Digital Personal Data Protection (DPDP) Act, 2023 and DPDP Rules, 2025: Complete Compliance Guide for Indian Businesses
Introduction
Personal data has become an essential part of modern business operations. Organisations collect and process information when customers create accounts, employees join an organisation, patients book appointments, students enrol in courses, users purchase products or businesses provide digital services. This information enables organisations to deliver services, improve operations and communicate with their customers. However, the collection and use of personal data also create legal, security and privacy responsibilities.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a legal framework governing the processing of digital personal data. The Digital Personal Data Protection Rules, 2025 (DPDP Rules) provide detailed requirements for implementing several provisions of the Act.
The Act received presidential assent on 11 August 2023. The Central Government subsequently notified the DPDP Rules in November 2025 and issued a phased commencement schedule. Consequently, organisations must distinguish between provisions that are already in force and substantive obligations scheduled to commence later. The date on which a law is enacted, the date on which it is published and the date on which a particular obligation becomes enforceable are not necessarily the same.
The Government's official announcement explains that the framework is intended to strengthen individual privacy, improve transparency and accountability, and support responsible processing of digital personal data. The Act and Rules address matters such as consent, notices, security safeguards, personal data breaches, children's data, individual rights, retention, cross-border transfers and regulatory enforcement.
Official sources:
The legal documents linked above should be read together with the subsequent corrigendum and any later applicable notifications or amendments. The article below is an original explanatory and implementation guide, not a substitute for the official statutory text.
1. Understanding the DPDP Act and its purpose
The DPDP Act creates a framework for processing digital personal data while recognising individuals' rights and the responsibilities of organisations that determine why and how personal data is processed.
Its application depends on the nature of the data, the processing activity, the parties involved and the statutory scope of the Act.
Section 3 addresses the application of the Act. In broad terms, it covers digital personal data processed within India, including personal data collected in non-digital form and subsequently digitised. It also addresses processing outside India where the processing is connected with an activity related to offering goods or services to Data Principals within India, subject to the statutory wording.
The Act does not apply identically to every category of information or every processing situation. Section 3 contains exclusions, and Section 17 provides specific exemptions. Organisations must assess these provisions rather than assume that all information or every activity falls within the same legal framework.
1.1 What is personal data?
Personal data is data about an individual who is identifiable by or in relation to that data.
Examples may include:
Name and contact details.
Email address and telephone number.
Customer account identifiers.
Employee records linked to identifiable individuals.
Identity and verification information.
Digital account and transaction records.
Photographs or other digital information that identifies an individual.
Information about a person's interactions with a service, where the information is personal data.
Whether a particular data field qualifies as personal data depends on the circumstances and the statutory definition. An organisation should not classify information as anonymous merely because it replaces a person's name with an internal identifier.
1.2 What is digital personal data processing?
Processing includes operations performed on digital personal data, such as collection, recording, organisation, storage, use, sharing, disclosure and erasure.
For example, when an online retailer collects a customer's name and address, stores an order, shares delivery information with a logistics provider and retains the transaction record, several processing activities occur.
Each activity should be assessed for its purpose, applicable legal basis, access requirements, retention period and relevant security controls.
1.3 What are the central principles?
The Government's explanation of the framework highlights principles such as consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability.
These principles translate into practical expectations:
Collect only information that is relevant to the specified purpose.
Explain the purpose clearly.
Identify the applicable legal basis for processing.
Protect personal data against unauthorised access, loss and misuse.
Retain information according to applicable legal and operational requirements.
Provide the rights and grievance mechanisms required by law.
Maintain sufficient evidence to demonstrate compliance.
The detailed statutory requirements take precedence over any general summary of these principles.
2. Important terminology: who is responsible for what?
Understanding the parties involved is essential because responsibilities depend on their actual role, not merely the name of a department or the description in a contract.
2.1 Data Principal
A Data Principal is the individual to whom the personal data relates.
Examples include a customer, employee, student, patient or registered user, where the relevant information relates to that individual.
The Act gives Data Principals specified rights and places certain responsibilities on them.
2.2 Data Fiduciary
A Data Fiduciary is the person who, alone or in conjunction with others, determines the purpose and means of processing personal data.
Examples may include an e-commerce business determining how customer information is used, an employer determining how employee information is processed, or a digital service deciding how it processes user account information.
A business may have different roles in different processing activities. Its role must be assessed on the facts.
2.3 Data Processor
A Data Processor processes personal data on behalf of a Data Fiduciary.
