DPDP Act: India's Digital Personal Data Protection Act Explained

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law. It sets the rules for how organisations collect, use, store and share the digital personal data of individuals in India, and gives those individuals rights over their data. Parliament enacted the Act on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), published in November 2025, bring it into force in phases, with most obligations applying from 13 May 2027.

In short, the DPDP Act requires businesses to give a clear notice, obtain free and specific consent (or rely on a limited "legitimate use"), protect data with reasonable security safeguards, report breaches, honour data rights and delete data once it is no longer needed. The Data Protection Board of India can impose penalties of up to ₹250 crore per breach.

DPDP Act timeline: when does it come into force?

The Act received presidential assent and was published on 11 August 2023, but it did not apply in practice until the government notified the DPDP Rules. The Rules were published in the Gazette of India on 13 November 2025 (announced by the government on 14 November 2025) with an 18-month phased rollout set out in Rule 1:

In October 2026 the government also issued the DPDP (Removal of Difficulties) Order, 2026, which clarifies the wording of Sections 9(1) and 10(2) of the Act without adding new obligations. Always check MeitY for the latest notifications before relying on a date.

Who does the DPDP Act apply to?

The Act applies to the processing of digital personal data within India, whether the data was collected online or collected offline and later digitised. It also applies to processing outside India if it is connected with offering goods or services to individuals in India. Personal data processed by an individual for purely personal or domestic purposes, and data the individual has made publicly available, fall outside the Act.

Key roles under the DPDP Act

Key obligations for Data Fiduciaries

1. Notice

Before or when asking for consent, a Data Fiduciary must give a notice that stands on its own and, in clear and plain language, includes an itemised description of the personal data, the specific purpose of processing, and a link or other means to withdraw consent, exercise rights and complain to the Board (Rule 3).

2. Consent

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. Withdrawing consent must be as easy as giving it. Pre-ticked boxes and bundled consent do not meet this standard. A small set of "legitimate uses" (for example, data voluntarily provided for a specific purpose, employment, legal obligations and medical emergencies) can apply without consent.

3. Purpose limitation and data minimisation

Collect only what you need for the purpose you disclosed, and stop processing once consent is withdrawn or the purpose is served.

4. Reasonable security safeguards

Rule 6 sets a minimum baseline: encryption, obfuscation, masking or tokenisation; access controls; logging and monitoring to detect unauthorised access; backups for continuity; contracts that bind Data Processors to security safeguards; and retention of the relevant logs for one year.

5. Personal data breach notification

On becoming aware of a breach, a Data Fiduciary must inform each affected Data Principal without delay in plain language, and notify the Data Protection Board without delay, followed by a detailed report within 72 hours (Rule 7). Unlike the GDPR, there is no risk threshold: every personal data breach is reportable.

6. Children's data and verifiable parental consent

A child is anyone under 18. Data Fiduciaries must obtain verifiable consent of a parent before processing a child's personal data (Rule 10) and must not carry out tracking, behavioural monitoring or targeted advertising directed at children. Persons with disabilities who have a lawful guardian receive similar protection.

7. Data retention and erasure

Personal data must be erased once the purpose is no longer served, unless the law requires retention. For large e-commerce, online gaming and social media platforms, Rule 8 treats the purpose as served after three years of user inactivity, with a warning to the user at least 48 hours before erasure. All Data Fiduciaries must keep processing logs for at least one year.

8. Contact point and grievance redressal

Publish the business contact details of a Data Protection Officer or another person who can answer privacy questions, and run a grievance system that responds within 90 days.

9. Extra duties for Significant Data Fiduciaries

SDFs must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and audit every 12 months, reporting significant observations to the Board. See our guides to the DPO role and DPIA.

Rights of Data Principals

Data Principals also have duties, such as not filing false or frivolous complaints; breaching them can attract a penalty of up to ₹10,000.

Cross-border data transfers

The DPDP Act takes a negative list approach: personal data may be transferred outside India unless the government restricts transfers to a specific country. Rule 15 adds that transfers must meet any requirements the government sets for making data available to foreign states or entities under their control, and Significant Data Fiduciaries may be required to keep specified categories of data in India. Sector rules that are stricter, such as those of financial regulators, continue to apply.

DPDP Act penalties

The Schedule to the Act sets maximum penalties per instance, imposed by the Data Protection Board after an inquiry. They are fixed amounts, not a percentage of turnover.

DPDP Act vs GDPR

If you already comply with the GDPR, you have a head start, but the two laws differ in important ways.

Contracts with vendors still matter under both laws; see our guide to the Data Processing Agreement.

DPDP compliance checklist for websites and apps

1. Map your data: list the personal data your website, app, cookies, SDKs and third-party tags collect, and why.
2. Show a DPDP notice: a standalone notice with an itemised list of data and purposes, in English or any of the 22 languages in the Eighth Schedule of the Constitution where relevant.
3. Collect valid consent: a consent banner with a clear "Accept" and an equally easy way to refuse, with no pre-ticked boxes.
4. Block non-essential tags until consent: analytics, advertising and social pixels should only fire after consent.
5. Make withdrawal easy: a persistent link or preference centre where users can change their choice at any time.
6. Keep consent records: store when, how and for what each consent was given, so you can prove it to the Board.
7. Handle children's data: add age gating and verifiable parental consent, and switch off tracking and targeted ads for under-18s.
8. Prepare for breaches: a playbook to notify affected users and the Board, with a detailed report within 72 hours.
9. Set retention periods: erase data once the purpose is served and keep processing logs for one year.
10. Publish a contact and grievance process: name a DPO or contact person and answer requests within 90 days.
11. Review vendors and transfers: update processor contracts and check that no data goes to a restricted country.

How UniConsent helps with DPDP compliance

UniConsent is a consent management platform (CMP) that puts the website and app parts of this checklist in place with one tag:

• DPDP consent banner: show a clear notice with itemised purposes and equal "Accept" and "Reject" choices, geo-targeted to visitors in India. See Cookie Banner.
• Multi-language notices: present the notice in English, Hindi and more than 50 languages in total, so every Data Principal can understand it.
• Tag and cookie blocking: automatically hold back analytics and advertising scripts until the user consents, with Google Consent Mode v2 support.
• Cookie scanning: find every cookie and tracker on your site so your notice is complete. See Cookie Scanner.
• Preference centre: let users review and withdraw consent as easily as they gave it, and manage data requests through the Privacy Portal and DSAR tools.
• Consent logs: keep a timestamped Consent Audit Trail of every choice to prove valid consent to the Data Protection Board.
• Mobile apps: apply the same consent rules in iOS and Android apps with the UniConsent mobile SDKs.

Note that a CMP on your own website is different from a Consent Manager under the DPDP Act, which is an India-incorporated company registered with the Data Protection Board. UniConsent helps you meet your own obligations as a Data Fiduciary on your websites and apps.

Operating in several markets? Compare India's law with other regimes in our Global Privacy Laws guide.

Official sources

• Digital Personal Data Protection Act, 2023 (MeitY)
• Digital Personal Data Protection Rules, 2025 (MeitY)
• DPDP Rules, 2025 Notified (PIB)