Updated for DPDP Rules 2025
The Digital Personal
Data Protection Act
A Practical DPDPA Guide for Businesses
Executive Summary
The Digital Personal Data Protection Act and the DPDP Rules together establish a complete regulatory framework for how personal data must be collected, used, secured, retained, shared, and erased in India.
Notices
What You Must Tell Users
Consent
How You Obtain and Record Agreement
Security
Minimum Safeguards Required
Rights
How Users Can Exercise Control
Breach
What Happens When Something Goes Wrong
Retention
How Long You Can Keep Data
What the DPDPA, 2023 Establishes
- A unified framework that regulates the full lifecycle of personal data.
- Clear duties for organisations that collect, process, or store personal data.
- Defined rights for individuals, including access, correction, erasure, and grievance redressal.
- A central authority (the Data Protection Board) responsible for enforcement, inquiries, and penalties.
- A scalable model that applies to every kind of organisation: startups to public authorities.
What the DPDP Rules, 2025 Add
The Rules convert the Act’s principles into operational obligations. They specify:
- The mandatory structure of notices and how they must be presented.
- Requirements for valid consent, including the conditions for withdrawal.
- Processes for verifiable consent for children and persons with disabilities.
- Minimum security safeguards and mandatory log retention.
- Mandatory breach notifications to both users and the Board.
- Detailed retention and erasure timelines (Rule 8 & Third Schedule), including sector-specific rules.
- A classification of Significant Data Fiduciaries and their additional responsibilities.
What This Means for Businesses
Why Compliance Must Start Early
DPDPA compliance involves legal, operational, and technical alignment. Building foundational elements (data mapping, consent tracking, rights workflows, retention logic) requires coordination across teams and systems.
Starting early reduces operational risk and ensures your organisation can demonstrate accountability from day one.
Core Concepts
Understanding the key terms of the DPDPA is essential. These definitions form the foundation for every obligation in the law.
Data Principal
The individual whose personal data is being collected or processed. This includes customers, users, employees, contractors, or any identified or identifiable person.
Every obligation in the law is designed around protecting this person’s data and rights. Your systems, policies, and processes must be built with the Data Principal at the centre.
Data Fiduciary
Any organisation that determines why and how personal data is processed.
Your organisation is a Data Fiduciary whenever it decides how data is collected, used, stored, shared, or erased. This makes you responsible for notices, consent, security, rights fulfilment, breach handling, and retention.
Data Processor
A third party that processes personal data on behalf of your organisation, following your instructions.
You remain accountable for what your processors do. Contracts must include the required safeguards, and processors must follow your documented instructions.
Personal Data
Any data about an individual who can be identified directly or indirectly.
If data can identify someone, even through linkage, inference, or combining fields, it is personal data and must be handled according to the DPDPA’s obligations.
Processing
Any operation performed on personal data. This includes collection, storage, use, sharing, analysis, transfer, or erasure.
Every stage of processing is regulated. You must ensure that each operation complies with the law and aligns with stated purposes and notices.
Consent
An individual’s agreement to process their personal data, based on clear information and a meaningful choice.
You must be able to show that the person understood the purpose, voluntarily agreed, and had the ability to refuse or withdraw consent.
Verifiable Consent
A strengthened form of consent required for children and certain cases involving persons with disabilities.
If you serve children or users who require a guardian, you must implement identity checks, secure documentation flows, and store verification evidence.
User Account
Any account by which a user can access your service or platform, including registered and authenticated accounts.
Your notice and consent obligations apply at account creation and through ongoing use. Identity checks, rights fulfilment, and verification processes often depend on the structure of the account.
Significant Data Fiduciary
A special classification for organisations that meet certain criteria and must follow enhanced duties.
If you fall within this designation, your compliance program must include advanced governance and regular reporting.
Notice
A clear, standalone explanation of what personal data you collect, why you collect it, how it will be used, and how individuals can exercise their rights.
Notices are the foundation for lawful processing. They must be presented before or at the point of collection.
Data Breach
Any unauthorised access, disclosure, modification, loss, or other compromise of personal data.
You have obligations to notify both the affected individuals and the Data Protection Board quickly and clearly.
Retention
The period for which personal data must or may be stored.
Retention must follow purpose limits, sector-specific rules, and additional timelines prescribed in the Schedules.
The Compliance Lifecycle
The DPDPA operates as an end-to-end framework. The most effective way to approach compliance is to understand the law as a sequence of obligations that arise before collection, during processing, and after the purpose is fulfilled.
Collect
Process
Protect
Respond
Notify
Erase
Collect
Providing a clear notice, explaining purpose, and collecting valid/verifiable consent.