Examples may include cloud hosting providers, outsourced payroll companies, customer-support vendors and CRM providers.
A Data Fiduciary must take appropriate steps to ensure that its processing arrangements comply with applicable legal requirements. Under the DPDP framework, a Data Fiduciary's use of a processor does not automatically remove the Fiduciary's statutory responsibility.
2.4 Significant Data Fiduciary
A Significant Data Fiduciary (SDF) is an entity notified by the Central Government under Section 10, based on the statutory framework and applicable criteria.
An organisation should not assume that it is an SDF merely because it has a large customer base. Equally, it should not assume that it cannot be an SDF simply because it is privately held or operates in a particular industry.
The organisation should monitor relevant notifications and obtain a documented legal assessment of its status.
2.5 Consent Manager
A Consent Manager is a registered entity that enables Data Principals to manage their consent through the framework established by the Act and Rules.
Not every business must register as a Consent Manager. Registration and operational requirements apply to entities seeking to perform that regulated role.
3. Commencement and implementation deadlines
One of the most important compliance issues is understanding when the different provisions become effective.
The Act was enacted in 2023, but the commencement notification issued under Section 1(2) divides its provisions into different stages.
Similarly, Rule 1 of the DPDP Rules establishes a phased commencement schedule.
The official Gazette documents are dated 13 November 2025. The Ministry's portal and Government announcements record publication on 14 November 2025. Because the instruments refer to the date of publication in the Official Gazette, the Gazette record and any applicable legal interpretation must be considered together.
For conservative project planning, organisations should use the earlier potentially applicable date until Legal confirms the operative calculation.
3.1 Commencement of the Act
The commencement notification establishes three broad stages.
Stage One: provisions effective upon publication
The notification brings into force the specified preliminary, institutional and related provisions, including Section 2, Sections 18–26, Sections 35 and 38–43, and specified parts of Section 44.
Stage Two: provisions scheduled one year after publication
Section 6(9) and Section 27(1)(d) are included in the one-year stage.
Stage Three: provisions scheduled eighteen months after publication
This stage includes Sections 3–5, the specified subsections of Section 6, Sections 7–17, most of Section 27, Sections 28–34, Sections 36–37 and the specified remaining part of Section 44.
The precise legal effect of a provision depends on the wording of the commencement notification and any later instrument that modifies or clarifies it.
3.2 Commencement of the Rules
Rule 1 of the DPDP Rules, 2025 specifies the following schedule:
On the Gazette publication calculation, the corresponding planning dates are 13 November 2026 and 13 May 2027. Because the Ministry's public portal records 14 November 2025, organisations should have their Legal team confirm the applicable computation against the original Gazette and any later notification.
The safer operational approach is to complete Rule 4-related preparation before 13 November 2026 and the main operational work before 13 May 2027, subject to formal legal confirmation.
These dates are not interchangeable with an organisation's internal project milestones. A business may establish earlier completion targets to allow time for testing and remediation.
3.3 Why phased commencement matters
An obligation appearing in the Rules is not necessarily enforceable from the day the Rules were announced.
For each obligation, the organisation should document:
The relevant Act section.
The relevant Rule and Schedule, if applicable.
The commencement provision.
The operative date.
Any amendment, corrigendum or exemption affecting that obligation.
The evidence required to demonstrate compliance.
This process prevents two common mistakes: treating a future requirement as already enforceable without checking its commencement, and assuming that a future deadline means the organisation should postpone all preparation.
4. Rule-by-rule analysis and implementation requirements
Rule 1: Short title and commencement
Rule 1 establishes the name of the Rules and their phased commencement.
What the organisation must do
Legal and Compliance should create a statutory obligations register that records each applicable Rule, its commencement date, the relevant business process and the responsible owner.
The register should distinguish binding requirements from recommended internal practices.
Rule 2: Definitions
Rule 2 provides definitions and explains that terms used in the Rules but not independently defined generally carry the meanings assigned in the Act.
What the organisation must do
Legal, Privacy and Data Governance should use the statutory definitions when designing policies and allocating responsibilities. Internal terminology should not conflict with the legal meaning of Data Principal, Data Fiduciary, Data Processor or Consent Manager.
Rule 3: Notice to the Data Principal
Rule 3 establishes detailed notice requirements.
The notice must be independently understandable, use clear and simple language and provide the information needed for informed consent.
It must include an itemised description of the personal data being processed, the specific purpose or purposes of processing, and a description of the goods, services or uses enabled by that processing.
