The DPDP Act, Explained: The Complete 2026 Guide for Indian Businesses

Who this guide is for: founders, CEOs and business leaders who need a complete, accurate picture of what the DPDP Act requires, without reading 44 sections and 23 rules first. Privacy, legal and technology leaders will find it a useful briefing to share upward.

The Act itself is short. Its implications are not. It changes how organisations collect data, what they must tell people, how long they may keep information, how quickly they must respond to a breach, and how they must prove all of it. This guide walks through each requirement in the order a business actually encounters it, with the relevant Section of the Act or Rule cited at each step.

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 governs how organisations process the digital personal data of individuals. It received Presidential assent in August 2023. The operational detail, covering what notices must contain, how breaches are reported and how long data may be kept, sits in the Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025.

The law rests on a simple bargain. Individuals gain enforceable control over their personal data. Organisations may use that data for lawful purposes, provided they are transparent, collect only what they need, protect it, and can demonstrate that they did so.

Does the DPDP Act apply to your business?

If your organisation handles information about identifiable individuals in digital form, the answer is almost certainly yes. Under Section 3, the Act applies to:

• Digital personal data processed in India, whether it was collected online or collected offline and later digitised.
• Processing outside India when it relates to offering goods or services to individuals in India. A SaaS company in Singapore with Indian customers is in scope.

There is no turnover threshold and no minimum number of users. A 20-person D2C brand, a hospital chain and a global bank are all covered. What changes with size is the weight of the obligations, particularly if the government designates you a Significant Data Fiduciary (covered below).

What falls outside the Act

Section 3(c) excludes personal data processed by an individual for personal or domestic purposes, and personal data that the individual has made publicly available or that is published under a legal obligation. Section 17 adds targeted exemptions, including processing to enforce legal rights, by courts and tribunals, for preventing or investigating offences, and for certain research and statistical purposes. These exemptions are narrow and conditional. They are not a general escape route for commercial processing.

Personal data, defined broadly

Section 2(t) defines personal data as any data about an individual who is identifiable by or in relation to that data. Names, phone numbers, email addresses, device identifiers, location history, purchase records and employee files all qualify. Unlike some global laws, the DPDP Act does not create a separate category of "sensitive" data. Every category of personal data receives the same baseline protection, though children's data carries additional obligations.

The five roles every business needs to understand

The Act assigns responsibilities by role, not by industry. Working out which role you play in each processing activity is the first step in any compliance programme.

One principle matters more than any other here. Under Section 8(1), the Data Fiduciary remains responsible for compliance even when a processor handles the data. Outsourcing the work does not outsource the liability.

When can you process personal data?

The DPDP Act allows only two lawful grounds for processing (Section 4): the individual's consent, or one of a closed list of legitimate uses. There is no general "legitimate interests" basis of the kind found in Europe's GDPR. For most commercial activity, that leaves consent as the main route.

Consent: the standard is high

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. It must also be limited to the personal data necessary for the stated purpose. In practice, this rules out pre-ticked boxes, bundled consent hidden inside terms of service, and consent for one purpose stretched to cover another.

Every consent request must be preceded or accompanied by a notice (Section 5, Rule 3). The notice must be understandable on its own, presented separately from other information, and give an itemised description of the personal data and the specific purpose of processing. It must also explain how the individual can withdraw consent, exercise their rights and complain to the Data Protection Board. Individuals can ask for it in English or any of the 22 languages in the Eighth Schedule to the Constitution.

Withdrawal must be as easy as giving consent (Section 6(4)). Once consent is withdrawn, you and your processors must stop processing within a reasonable time, unless another legal basis applies (Section 6(6)).

For data collected before the Act took effect, Section 5(2) requires you to give existing users a notice as soon as reasonably practicable. Your existing customer base needs attention too, not only new sign-ups.