Collect
Providing a clear notice, explaining purpose, and collecting valid/verifiable consent.
Process
Ensuring purpose limitation, minimisation, and processing according to instructions.
Protect
Applying security safeguards, monitoring logs, and governing processors.
Respond
Handling access, correction, erasure, and grievance requests within timelines.
Notify
Notifying individuals and the Board immediately in case of a data breach.
Erase
Deleting data when the purpose is met or retention period expires.
Notices
What Must Be Disclosed Before Collecting Personal Data
Notices are the starting point of lawful personal data processing. A notice must stand on its own, be easy to read, and be available before any collection or processing begins.
What Every Notice Must Contain
Purpose of Processing
Concise explanation of why data is collected (e.g., Account creation, Delivery).
Categories of Data
Clear list of data types (e.g., Contact details, Location, Transaction data).
Rights Available
Summary of rights (Access, Correction, Erasure, Grievance).
Contact Information
DPO or Grievance Officer details for concerns.
Withdrawal Instructions
How to withdraw consent easily.
Board Complaint
Right to complain to the Data Protection Board.
Privacy Notice
DPDPA Compliant • Version 1.2
How We Use Your Personal Data
Effective Date: November 20, 2025
- Phone Number
- Email Address
- Location
- Account Access
- Delivery
- Fraud Check
You have the right to access, correct, erase your data, and nominate a representative.
You can withdraw consent anytime via Account Settings.
Questions? Contact our Grievance Officer at [email protected]
Unresolved? You may complain to the Data Protection Board.
Where Notices Must Appear
TIMING: BEFORE OR AT COLLECTIONWebsite Sign-up
Before the 'Sign Up' button.
Mobile Onboarding
First screen of app launch.
Transaction Flows
Checkout or payment pages.
Version Control is Mandatory
Your organisation must maintain versioned notices to show what was presented, when, and to whom. This protects you during audits and ensures you can demonstrate what information was available to individuals.
Consent
Validity, Withdrawal, and Records
Consent must be meaningful, informed, and easy to withdraw. The quality and clarity of your consent process define the legitimacy of your data practices.
What Valid Consent Means
Free Choice
No dark patterns, no pre-ticked boxes, no forced acceptance.
Specific
Consent must apply to clearly identified purposes. Unbundled choices.
Informed
User must understand data collection, usage, and rights clearly.
Unambiguous
Silence, inactivity, or pre-ticked boxes do not constitute valid consent.
Easy Withdrawal
Withdrawal must be as simple as giving consent. No friction.
Affirmative
Consent must be obtained through a clear affirmative action (e.g. clicking 'I Agree').
Interactive Example
Try toggling switchesPermission Settings
Manage how we use your data
Essential Services
Required for delivery & security
Marketing Offers
Personalized recommendations
Usage Analytics
Help us improve performance
The Consent Lifecycle
Recording Consent
timestamp: "2025-11-20T14:30:00Z"
user_id: "usr_8923"
consent_type: "marketing_email"
status: "granted"
method: "toggle_switch"
notice_version: "v1.2"
Your organisation must maintain defensible, tamper-evident records (JSON logs, DB entries) to prove exactly what was agreed to and when.
Easy Withdrawal
Marketing Emails
Currently: Subscribed
Withdrawal must be as simple as giving consent. It should be a single click in settings, with no hidden menus or friction.
Verifiable Consent
Children & Persons with Disabilities
Verifiable consent is required whenever an organisation processes personal data belonging to a child or to a person with a disability who has a lawful guardian. It ensures that the decision is made by a parent or guardian with authority.
Identity Verification
Parental Authority Check
The Evidence Record
Verification Log
verification_id: "vfy_9921_ax"
timestamp: "2025-11-20T10:15:00Z"
guardian_ref: "g_8823"
child_ref: "usr_child_01"
method: "digilocker_kyc"
status: "pending"
token_hash: "sha256:7f83b1..."
You must store a record of how verification was performed, not the sensitive ID documents themselves (unless required by other laws). This creates a defensible audit trail.
Rights of Data Principals
Individuals have defined rights over their personal data. Your organisation must be able to receive, authenticate, process, and fulfil these rights consistently.
Right to Access
Individuals can request a summary of their personal data processed by your organisation and understand why and how it is being used.
Compliance Note: Access responses must be accurate, complete, and understandable.
Request Processing Workflow
Security & Reasonable Safeguards
Security is not optional. Organisations must adopt technical and organisational measures appropriate to the nature, volume, and sensitivity of the data. Failures here trigger breach obligations.