It must also provide a link to the Data Fiduciary's website or app and explain the available means of withdrawing consent, exercising rights and making a complaint to the Board.
Implementation requirements
The organisation should:
Inventory every relevant data-collection point.
Map each data category to a specific processing purpose.
Draft a standalone notice in understandable language.
Provide accessible links or methods for exercising rights.
Explain how consent can be withdrawn.
Obtain Legal approval before deployment.
Record the notice version displayed to the user.
Test the notice on relevant devices and platforms.
The notice should be consistent with the actual processing activity. A broad statement about improving the user experience should not be used as a substitute for explaining the specific purpose.
Responsible teams: Legal, Privacy, Product, UX, Engineering and Marketing.
Evidence: Approved notices, version history, deployment records, screenshots and testing reports.
Rule 4: Registration and obligations of Consent Managers
Rule 4 and the First Schedule establish registration conditions and obligations for Consent Managers.
The First Schedule includes requirements relating to incorporation in India, financial and operational capacity, management integrity, minimum net worth and other specified conditions.
The Rules also establish requirements concerning consent management, records, transparency, security and independence.
Implementation requirements for an applicant
An entity seeking registration should:
Assess the First Schedule's eligibility requirements.
Prepare the required corporate and financial documents.
Establish appropriate governance and operational capacity.
Design the consent management platform in accordance with applicable requirements.
Implement security, recordkeeping and conflict-of-interest controls.
Follow the Board's registration process and applicable directions.
Implementation requirements for ordinary Data Fiduciaries
A business that is not seeking Consent Manager registration should focus on its own consent and withdrawal obligations. It should not assume that it must itself register as a Consent Manager.
Responsible teams: Legal, Corporate Governance, Product, Engineering, Security and Finance.
Rule 5: Processing for State benefits, services, certificates, licences and permits
Rule 5 addresses processing by the State and its instrumentalities for the provision or issue of specified benefits, services, certificates, licences and permits.
It refers to standards set out in the Second Schedule.
This is not a general authorisation for every private business to process personal data without consent.
Implementation requirements
Covered public authorities and relevant entities should assess the legal basis for processing, the necessity of the information, accuracy, retention, security and applicable rights-related requirements.
Private businesses should not apply Rule 5 to unrelated commercial processing simply because they provide services to customers.
Responsible teams: Legal, Government Relations, Public Administration and relevant service owners.
Rule 6: Reasonable security safeguards
Rule 6 establishes safeguards intended to protect personal data against personal data breaches.
The Rule specifies minimum measures, including appropriate encryption, masking or other security measures, access controls, monitoring, logs, backup measures and contractual safeguards involving Data Processors.
Implementation requirements
The organisation should establish and test controls covering:
Access permissions and privileged accounts.
Encryption and appropriate masking or tokenisation.
Security monitoring and detection.
Investigation of unauthorised access.
Backup and recovery.
Relevant logging and review.
Security requirements in processor contracts.
Technical and organisational measures to prevent and respond to breaches.
The exact control design should reflect the processing environment and the requirements of the Rule.
Responsible teams: Chief Information Security Officer, IT, Engineering, Cloud Operations, Procurement and Internal Audit.
Evidence: Security configurations, access reviews, monitoring records, incident reports, recovery tests, vendor assessments and remediation records.
A policy that says data is encrypted does not establish that encryption is actually implemented. Compliance evidence should demonstrate the control's operation.
Rule 7: Intimation of personal data breaches
Rule 7 establishes requirements for notifying affected Data Principals and the Data Protection Board.
The Rule requires prompt notification to affected individuals and an initial intimation to the Board without delay.
It also requires updated and detailed information to be provided to the Board within seventy-two hours of becoming aware of the breach, unless the Board allows a longer period.
The detailed information includes relevant facts concerning the breach, its causes or circumstances, mitigation measures, remedial action and communications to affected individuals.
Implementation requirements
The organisation should:
Establish a formal incident-response process.
Define when an incident must be escalated as a suspected personal data breach.
Record discovery and awareness timestamps.
Preserve relevant logs and evidence.
Assess the affected data, individuals and likely consequences.
Prepare the Board's initial intimation.
Prepare the detailed follow-up report.
Notify affected individuals in the manner required by the Rule.
Record mitigation and remediation.
Test the process through simulated incidents.
The seventy-two-hour period relates to the detailed Board intimation. It should not be described as a universal deadline for erasing personal data or as the sole deadline governing every communication to affected individuals.
