DPDP Act 2023 and DPDP Rules 2025: Compliance Guide for IT Companies

India's Digital Personal Data Protection Act, 2023 is now on a fixed timetable. The DPDP Rules were notified on 13 November 2025, and the main duties for businesses apply from 13 May 2027. For Indian IT and SaaS companies, and for foreign companies that serve users in India, the next few months are the preparation window. This guide explains who the Act applies to, what Data Fiduciaries and Data Processors must do, how the Rules make the obligations concrete, and how to build a readiness plan.

What is the DPDP Act?

The DPDP Act is India's first comprehensive data protection law. It sets the rules for how organisations collect and use digital personal data, gives individuals rights, and creates the Data Protection Board of India to enforce it. The Digital Personal Data Protection Rules, 2025 fill in the details, such as the content of notices, security safeguards, breach reporting and children's consent.

Full form and definition

DPDP stands for Digital Personal Data Protection. The law is the Digital Personal Data Protection Act, 2023 (No. 22 of 2023). Key terms:

• Data Principal: the individual the data relates to (for a child, including the parent or lawful guardian).
• Data Fiduciary: the organisation that decides the purpose and means of processing (similar to a GDPR controller).
• Data Processor: an organisation that processes data on behalf of a Data Fiduciary.
• Significant Data Fiduciary (SDF): a Data Fiduciary the Central Government notifies based on volume and sensitivity of data and risk factors, with extra duties.
• Consent Manager: a registered entity that lets people give, manage and withdraw consent through an accessible, interoperable platform.

Law, standard or certification?

It is a law with civil financial penalties imposed by the Data Protection Board. There is no DPDP certification; compliance is demonstrated through records, contracts, notices, security controls and, for SDFs, independent data audits.

History and background of the DPDP Act

The Supreme Court's 2017 judgment in Justice K.S. Puttaswamy v. Union of India recognised privacy as a fundamental right and prompted work on a data protection law. After the Justice B.N. Srikrishna Committee report (2018), a Personal Data Protection Bill was introduced in 2019 and withdrawn in 2022. A shorter, principles-based bill was introduced in 2023, passed by Parliament and received Presidential assent on 11 August 2023.

The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules on 13 November 2025, with phased commencement:

DPDP commencement timeline

Date	What applies
13 Nov 2025	Definitions and provisions establishing the Data Protection Board
13 Nov 2026	Registration and obligations of consent managers
13 May 2027	Main obligations: notice, consent, legitimate uses, security safeguards, breach intimation, children's data, rights, retention, SDF duties, processor contracts and penalties

Proposals to shorten the 18-month transition have been reported, but as of October 2026 no change has been notified. Treat 13 May 2027 as the deadline, and plan to be ready earlier.

Why was the DPDP Act introduced?

India had only limited protection through Section 43A of the IT Act 2000 and the SPDI Rules 2011, which covered a narrow set of "sensitive" data and were rarely enforced. Rapid digital adoption, large data breaches and the need for a trusted data economy, including cross-border trade in IT services, required a modern law.

Main objectives and purpose

• Recognise individuals' right to protect their personal data and the need to process it for lawful purposes.
• Make organisations accountable for the data they collect, including through processors.
• Give individuals simple rights and a grievance route.
• Protect children online with verifiable parental consent and limits on tracking and targeted advertising.
• Create a digital-first regulator, the Data Protection Board of India.

Who needs to comply with the DPDP Act?

Any organisation that processes digital personal data in India, whether collected digitally or digitised later, and any organisation outside India that processes personal data in connection with offering goods or services to Data Principals in India (Section 3).

• Indian IT and SaaS companies as Data Fiduciaries for their employees, users and leads, and as Data Processors for client data.
• IT services and BPO companies processing data for Indian clients.
• Foreign SaaS companies serving Indian users.
• E-commerce, fintech, edtech, gaming, health tech and social media platforms, some of which face stricter retention rules and may be notified as SDFs.

What is excluded?

Personal or domestic processing by an individual, and personal data that the Data Principal or someone under a legal duty has made publicly available. Section 17 also exempts certain processing, for example for legal claims, by courts, and for processing the data of people outside India under a contract with a foreign entity, which matters for Indian outsourcers (most duties do not apply, but security safeguards still do).

Geography

India, with extraterritorial reach for those offering goods or services to people in India. Cross-border transfers are allowed by default, except to countries the Central Government restricts by notification (Section 16); sector laws such as RBI data localisation rules continue to apply.

Key requirements of the DPDP Act and Rules

Grounds for processing

Personal data may be processed only for a lawful purpose with consent (Section 6) or for a listed legitimate use (Section 7), such as data voluntarily provided for a specified purpose, employment purposes, medical emergencies or compliance with law. Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and as easy to withdraw as to give.

Notice (Section 5 and Rule 3)

A standalone notice in clear, plain language, with an itemised description of the personal data and the specified purpose, and a link to withdraw consent, exercise rights and complain to the Board. Notices can be in English or any language in the Eighth Schedule of the Constitution.