Read more: Valid Consent Under DPDP: Why Your Checkbox Isn't Enough

Legitimate uses: a closed list

Section 7 permits processing without consent in specific situations, including:

• data the individual voluntarily provides for a specified purpose, where they have not objected to its use for that purpose
• performing state functions and providing government subsidies, benefits and services
• complying with a law or a court order
• responding to a medical emergency, epidemic or disaster
• employment purposes, including preventing corporate espionage and providing employee benefits

These grounds are narrower than they appear. For example, the employment ground covers what an employer genuinely needs, not every analytics or monitoring tool an HR team might want to deploy.

Read more: Legitimate Uses Under DPDP: When You Don't Need Consent

What the DPDP Act requires of Data Fiduciaries

Section 8 sets out the core obligations, and the Rules turn several of them into specific, measurable requirements. Together they define what a compliant organisation must be able to do in day-to-day operations.

1. Protect the data with reasonable security safeguards

Section 8(5) requires reasonable security safeguards to prevent a personal data breach. Rule 6 sets the minimum: appropriate encryption, obfuscation, masking or virtual tokens; access controls; logs and monitoring to detect unauthorised access; backups to ensure continuity; retention of logs for at least one year; and matching security obligations written into processor contracts. Failing to maintain these safeguards carries the Act's highest penalty, up to ₹250 crore.

2. Report personal data breaches quickly and in full

Under Section 8(6) and Rule 7, a breach triggers a two-stage process:

1. Without delay: notify each affected individual in plain language, covering what happened, the likely consequences, what you are doing about it, the steps they can take to protect themselves, and a contact person. Notify the Data Protection Board at the same time.
2. Within 72 hours of becoming aware of the breach, unless the Board allows longer: submit a detailed report to the Board covering the facts, cause, mitigation, findings about who caused it, remedial measures and the notifications made.

There is no materiality threshold. Every personal data breach must be reported. Organisations also bound by CERT-In's 6-hour cyber incident reporting rule must run both processes in parallel.

Read more: DPDP Breach Notification: The Rule 7 Playbook

3. Keep data only as long as necessary

Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer being served, unless the law requires retention. Rule 8 adds two specifics:

• A one-year floor: personal data, associated traffic data and processing logs must be retained for at least one year from the date of processing, for purposes such as breach investigation.
• A three-year ceiling for large platforms: under the Third Schedule, e-commerce entities and social media intermediaries with two crore or more registered users in India, and online gaming intermediaries with fifty lakh or more, must erase a user's data after three years without contact from that user. You must warn the individual at least 48 hours before erasure.

4. Keep data accurate when it matters

Section 8(3) requires completeness, accuracy and consistency where personal data is used to make a decision that affects the individual, or is disclosed to another fiduciary.

5. Make yourself reachable

Section 8(9) requires you to publish the business contact information of a Data Protection Officer (if you have one) or a person who can answer questions about your processing. Section 8(10) requires an effective grievance redressal mechanism. Rule 14 caps the response time at 90 days.

6. Apply extra protection to children's data

Anyone under 18 is a child under the DPDP Act. Section 9 requires verifiable consent from a parent or lawful guardian before processing a child's data (Rule 10 sets out how to verify identity and age). It prohibits tracking, behavioural monitoring and targeted advertising directed at children, and any processing likely to have a detrimental effect on a child's wellbeing. Rule 10 and the Fourth Schedule provide limited exemptions, for example for healthcare and educational institutions acting within their functions. Breaching Section 9 can cost up to ₹200 crore.

Read more: Verifiable Parental Consent: Handling Children's Data in India

7. Meet the additional bar if you are a Significant Data Fiduciary

The government can designate any fiduciary as a Significant Data Fiduciary based on the volume and sensitivity of the data it processes, and risks to individuals, national security and public order (Section 10). SDFs must appoint a Data Protection Officer based in India who reports to the board, appoint an independent data auditor, and conduct periodic Data Protection Impact Assessments. Rule 13 requires a DPIA and audit every 12 months, due diligence on algorithmic software, and compliance with any data localisation requirements the government specifies. Large banks, platforms and telecom operators should plan on the assumption that they will be designated.

8. Govern your vendors and cross-border transfers

Processors may be engaged only under a valid contract (Section 8(2)). The fiduciary remains accountable for anything the processor does with the data. On transfers outside India, Section 16 takes a negative-list approach: transfers are permitted unless the government restricts transfers to a specific country. Sector regulators such as the RBI may impose stricter localisation rules, and those continue to apply.

