What is the DPDPA, and does it affect you?

The Digital Personal Data Protection Act (DPDPA) is India's law governing how organisations collect, use, and protect the personal data of individuals. It applies to most organisations that handle personal data digitally, from a simple website contact form to a full customer database.

The Act gives individuals (called Data Principals) a set of rights over their own information, and places responsibility on organisations (Data Fiduciaries) that collect or process it.

As more of everyday business moved online, personal data started flowing through far more systems, tools, and vendors than any one person could easily track, often without the person it belongs to knowing where it ended up.

The DPDPA responds to that by making accountability explicit: it's clear who is responsible for data at each stage, and individuals get a real, enforceable way to ask what's held about them, correct it, or have it deleted.

In practice, DPDPA readiness comes down to a handful of ongoing habits rather than a one-time project:

The Act is enforced by the Data Protection Board of India, which can inquire into complaints and data breaches and, for a significant breach, impose financial penalties under the Act's Schedule. The ceiling figures: up to ₹250 crore for failing to take reasonable security safeguards to prevent a data breach, up to ₹200 crore for failing to notify the Board and affected individuals when a breach happens (or for specific failures around children's data), and up to ₹150 crore for a Significant Data Fiduciary that misses its extra obligations, such as independent audits. The Board decides the actual amount case by case within these ceilings, and the government can amend the Schedule, so treat this as orientation, not a quote — the Act's Schedule is the authoritative source.

If a breach does happen, the DPDP Rules, 2025 set a two-step clock: intimate the Board and the affected individuals without delay, then follow up with a more detailed report to the Board within 72 hours of becoming aware of it.

Children's data gets extra rules, not just extra care: anyone under 18 counts as a child under the Act (there's no tiered age band the way some other countries have it), verifiable parental consent is required before processing their data, and tracking or behavioural monitoring of children, or targeted advertising directed at them, is prohibited even where a parent has consented. The Rules (rule 12 and the Fourth Schedule) carve out narrow exemptions, for example for certain health, education and child-safety uses.

Beyond the penalty itself, an incident or audit without records already in place means a scramble to answer "can you show us where this data is and who's touched it."

This page is meant to get you oriented, not to replace the Act itself. The authoritative text is the Act and the rules published under it by the Government of India. That's what governs your obligations, not this page.

What we can help with is the practical side: once you have a rough sense of where DPDPA touches your organisation, the readiness assessment gives you a concrete, specific view of where you stand today and what to do next.