Responsible teams: Security, Incident Response, Legal, Privacy, Communications and Customer Support.
Rule 8: Retention and erasure for specified purposes
Rule 8 addresses when a specified purpose is deemed no longer served for covered Data Fiduciaries, and it establishes a separate minimum-retention requirement for specified purposes in the Seventh Schedule.
The Rule must be read with the Third Schedule, Seventh Schedule, Section 8(7) and any other applicable legal retention requirements.
Specified classes and inactivity periods
The Third Schedule includes thresholds and specified-purpose conditions for certain e-commerce entities, online gaming intermediaries and social media intermediaries.
The thresholds include:
E-commerce entities with at least two crore registered users in India.
Online gaming intermediaries with at least fifty lakh registered users in India.
Social media intermediaries with at least two crore registered users in India.
For the covered activities, the Third Schedule specifies the applicable inactivity period, including the three-year period where specified, subject to the exact conditions and exceptions in the Schedule.
At least forty-eight hours before erasure under Rule 8(1), the Data Fiduciary must inform the Data Principal that the data will be erased unless the person takes an action specified by the Rule.
Minimum one-year retention
Rule 8(3) separately requires retention of relevant personal data, associated traffic data and other processing logs for a minimum of one year from the processing date for the purposes specified in the Seventh Schedule.
After that period, erasure is required unless further retention is necessary under another applicable law or Government notification.
This is a specific legal requirement, not a blanket permission to retain all personal data indefinitely.
Implementation requirements
The organisation should:
Establish a data inventory.
Map each data category to its purpose.
Identify statutory and regulatory retention requirements.
Define retention periods and the events that start them.
Automate deletion where appropriate.
Address replicas, analytics systems and relevant processor systems.
Document backup retention and restoration procedures.
Implement legal-hold exceptions where legally required.
Retain evidence of deletion and exception approvals.
Responsible teams: Data Governance, Engineering, Legal, Security, Records Management and Procurement.
Rule 9: Contact information for processing-related questions
Rule 9 requires every Data Fiduciary to prominently publish relevant business contact information on its website or app.
Where applicable, the contact is that of the Data Protection Officer. Otherwise, the organisation should identify a person who can answer questions about personal data processing on its behalf.
The relevant contact information must also appear in every response to a communication exercising Data Principal rights under the Act.
Implementation requirements
The organisation should publish the appropriate contact information, establish an accountable mailbox or case-management process, provide backup ownership and include the contact details in rights-response templates.
The general contact requirement should not be confused with the specific DPO appointment obligation applicable to Significant Data Fiduciaries.
Rule 10: Verifiable consent for children's personal data
Section 9 of the Act and Rule 10 establish requirements concerning the processing of children's personal data.
The Act defines a child as an individual who has not completed eighteen years of age.
Rule 10 requires appropriate technical and organisational measures to obtain verifiable parental consent before processing a child's personal data, subject to applicable statutory exemptions.
The Rule describes methods involving reliable identity and age details, including relevant information available to the Data Fiduciary or information voluntarily provided by the individual or through a qualifying virtual token.
Implementation requirements
Organisations should:
Identify products and services likely to involve children's data.
Determine whether the Act's child-data requirements apply.
Implement an appropriate age and parental-verification process.
Ensure that verification methods satisfy the applicable Rule.
Review tracking, behavioural monitoring and targeted advertising.
Assess whether a statutory exemption applies.
Record the basis for any exemption relied upon.
The organisation should not collect excessive identity information merely because a verification process is needed. The verification design should satisfy the legal requirement while taking security and data-minimisation considerations into account.
Rule 11: Consent through lawful guardians for persons with disabilities
Rule 11 addresses verifiable consent involving a lawful guardian in the circumstances specified by the Act and Rules.
The relevant legal test must be applied carefully. Disability alone should not automatically be treated as proof that a person cannot make the relevant legal decision.
Implementation requirements
The organisation should establish a legally reviewed process for determining when guardian involvement is required, verifying the relevant guardian and recording the legal basis for the processing.
The process should be consistent with the applicable law governing guardianship and the person's legal capacity.
Rule 12: Exemptions relating to children's data
Rule 12 and the Fourth Schedule specify particular circumstances in which certain child-data obligations are exempt, subject to the stated conditions.
These exemptions must be interpreted narrowly and in the context of the actual statutory language.
Implementation requirements
For every exemption relied upon, maintain a record of:
The applicable legal provision.
The covered processing purpose.
The relevant conditions.