Read more: Third-Party Vendor Risk Under DPDP: Your Vendor's Breach Is Your Breach

Rights of Data Principals

The Act gives individuals four enforceable rights. Each one becomes an operational workflow inside your organisation, so each needs a clear owner and a documented process.

Under Rule 14, you must publish on your website or app how individuals can make these requests, and what identifier (such as a customer ID or registered mobile number) they need to provide.

What is not on the list

The DPDP Act has no right to data portability and no general right to object to processing. These are two of the most important differences from the GDPR. Global organisations should not simply copy their European rights process. It will collect more than it needs to and confuse Indian customers.

Individuals have duties too

Section 15 requires Data Principals not to impersonate others, not to suppress material information, not to file false or frivolous complaints, and to provide authentic information when seeking correction. Breaching these duties carries a penalty of up to ₹10,000. This is unusual among global privacy laws, and it gives businesses a basis for handling bad-faith requests.

Read more: Data Principal Rights Under DPDP: The Complete List (and What Isn't on It)

The Data Protection Board and penalties

The Data Protection Board of India, established under Section 18, is the body that enforces the Act. It inquires into breaches and complaints, issues directions, and imposes monetary penalties. It operates as a digital-first adjudicator: complaints, hearings and orders are designed to run online. Appeals against its decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Penalties are set out in the Schedule to the Act (Section 33) and apply per instance of breach:

When setting a penalty, the Board must consider the nature, gravity and duration of the breach, the type of data affected, whether it was repeated, any gain made or loss avoided, the mitigation steps taken, and whether the penalty is proportionate. In practice, that means documented controls and a fast, well-evidenced response directly reduce your exposure.

Read more: DPDP Act Penalties: What a ₹250 Crore Fine Actually Looks Like

When does the DPDP Act take effect?

The Act and the Rules are coming into force in three phases, all measured from the notification of the Rules on 13 November 2025.

Three developments are worth watching. First, MeitY consulted in early 2026 on bringing forward the deadline for Significant Data Fiduciaries. As of the latest available reporting, no amendment has been notified, but large organisations should not plan around the full 18 months. Second, the Board's staffing is still being completed: MeitY invited applications for its Chairperson and four Members in May 2026. Third, the Supreme Court has issued notice on a constitutional challenge concerning the Act's amendment to the Right to Information Act, without staying the law.

Eighteen months sounds generous. It is not. Data mapping, consent redesign, vendor contract renegotiation and system changes for erasure and logging typically take 9 to 12 months for a mid-sized organisation, and longer for an enterprise.

Read more: DPDP Compliance Timeline: Every Deadline Between Now and Full Enforcement

Where to start: a six-step DPDP readiness plan

The sequence matters more than speed. Each step produces something the next step depends on.

Our 90-day DPDP compliance roadmap breaks these steps into weekly milestones with owners.

Common mistakes to avoid

• Treating the privacy policy as the deliverable. A policy describes intentions. The Board will ask for evidence of what actually happened.
• Copying a GDPR programme wholesale. The DPDP Act has no legitimate interests basis, no portability right and no sensitive-data category, but it does have stricter consent conditions and duties for individuals. Read the DPDP vs GDPR comparison before reusing European templates.
• Ignoring existing customers. Section 5(2) notice obligations apply to data you already hold, not just future sign-ups.
• Forgetting that consent is withdrawn downstream too. If withdrawal updates your website but not your CRM, marketing platform and vendors, you have not stopped processing.
• Waiting for the Board to act first. By the time enforcement begins, the systems that prove compliance must already be producing records.

How ConsentifyAI helps

ConsentifyAI is a consent management platform built specifically for the DPDP Act. It connects your Record of Processing Activities to purpose-specific notices in all 22 scheduled languages, captures and versions every consent, and propagates withdrawals to downstream systems through APIs. Every action is written to a tamper-evident audit trail, so when a regulator or customer asks what happened, you can show them rather than explain.