Security safeguards (Section 8(5) and Rule 6)

Reasonable security safeguards, including at least encryption, obfuscation, masking or virtual tokens where appropriate; access controls; visibility through logs, monitoring and review; backups for continuity; contractual safeguards with processors; and retention of logs and relevant personal data for one year to detect and investigate unauthorised access, unless another law requires otherwise. Failing this duty carries the highest penalty.

Breach intimation (Section 8(6) and Rule 7)

Every personal data breach must be reported, with no materiality threshold:

• To each affected Data Principal, without delay, explaining the breach, likely consequences, mitigation, safety steps and a contact.
• To the Data Protection Board, without delay, followed by a detailed report within 72 hours of becoming aware (or longer if the Board allows).

This sits alongside the 6-hour incident reporting duty to CERT-In under the CERT-In Directions.

Retention and erasure (Section 8(7) and Rule 8)

Erase personal data when consent is withdrawn or the purpose is no longer served. For large e-commerce entities, online gaming intermediaries and social media intermediaries above the user thresholds in the Rules, data must be erased after three years of inactivity, with 48 hours' notice to the user first.

Children and persons with disabilities (Section 9 and Rule 10)

A child is anyone under 18. Processing requires verifiable consent of a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited, subject to exemptions in the Rules.

Data Principal rights (Sections 11 to 14)

Access to information about processing, correction, completion, updating and erasure, grievance redressal, and nomination of another person to exercise rights after death or incapacity. Data Fiduciaries must publish how to exercise rights and respond within the timelines they publish, with grievances resolved within a period of no more than 90 days under the Rules.

Processors and contracts (Section 8(2))

A Data Fiduciary may use a Data Processor only under a valid contract and remains responsible for compliance, including the processor's acts.

Significant Data Fiduciaries (Section 10 and Rule 13)

Appoint a Data Protection Officer based in India, an independent data auditor, and carry out an annual data protection impact assessment and audit, with additional due diligence on algorithmic software.

How to implement DPDP compliance: step by step

1. Determine your roles. For each product, client and internal function, decide whether you are a Data Fiduciary, Data Processor or both, and whether the Section 17 outsourcing exemption applies.
2. Map personal data. Inventory what you collect, the purpose, the ground (consent or legitimate use), systems, processors, retention and transfers.
3. Redesign notices and consent flows. Separate, itemised notices; granular consent where needed; easy withdrawal; records of consent.
4. Close security gaps against Rule 6, using ISO 27001 controls as a practical baseline, and keep logs for at least a year.
5. Build breach response that meets both CERT-In's 6-hour reporting and the DPDP 72-hour Board report plus notices to individuals.
6. Update contracts with processors and with clients, allocating DPDP duties clearly.
7. Set retention schedules and automate deletion.
8. Implement rights and grievance handling with published timelines and a named contact.
9. Review children's data: age gating, parental consent and removal of targeted ads where children may use the service.
10. Train staff and assign an owner, even if you are not an SDF.

Documentation required

• Data inventory and processing register
• Notices, consent records and withdrawal logs
• Legitimate use assessments
• Information security policy and evidence of Rule 6 safeguards
• Processor contracts and client agreements
• Breach response plan, breach log and copies of notifications
• Retention schedule and deletion evidence
• Rights and grievance procedure and logs
• For SDFs: DPIA reports and independent audit reports

Audit and assessment requirements

Only Significant Data Fiduciaries must undergo periodic independent data audits and annual DPIAs. Others are not audited routinely, but the Data Protection Board can inquire into complaints and breaches and impose penalties after an inquiry. Enterprise clients are already adding DPDP questions to vendor security assessments, so most IT companies will face customer-led assessments well before any Board inquiry.

Estimated implementation timeline

Typical readiness plan for an IT or SaaS company

Phase	Duration
Roles, data mapping and gap assessment	4 to 8 weeks
Notices, consent and contracts	6 to 10 weeks
Security, logging and breach process	8 to 16 weeks, in parallel
Rights, retention and deletion automation	6 to 12 weeks
Training and dry run	2 to 4 weeks

Plan for 6 to 12 months in total, finishing well before 13 May 2027.

Cost considerations

• Legal review of notices, contracts and legitimate use positions
• Engineering work on consent, rights, retention and deletion
• Security tooling for encryption, logging and monitoring
• Consent management platforms or integration with registered consent managers
• For SDFs: DPO salary, independent data auditor and DPIA work

Benefits of DPDP compliance

• Avoiding penalties of up to INR 250 crore per instance.
• Readiness for enterprise and government procurement, which will require DPDP clauses.
• Smoother international business: much of the work also supports GDPR and ISO 27701.
• Lower breach impact through minimisation and deletion.

Risks and consequences of non-compliance

Maximum penalties under the Schedule to the DPDP Act

Breach	Maximum penalty
Failure to take reasonable security safeguards to prevent a personal data breach	INR 250 crore
Failure to notify the Board or affected Data Principals of a breach	INR 200 crore
Breach of additional obligations for children	INR 200 crore
Breach of Significant Data Fiduciary obligations	INR 150 crore
Breach of duties by a Data Principal	INR 10,000
Any other breach of the Act or Rules	INR 50 crore

The Board considers factors such as the nature, gravity and duration of the breach, the type of data affected, whether it was repetitive, and mitigation steps taken.