The business process relying on the exemption.
The controls required by the exemption.
The approving Legal or Compliance owner.
The date of the last review.
An exemption for one specified activity should not automatically be extended to unrelated processing.
Rule 13: Significant Data Fiduciaries
Rule 13 establishes enhanced obligations for Significant Data Fiduciaries.
These include periodic Data Protection Impact Assessments, audits and reporting of significant observations, together with due diligence relating to specified algorithmic software and compliance with applicable Government restrictions concerning certain data and transfers.
Implementation requirements
Once an organisation's SDF status is established, it should:
Confirm the applicable notification and commencement provisions.
Establish governance and accountability arrangements.
Appoint the required Data Protection Officer.
Arrange the required independent data audit.
Establish a periodic DPIA process.
Review the relevant algorithms and technical systems.
Assess applicable restrictions on transfers of specified data.
Document findings, remedial actions and required reports.
DPIA and audit obligations should be scheduled according to the actual statutory and Rule requirements. A business should not assume that the same enhanced requirements apply to every Data Fiduciary.
Rule 14: Rights of Data Principals
Rule 14 addresses the exercise of Data Principal rights and the arrangements needed to support those rights.
The Act provides rights including access to information about personal data, correction and updating, erasure where applicable, grievance redressal and nomination.
The exact scope of each right must be assessed under the relevant section of the Act.
Rule 14 requires the Data Fiduciary to publish information about the means by which rights can be exercised. It also establishes requirements concerning grievance redressal, including a reasonable response period that cannot exceed ninety days.
Implementation requirements
The organisation should provide a clear route for requests, verify the request where appropriate, track deadlines, identify the relevant data and systems, assess any lawful retention exception and communicate the outcome.
The rights process should cover relevant systems and processors rather than only the primary customer database.
Responsible teams: Privacy, Legal, Customer Support, Engineering, Data Governance and relevant business owners.
Rule 15: Transfer of personal data outside India
Rule 15 establishes the framework under which personal data may be transferred outside India, subject to requirements specified by the Central Government.
It should not be interpreted as an automatic prohibition on every international transfer.
Other applicable legal and sector-specific requirements may impose additional conditions, including localisation or restrictions on particular types of data.
Implementation requirements
The organisation should identify:
Overseas hosting and storage.
International vendor access.
Subprocessors located outside India.
Remote support arrangements.
Applicable Government restrictions.
Sector-specific transfer or localisation obligations.
Relevant contractual and security safeguards.
The organisation should document the legal basis for its transfer arrangements and review them when the relevant rules or Government directions change.
Rule 16: Research, archiving and statistical purposes
Rule 16 addresses specified processing for research, archiving and statistical purposes, subject to the conditions and standards in the Second Schedule.
An organisation should not assume that labelling a project as research or analytics automatically exempts it from the Act.
Implementation requirements
The relevant team should document the research purpose, applicable exemption, data categories, access arrangements, security controls and retention practices.
Legal should verify that the actual processing satisfies the statutory conditions.
Rules 17–21: Institutional and procedural framework
Rules 17–21 form part of the initial commencement stage and address institutional and procedural matters associated with the Data Protection Board framework and related functions.
Organisations should monitor official Board notifications, applicable procedural requirements and any directions that affect their operations.
Legal and Compliance should establish a process for reviewing relevant regulatory developments and distributing them to the responsible teams.
Rule 22: Appeals
Rule 22 concerns the appeal framework for relevant orders under the statutory regime.
It should not be confused with the general erasure provisions.
Implementation requirements
Legal should maintain procedures for receiving regulatory orders, preserving evidence, escalating decisions, assessing appeal rights and tracking applicable deadlines.
Rule 23: Information calls
Rule 23 concerns the specified circumstances in which information may be sought under the regulatory framework.
Implementation requirements
The organisation should designate an authorised response owner, establish an internal document-preservation process, verify the scope of the request, obtain appropriate legal review and track the response to closure.
The exact requirements should be checked against the operative text of Rule 23 and any applicable correction.
5. Consent management: what a compliant system should look like
Consent is a central element of the DPDP framework, but it is not the only lawful basis for processing.
Section 6 establishes the consent framework, while Section 7 recognises specified legitimate uses. A business should identify the correct legal basis for each processing activity rather than automatically treating every activity as consent-based.
Where consent is required, the organisation should be able to demonstrate that it was validly obtained.
A practical consent record may include:
The Data Principal or relevant account identifier.
The specified processing purpose.
