8(6) | INR 200 crore |
| Breaching the additional obligations for children | 9 | INR 200 crore |
| Breaching the additional obligations of a Significant Data Fiduciary | 10 | INR 150 crore |
| Breaching the duties of a Data Principal | 15 | INR 10,000 |
| Breaching a voluntary undertaking accepted by the Board | 32 | Up to the penalty for the original breach |
| Breaching any other provision of the Act or the Rules | Any other | INR 50 crore |
In setting the amount, the Board weighs:
- The nature, gravity and duration of the breach
- The type and nature of the personal data affected
- Whether the breach was repeated
- Any gain made or loss avoided as a result of the breach
- The action taken to mitigate it, and how timely and effective that action was
- Whether the penalty is proportionate and effective as a deterrent
- The likely impact of the penalty on the person
For the failures that fall under each head, and a worked example of one incident engaging several, see DPDP penalties explained.
DPDP Rules 2025 Commencement Dates
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)) and corrected on 10 December 2025 (G.S.R. 892(E)), which left the dates unchanged. They commence in three stages:
| Date | Rules | What they cover |
|---|---|---|
| 13 November 2025 | 1, 2 and 17 to 21 | Commencement, definitions, and the constitution and working of the Data Protection Board |
| 13 November 2026 | 4 | Registration and obligations of Consent Managers |
| 13 May 2027 | 3, 5 to 16, 22 and 23 | Notice, security safeguards, breach intimation, retention, contact details, children's data, Significant Data Fiduciary duties, Data Principal rights, transfers outside India, research exemptions, appeals and calls for information |
Data Principal Rights Under the DPDP Act
Right to access information (section 11)
A summary of the personal data being processed and the processing activities, the identities of every other Data Fiduciary and Data Processor it was shared with, and a description of what was shared.
Right to correction and erasure (section 12)
Correction, completion and updating of personal data, and erasure unless keeping it is necessary for the specified purpose or required by law.
Right of grievance redressal (section 13)
A readily available way to raise a grievance with the Data Fiduciary or Consent Manager, answered within its published period of no more than 90 days. The Data Principal must use it before approaching the Board.
Right to nominate (section 14)
Nominate another individual to exercise these rights in the event of the Data Principal's death or incapacity.
Duties of Data Principals (section 15)
Comply with the law, never impersonate anyone, never suppress material information for a State-issued document or proof of identity, never file a false or frivolous grievance, and give only verifiably authentic information when asking for correction or erasure. Breaching these duties carries a penalty of up to INR 10,000.
DPDP Act Implementation
The DPDP compliance guide turns these obligations into a checklist and a roadmap to 13 May 2027. The DPDP penalty calculator shows an indicative exposure for any organization from its public website.
Primary sources: Digital Personal Data Protection Act, 2023 · Digital Personal Data Protection Rules, 2025
IQWorks Solution for DPDP Act Compliance
Notices, consent, children's data, rights requests and breaches for the DPDP Act, on one inventory.
Frequently Asked Questions
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's law on the processing of digital personal data. It sets the duties of Data Fiduciaries, who decide the purpose and means of processing, and the rights of Data Principals, the individuals the data relates to. Rules 3 and 5 to 16 of the DPDP Rules 2025, which set out most Data Fiduciary duties, come into force on 13 May 2027.
What are the penalties under the DPDP Act?
The Schedule caps each penalty per breach: up to INR 250 crore for failing to take reasonable security safeguards, INR 200 crore for failing to notify a breach, INR 200 crore for breaching the children's data duties, INR 150 crore for breaching the Significant Data Fiduciary duties, and INR 50 crore for any other provision. The Data Protection Board of India can impose them after an inquiry and a hearing.
Who does the DPDP Act apply to?
The DPDP Act applies to digital personal data processed in India, whether it was collected in digital form or digitized later, and to processing outside India connected with offering goods or services to Data Principals in India. It does not apply to personal data an individual processes for a personal or domestic purpose, or to personal data made publicly available by the Data Principal or by someone legally required to publish it.
When do the DPDP Rules 2025 take effect?
The Digital Personal Data Protection Act, 2023 received the President's assent on 11 August 2023. The DPDP Rules 2025 were notified on 13 November 2025 and commence in three stages: the rules on the Data Protection Board on 13 November 2025, Rule 4 on Consent Managers on 13 November 2026, and Rules 3 and 5 to 16, which set out most Data Fiduciary duties, on 13 May 2027.
What is a Significant Data Fiduciary under the DPDP Act?
A Data Fiduciary, or a class of them, that the Central Government notifies under section 10, based on the volume and sensitivity of the personal data it processes and the risks to Data Principals and the State. It must appoint a Data Protection Officer based in India and an independent data auditor, and carry out a Data Protection Impact Assessment and an audit every 12 months.
Can a Data Principal complain to the Data Protection Board directly?
Only after using the Data Fiduciary's own grievance redressal, which must answer within its published period of no more than 90 days (section 13(3), Rule 14). The Board then decides whether there are sufficient grounds for an inquiry, and an order of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (section 29).
Compare DPDP Act
Compliance Guides
Related Regulations
Automate DPDP Act Compliance
IQWorks helps organizations achieve and maintain DPDP Act compliance with AI-powered automation.
Request Demo