Common implementation mistakes

• Assuming the Section 17 outsourcing exemption removes all duties; security safeguards still apply.
• Bundling consent into terms and conditions.
• Planning only for "serious" breaches when every personal data breach must be reported.
• Ignoring offline data that is later digitised, such as scanned forms.
• No deletion jobs, so data is kept indefinitely "just in case".
• Treating the DPDP Act as a copy of the GDPR; the grounds, rights and penalties differ.

Compliance challenges for IT companies

• Dual roles: an IT services company may be a Data Processor for clients and a Data Fiduciary for its own staff and marketing data.
• Two breach clocks: CERT-In (6 hours, for cyber incidents) and the DPDP Board (without delay, plus 72-hour report).
• Legacy systems without audit logs or deletion capability.
• Children's data in edtech and gaming products, where age verification is hard.
• Section 43A transition: the IT Act's Section 43A and the SPDI Rules are omitted when the main DPDP provisions commence; contracts that reference SPDI should be updated.

Best practices and recommendations

• Start with data minimisation: every field you stop collecting is one less to protect, explain and delete.
• Use one breach response playbook that covers CERT-In, DPDP and any foreign laws such as the GDPR.
• Prefer legitimate uses only where they clearly fit; do not stretch them to avoid consent.
• Build consent and rights as product features, not manual processes.
• Pair DPDP work with ISO 27001 and ISO 27701 for clients who want certified assurance.

Tools and technologies that help

• Consent management platforms that support itemised notices in multiple Indian languages
• Data discovery and classification tools
• Centralised logging with one-year retention
• Encryption, tokenisation and data masking services
• Privacy request portals and ticketing workflows

Relationship with other compliance frameworks

DPDP Act and related requirements

Framework	Relationship
IT Act 2000	The parent cyber law; Section 43A is replaced by the DPDP regime from 13 May 2027
CERT-In Directions	Separate 6-hour cyber incident reporting and log retention duties that continue alongside DPDP
GDPR	Similar principles; GDPR has six lawful bases, a DPO test for all controllers and higher turnover-based fines
ISO 27701	Certifiable privacy management system that can evidence DPDP readiness
ISO 27001	Practical baseline for "reasonable security safeguards"

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

Edtech platform

An edtech company with school-age users introduced age declaration with parental verification through a parent's existing account, removed behavioural advertising from logged-in student pages and rewrote its notices in English and Hindi.

IT services company

A 600-person services company classified its contracts: for foreign clients' data it relied on the Section 17 exemption while keeping security safeguards; for Indian clients it signed processor terms; and for its own HR data it built a DPDP notice, retention schedule and grievance process.

Frequently asked questions

When does the DPDP Act come into force?

In phases. The Board provisions took effect on 13 November 2025, consent manager provisions on 13 November 2026, and the main obligations on 13 May 2027.

Does the DPDP Act apply to foreign companies?

Yes, if they process personal data in connection with offering goods or services to people in India.

Does it apply to non-digital data?

It applies to personal data collected in digital form and to non-digital data that is later digitised. Purely paper records are outside its scope.

What are the penalties under the DPDP Act?

Up to INR 250 crore for failing to take reasonable security safeguards, INR 200 crore for breach notification and children's data failures, INR 150 crore for SDF failures and INR 50 crore for other breaches.

How quickly must a data breach be reported?

To affected individuals and the Board without delay, with a detailed report to the Board within 72 hours of becoming aware of the breach.

Is consent always required?

No. Section 7 lists legitimate uses, such as data voluntarily provided for a specified purpose, employment and legal obligations, that do not need consent.

Who is a child under the DPDP Act?

Anyone under 18. Processing their data requires verifiable parental consent.

Do we need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint a DPO based in India. Other Data Fiduciaries must publish the contact details of a person who can answer questions about processing.

Can data be transferred outside India?

Yes, unless the destination is restricted by government notification, subject to any stricter sector rules and requirements the government may specify.

Does the DPDP Act replace the IT Act?

No. It replaces Section 43A of the IT Act and the SPDI Rules for personal data. The rest of the IT Act, including CERT-In powers, continues.

What is a consent manager?

A company registered with the Data Protection Board that provides a platform for people to give, manage, review and withdraw consent across Data Fiduciaries.

Are Indian IT outsourcers exempt?

Partly. Processing personal data of people outside India under a contract with a foreign entity is exempt from most provisions, but security safeguards still apply.

Conclusion and next steps

The DPDP Act gives Indian companies a clear deadline and a shorter list of rules than the GDPR, but some duties are strict: every breach is reportable, security failures carry the highest penalty and children's data needs parental consent.

1. Map roles and data now.
2. Fix notices, consent and contracts.
3. Strengthen security and logging to Rule 6.
4. Combine CERT-In and DPDP breach response.
5. Automate retention, deletion and rights.

This guide is general information, not legal advice. Get advice from a qualified Indian privacy lawyer for your situation.

How we keep this guide up to date

We review this guide every six months and whenever MeitY or the Data Protection Board issues new notifications, rules, SDF designations, cross-border restrictions or changes to the commencement dates.