The applicable notice version.
The consent action.
The date and time of the action.
The relevant system or collection point.
Subsequent withdrawal or modification.
Evidence of downstream handling.
This list is a recommended evidence model; the precise statutory recordkeeping requirement depends on the applicable provision.
Consent withdrawal
The Act requires withdrawal to be as easy as giving consent.
The organisation should therefore avoid making withdrawal materially more difficult than the original consent process.
A practical withdrawal workflow should identify the affected purpose, update the consent record, stop processing that depends on the withdrawn consent where required, notify relevant downstream systems and assess any separate lawful basis or retention obligation.
Withdrawal does not necessarily require deletion of every record if another applicable law requires retention. Equally, a retention obligation should not be used as a blanket reason to continue unrelated processing.
6. Data security and breach management
Security compliance must be implemented in actual systems, not merely described in policy documents.
The Rule 6 safeguards and Rule 7 breach requirements should be integrated into the organisation's existing security and incident-management programme.
6.1 Recommended security controls
The organisation should assess the following areas:
Identity and access management: Restrict access according to role, review privileged access and remove access when no longer needed.
Encryption and data protection: Apply appropriate encryption, masking, obfuscation or other measures to relevant data stores and transfers.
Monitoring and investigation: Maintain appropriate logs and monitoring to detect, investigate and respond to unauthorised access.
Backup and recovery: Establish appropriate backup arrangements and test restoration.
Processor controls: Include relevant security obligations in contracts and assess whether vendors actually implement the agreed controls.
Incident management: Establish escalation channels, evidence preservation, communications approval and remediation procedures.
6.2 Breach-response workflow
A useful internal workflow is:
Detect and record the incident.
Escalate it to the incident-response owner.
Determine whether personal data may have been affected.
Preserve evidence and investigate.
Identify the affected systems, data and individuals.
Take appropriate containment and mitigation measures.
Notify affected Data Principals as required.
Inform the Board without delay.
Provide detailed Board information within the applicable period.
Document remedial actions and lessons learned.
The organisation should establish internal escalation targets substantially earlier than the external reporting deadlines so that the team has time to investigate and prepare accurate notifications.
7. Retention and deletion: avoiding both over-retention and unlawful deletion
Retention is not a one-size-fits-all exercise.
A company may have different obligations for customer accounts, orders, invoices, employee records, support tickets, security logs and regulatory records.
For each category, the organisation should document:
The processing purpose.
The relevant legal basis.
The retention period.
The event that starts the retention period.
Any statutory minimum or maximum.
Any applicable Rule 8 requirement.
Any legal hold or regulatory exception.
The deletion process and evidence.
Rule 8(3) is particularly important because it specifies minimum retention for certain data and logs used for Seventh Schedule purposes. It must be reconciled with other legal retention requirements and with the specific erasure provisions applicable to the organisation.
The correct objective is not to delete everything immediately or to retain everything indefinitely. It is to retain the required information for the appropriate period and erase it when the applicable legal and operational conditions permit or require erasure.
8. Rights and grievance management
The organisation should treat Data Principal rights as an operational service, not merely a clause in the privacy policy.
A rights-handling process should establish:
How a request can be submitted.
How the request is verified.
How the relevant records are located.
How the requested action is assessed under the Act.
How exceptions and legal retention duties are considered.
Who approves the response.
How the response is communicated.
How the case is closed and recorded.
The process should cover access, correction, completion, updating, erasure, grievance redressal and nomination to the extent provided by the applicable provisions.
The organisation should also publish the relevant means of exercising rights and ensure that contact information is included in responses where required by Rule 9.
The maximum ninety-day grievance period under Rule 14 should not be treated as a universal deadline for every type of privacy request. Each request should be mapped to its own applicable statutory requirements.
9. Children and persons requiring lawful guardians
Organisations whose services may involve children should review their product design, age-related data flows, parental verification and advertising practices.
The relevant legal framework includes Section 9 and Rules 10–12, subject to the applicable commencement dates and statutory exemptions.
A compliant programme should identify the relevant users and processing purposes, implement an appropriate verification process, review prohibited or restricted activities, and document any exemption relied upon.
Where lawful-guardian consent is relevant, the organisation must apply the correct legal test rather than assume that disability automatically requires a guardian.
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, listed by MeitY in October 2026, is also an important document to review for the exact amended statutory wording. Legal teams should read the Order itself before finalising child-data and lawful-guardian policies.
