The DPDP Act, Explained: The Complete 2026 Guide for Indian Businesses
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law. It applies to almost every organisation that processes digital personal data of individuals in India, including foreign companies serving Indian users. The DPDP Rules, 2025 were notified on 13 November 2025, and most obligations (notice, consent, security, breach reporting, rights and grievance handling) become enforceable on 13 May 2027. Penalties reach ₹250 crore per instance. The organisations that will be ready are the ones treating compliance as an operating model, not a policy update.
DPDP Compliance Cost: What an SME Should Actually Budget For
There is no fixed price for DPDP compliance. Cost depends on how much personal data you hold, how many systems and vendors it touches, your channels, whether you process children's data, and where you start. The main components are internal time, tooling, legal review, engineering integration, training and ongoing operations. The biggest savings come from collecting less data and acting early, not from cutting corners.
ReadInside the Data Protection Board of India: How Complaints Become Penalties
The Data Protection Board of India is the body that enforces the DPDP Act. It inquires into breaches and complaints, can issue directions, refer matters to mediation, accept voluntary undertakings and impose penalties of up to ₹250 crore per instance. It works as a digital office. Appeals go to TDSAT within 60 days. The Board was established in November 2025; its powers over business obligations apply from 13 May 2027.
ReadData Fiduciary vs Data Processor: Who Carries the Liability?
A Data Fiduciary decides why and how personal data is processed, alone or with others. A Data Processor processes it on a fiduciary's behalf. Under the DPDP Act, the fiduciary carries the obligations and the liability, including for its processors (Section 8(1)), and may use processors only under a valid contract (Section 8(2)). Roles are decided activity by activity, and most organisations are both.
ReadSignificant Data Fiduciary: Are You on the Government's Radar?
The government can designate any Data Fiduciary, or class of fiduciaries, as a Significant Data Fiduciary (SDF) based on data volume and sensitivity and risks to individuals, the state and public order (Section 10). SDFs must appoint a DPO based in India, an independent data auditor, and run an annual DPIA and audit (Rule 13), plus due diligence on algorithms and any localisation the government specifies. Criteria have not yet been notified, but likely candidates should prepare now.
ReadDPDP vs GDPR: The Differences That Catch Global Companies Out
The DPDP Act shares the GDPR's principles but differs in ways that break a copied programme. It has no legitimate interests basis, no sensitive-data category, no portability or objection rights, and no breach-reporting threshold. Children are anyone under 18, tracking and targeted ads to them are banned, and penalties are fixed rupee amounts per instance rather than a share of turnover. A GDPR programme is a strong starting point, not a finished one.
ReadDPDP Act Penalties: What a ₹250 Crore Fine Actually Looks Like
The DPDP Act sets maximum penalties per instance of breach: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach or protect children's data, ₹150 crore for Significant Data Fiduciary failures, and ₹50 crore for any other breach. The Board must weigh factors including gravity, duration and how quickly you mitigated. One incident can trigger more than one penalty. Penalty powers apply from 13 May 2027.
ReadDPDP Compliance Timeline: Every Deadline Between Now and Full Enforcement
The DPDP Act is being switched on in three phases. The Data Protection Board provisions have been live since 13 November 2025. Consent Manager rules take effect on 13 November 2026. Every substantive obligation on businesses, including notice, consent, security, breach reporting, retention, rights and penalties, becomes enforceable on 13 May 2027. From October 2026, that leaves roughly seven months. For most organisations, that is just enough time if work starts now.
ReadDoes the DPDP Act Apply to You? A 5-Minute Scope Test
The DPDP Act applies if you process digital personal data in India, or process it anywhere in connection with offering goods or services to people in India. There is no size, turnover or user threshold. The main exclusions are personal or domestic use and data the individual has made public themselves. The Section 17 exemptions are narrow, and even exempt processing must still be kept secure. For most businesses, the real question is not whether the Act applies, but which role you play and how heavy your obligations are.
ReadGet started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.