Minimum Safeguards Checklist
- Role-based access control (RBAC)
- Least privilege principles enforced
- Multi-factor authentication (MFA)
- Regular access rights reviews
Security Maturity Scale
Basic Level
Ad-hoc policies, manual access control, basic firewalling.
Required Evidence
Chain of Responsibility
Data Fiduciary
Ultimate Liability
Data Processor
Operational Security
Sub-Processor
Cascaded Terms
Data Breach Response
Data fiduciaries that suffer a personal data breach must report details to the Board "without delay" and provide a detailed report within 72 hours. This is in addition to existing reporting obligations under other Indian laws.
Notify The Board
Primary DPDPA Obligation
Initial Intimation
Detailed Report
Notify Data Principals
Transparency Obligation
You must inform impacted individuals to the best of your ability. Notification must include:
- Details of the personal data breach
- Consequences likely to arise
- Contact info of an organisation representative
Parallel Reporting Obligations
CERT-In Reporting
Mandatory for all service providers, intermediaries, and body corporates to report cybersecurity incidents.
Financial Sector
Banks and financial institutions must report to relevant regulators (e.g., RBI) starting at 2 hours in certain cases.
Stock Exchanges
Public listed companies have obligations to disclose material events/incidents to stock exchanges.
IRDAI (Insurers)
Insurers must send a copy of the CERT-In report to the Insurance Regulatory and Development Authority.
UIDAI (Aadhaar)
Specific obligation to inform Unique Identification Authority of India for Aadhaar-related breaches.
NCIIPC
Report incidents impacting Critical Information Infrastructure to the NCIIPC.
Unified Incident Response
Organisations should integrate these varying timelines into a single Incident Response Plan (IRP) to ensure no deadline is missed.
Retention & Erasure
Knowing When to Let Go
Retention is limited strictly to the period necessary to fulfil the purpose. Organisations must define retention periods, send pre-erasure notices, and erase data securely.
Purpose-Based Retention
Data must be retained only for as long as it is needed for the original purpose communicated in the notice.
No Indefinite Storage
Personal data cannot be kept 'just in case'. If the purpose is completed, the data becomes eligible for erasure.
Lawful Exceptions Apply
If another law requires longer retention (e.g., Tax, PMLA), that period overrides general limits.
Logs Retained Separately
Operational logs for security & audit must be retained for the required minimum period, distinct from user data.
Detect Completion
Purpose fulfilled
Check Exceptions
Legal retention check
Pre-Erasure Notice
Notify user
Secure Erasure
Delete across systems
Update Logs
Record evidence
Pre-Erasure Notice Requirement
Before erasing data, you must give individuals a final chance to retain it.
Scheduled for Deletion
The purpose for collecting your Transaction History has been fulfilled.
Sector-Specific Rules
Third ScheduleMandatory 3-Year Retention
Specific classes of Data Fiduciaries must retain personal data for exactly 3 years after the last interaction.
Overrides general purpose-based retention.
Business Considerations for Compliance
- Build a structured data inventory with retention tags
- Implement automated erasure mechanisms where possible
- Coordinate retention schedules with legal & engineering
- Regularly audit retention workflows and backup purges
Significant Data Fiduciaries (SDFs)
Higher Stakes, Stricter Rules
Organisations designated as SDFs based on scale, sensitivity, or risk must comply with enhanced governance, audits, and accountability measures.
| Obligation | Standard Data Fiduciary | Significant Data Fiduciary |
|---|---|---|
| Data Protection Officer | Recommended | Mandatory (India-based) |
| Independent Data Audit | Ad-hoc / Voluntary | Mandatory Annual Audit |
| DPIA | Not Explicitly Mandated | Mandatory Annual Assessment |
| Algorithmic Impact | General Harm Provisions | Mandatory Risk Assessment |
SDF Compliance Dashboard
Upcoming Deadlines
Annual Cycle
Q1: Risk Assessment
DPIA & Algorithmic Checks
Q2: Policy Review
Update safeguards & contracts
Q3: Independent Audit
External auditor review
Q4: Board Reporting
Submit findings to regulator
Algorithmic Accountability Flow
If your organisation uses automated decision-making, you must assess risks of bias, discrimination, and harm to individuals.
Exemptions & Special Conditions
Narrow, Conditional, Documented
Not all organisations are treated equally. Some specific purposes or classes of fiduciaries may be exempt from certain obligations. These are not blanket permissions; they are strictly conditional.
Exemptions are narrow and conditional
Misuse of exemptions increases regulatory exposure. You must document the specific basis for every exemption claimed.