10. Significant Data Fiduciaries: enhanced compliance
A Significant Data Fiduciary should maintain an enhanced governance framework once its designation and the relevant obligations are applicable.
The organisation should assess the requirements for:
A Data Protection Officer.
An independent data auditor.
Periodic Data Protection Impact Assessments.
Periodic data audits.
Reporting of significant observations.
Due diligence relating to specified algorithmic software.
Compliance with applicable restrictions concerning specified data and overseas transfers.
These requirements should be integrated into enterprise risk management, product governance, security assurance and internal audit.
The organisation should also track any applicable notification that specifies additional obligations or changes the relevant scope.
11. Cross-border processing and third-party vendors
Modern organisations frequently rely on cloud hosting, analytics platforms, CRM tools, customer-support providers and international software services.
The organisation should identify the personal data each vendor processes, the purpose of processing, the vendor's role, the location of storage, the access arrangements and any relevant subprocessors.
Contracts should address appropriate security safeguards and the operational support needed to meet applicable statutory duties.
Cross-border transfers should be assessed under Rule 15, relevant Government restrictions and applicable sectoral laws.
The organisation should not assume that a general contractual clause overrides statutory localisation or transfer restrictions.
12. Department-wise implementation responsibilities
DPDP compliance should be run as a cross-functional programme with a designated executive sponsor.
The following allocation is a recommended governance model. It is not a statutory list of mandatory job titles.
Board of Directors and executive management
Management should approve the programme, assign resources, review major risks and ensure that unresolved high-risk gaps are escalated.
Legal and Compliance
Legal should interpret the Act and Rules, maintain the obligations register, assess exemptions, approve notices and contracts, track regulatory changes and coordinate regulatory responses.
Privacy and Data Governance
This function should maintain the processing inventory, data-flow mapping, purpose register, retention schedule, rights-request process and evidence repository.
Information Security
Security should implement and test access controls, encryption, monitoring, incident response, backup and recovery, and processor security assessments.
Engineering and IT
Engineering should implement the necessary technical changes, including consent records, notice versions, access controls, retention automation, deletion workflows and rights-request integrations.
Product and User Experience
Product teams should ensure that notices, consent mechanisms and rights interfaces are understandable, accessible and consistent with actual processing.
HR
HR should map employee and candidate data, review relevant notices and access controls, and assess the legal basis and retention requirements for employment-related processing.
Marketing and Sales
Marketing should review lead-generation forms, campaign databases, tracking technologies, advertising use cases and consent-dependent processing.
Procurement and Vendor Management
Procurement should maintain the processor inventory, review contracts, conduct relevant vendor assessments and track remediation.
Internal Audit
Internal Audit should test whether controls work in practice, document findings and independently verify remediation.
13. Recommended compliance roadmap
The following roadmap is an internal project plan, not a statutory deadline schedule.
Phase 1: Immediate legal and governance assessment
Confirm the operative commencement dates, review applicable corrigenda and amendments, appoint an executive sponsor and identify the responsible workstream owners.
Phase 2: Data discovery and mapping
Inventory personal data, processing purposes, systems, vendors, transfers and retention practices.
Phase 3: Gap analysis
Compare existing processes with the applicable statutory requirements. Prioritise security, breach notification, notice and consent, rights handling and retention.
Phase 4: Policy and contract remediation
Update notices, consent processes, privacy procedures, processor contracts, incident-response plans and retention schedules.
Phase 5: Technical implementation
Build or update the systems needed to support consent evidence, withdrawal, rights requests, access control, monitoring, deletion and reporting.
Phase 6: Testing and training
Test relevant user journeys, security controls, deletion workflows, breach-response procedures and vendor escalation. Train the teams responsible for operating these processes.
Phase 7: Assurance and sign-off
Conduct a documented readiness review, close critical gaps and obtain management approval supported by evidence.
Phase 8: Continuous monitoring
Maintain ongoing legal-update monitoring, periodic control testing, vendor reviews, incident exercises and remediation tracking.
Organisations should set earlier internal targets than the applicable legal deadlines. Where the relevant provision has already commenced, the organisation should not delay compliance merely because a broader project plan remains incomplete.
14. Penalties and regulatory exposure
Section 33 and the Schedule to the DPDP Act establish monetary penalty ceilings for specified contraventions.
The statutory maximums include:
These are statutory ceilings, not automatic fines for every instance of non-compliance.
The Board must follow the applicable statutory process when determining a penalty. The organisation should not assume that a minor policy correction, a security incident or an incomplete notice automatically attracts the maximum penalty.
The appropriate response is to maintain a documented compliance programme, investigate incidents, remediate gaps and preserve evidence of the controls actually implemented.
15. Common mistakes organisations should avoid
Mistake 1: Treating publication and commencement as the same thing. Different provisions have different commencement dates.
Mistake 2: Assuming every activity requires consent. The Act recognises specified legitimate uses, subject to the statutory conditions.
Mistake 3: Using a generic privacy notice. Rule 3 requires a clear notice containing the specified information.
Mistake 4: Treating the seventy-two-hour breach period as a universal deletion deadline. The period concerns detailed Board breach information under Rule 7.
Mistake 5: Assuming every organisation must appoint a DPO. The statutory DPO requirement for Significant Data Fiduciaries must be distinguished from the broader contact-information requirement.
Mistake 6: Assuming every international transfer is prohibited. Rule 15 establishes a framework subject to Government-specified requirements and restrictions.
Mistake 7: Retaining all data indefinitely. Retention must be assessed against the purpose, applicable law, Rule 8 and other relevant requirements.
Mistake 8: Treating an exemption as unlimited permission. Exemptions apply only within their statutory scope and conditions.
Mistake 9: Relying on vendor assurances without verification. Processor contracts and security controls should be reviewed and tested.
Mistake 10: Considering a published policy sufficient proof of compliance. Evidence of actual implementation and control effectiveness is essential.
16. Official-Source Verification and Legal Update Process
To ensure accuracy and reduce the risk of misleading readers, this article has been prepared with reference to official Government of India sources. The following sources should be used as the primary reference points when verifying the Digital Personal Data Protection (DPDP) Act, 2023, the DPDP Rules, 2025, their commencement provisions, and subsequent legal updates.
Digital Personal Data Protection Act, 2023 — Official Act PDF
https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdfDigital Personal Data Protection Rules, 2025 — Official MeitY Documents Page
https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digital-Personal-Data-Protection-Rules-2025DPDP Act Commencement Notification — G.S.R. 843(E)
https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdfMinistry of Electronics and Information Technology (MeitY) — Official Updates
https://www.meity.gov.in/whats-newExplanatory Note to the DPDP Rules, 2025
https://www.meity.gov.in/writereaddata/files/Explanatory-Note-DPDP-Rules-2025.pdf
How These Sources Should Be Interpreted
The DPDP Act, 2023, the notified DPDP Rules, 2025, and applicable Gazette notifications should be treated as the principal legal reference documents. Official ministry webpages are useful for locating documents, checking publication details, and identifying subsequent updates or corrigenda.
Explanatory notes, government announcements, and other guidance materials can help readers understand the framework. However, they should not be treated as substitutes for the applicable statutory provisions or notified Rules.
Before relying on a particular requirement, readers should verify the relevant section or rule, applicable schedules, commencement notification, and any subsequent amendment, corrigendum, or other legally relevant notification.
Important: Legal requirements may come into force in phases. The publication of an Act or Rule does not necessarily mean that every provision becomes applicable on the same date. Compliance dates should therefore be checked against the relevant commencement provisions and official notifications.
This article is intended for general informational and compliance-planning purposes. It is not a substitute for legal advice tailored to a particular organisation or processing activity.
17. Final conclusion
The Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 require organisations to approach personal data protection as a combination of legal compliance, operational governance and technical security.
The correct implementation process begins with legal applicability and commencement verification. It then moves to data discovery, processing-purpose mapping, notices and consent, security controls, breach response, retention, individual rights, vendor governance and specialised requirements for children and Significant Data Fiduciaries.
Management must ensure that each obligation has a responsible owner, a realistic implementation milestone and evidence demonstrating completion. Legal should verify the operative wording and commencement of each provision, while Engineering, Security, Product, HR, Marketing and Procurement implement the controls relevant to their activities.
The ultimate objective is not simply to publish a privacy policy or complete a checklist. It is to ensure that the organisation processes digital personal data on an appropriate legal basis, communicates transparently, protects the information it holds, respects applicable rights, retains and erases information correctly, and can demonstrate compliance when required.
Final verification requirement: Before this article is adopted as a formal company policy, legal notice or published compliance advisory, the organisation should confirm the latest official Gazette position, including the December 2025 corrigendum, the October 2026 Removal of Difficulties Order, the operative commencement dates and any applicable sector-specific requirements. This final check is necessary to avoid relying on a provision, deadline or interpretation that has subsequently changed.