Exemption Eligibility Check
Exemption Eligibility Check
Two paths to exemption eligibility
Research / Archiving Path
Child Services Path
Exemption Scope Matrix
| Type | Conditions | Still Required |
|---|---|---|
| Research | Strictly for research purpose. No decisions affecting individuals. | Security Safeguards, Data Minimisation |
| Archiving | Public interest. Historical value. | Protection against misuse. |
| Child Services | Exempt from Age Verification & Tracking obligations (Section 9(1)/(3)). | No harmful tracking/ads. |
Documentation
Exemption Record
Required for audit trail
- Exemption Type Cited
- Justification & Purpose
- Safeguards Implemented
- Review Log
- Internal Approval
Cross-Border Data Transfers
The "Blacklist" Approach
The DPDPA simplifies international data transfers by shifting from a "Whitelist" (Adequacy) approach to a "Blacklist" approach. Transfers are permitted by default unless specifically prohibited.
The Default Rule: Transfers are Permitted
Open Borders by Default
You can transfer personal data to any country unless the Government specifically prohibits it.
- No "Adequacy" Required: You do not need to prove the destination country has specific data laws.
- Restricted Territories: If a country is notified on the "Blacklist", transfers are banned.
The 'Highest Standard' Rule
Sectoral Laws Override
If another Indian law (like RBI regulations for payments) requires data to be stored in India, that law takes precedence over the DPDPA.
Significant Data Fiduciaries (SDFs)
Stricter Controls
If you are designated as a Significant Data Fiduciary, the Government may restrict you further.
- Localisation Mandates: Government can mandate processing within India for specific data categories based on national security or public order.
Your Liability Remains
Accountability Follows Data
Even if a transfer is legal, you remain fully responsible for the data's safety.
- Contracts: You must have a valid contract with the foreign processor ensuring data protection.
- Breach Liability: If the foreign processor causes a breach, you are liable for the penalty in India.
Consent Managers
Standardised, User-Centric Control
Consent Managers are neutral platforms that allow individuals to manage consent across multiple services. Businesses must be ready to interoperate with them once they are registered and operational.
Interoperability Framework
Manager
Organisations must accept consent instructions (grant, withdraw, review) from registered Consent Managers as if they came directly from the user.
Business Readiness Checklist
Incoming Signal Example
Systems must update internal state immediately upon receiving a signal.
The Data Protection Board
Digital, Agile, Independent
The Board is an independent body that enforces compliance, conducts inquiries, imposes penalties, and directs remedial actions. It operates through a "digital office" for efficiency.
Chairperson & Members
Experts in law, tech, and governance who oversee proceedings and sign off on decisions.
Digital Office
A fully digital ecosystem for filings, notices, hearings, and pronouncements.
Adjudication Wing
Conducts inquiries, reviews evidence, determines non-compliance, and imposes penalties.
How Proceedings Work
Organisation Readiness
Alternative Resolution & Appeals
Voluntary Undertaking
Organisations can admit to a breach and propose specific actions to remediate it. If the Board accepts this undertaking, it acts as a bar to further proceedings for that specific matter.
Mediation
If the Board believes a complaint can be resolved amicably, it may direct the parties to attempt mediation through a mutually agreed mediator.
Appellate Tribunal
Decisions of the Board are not final. Any person aggrieved by an order may appeal to the TDSAT (Appellate Tribunal) within 60 days.
Voluntary Undertaking
Organisations can admit to a breach and propose specific actions to remediate it. If the Board accepts this undertaking, it acts as a bar to further proceedings for that specific matter.
Mediation
If the Board believes a complaint can be resolved amicably, it may direct the parties to attempt mediation through a mutually agreed mediator.
Appellate Tribunal
Decisions of the Board are not final. Any person aggrieved by an order may appeal to the TDSAT (Appellate Tribunal) within 60 days.
Enforcement & Penalties
Accountability Has Consequences
Penalties are tiered based on severity, harm, and nature of violation. The Board considers mitigation efforts, past conduct, and proportionality before imposing sanctions.
Security Failures
Failure to take reasonable security safeguards to prevent a personal data breach.
Breach Notification
Failure to notify the Board or affected individuals of a data breach.
Children's Data
Processing child data without verifiable consent or failing to ensure safety.
SDF Obligations
Breach of additional obligations for Significant Data Fiduciaries (Audits, DPO).
General Non-Compliance
Breach of any other provision of the Act or Rules not listed above.
Data Principal Duties
Breach of duties by individuals (e.g., impersonation, false grievances).
Factors Determining Penalties
Implementation Roadmap
From Assessment to Automation
Compliance is not a single task; it is a coordinated set of activities. This roadmap provides a structured 3-phase plan to build a strong governance foundation.
Data Inventory: The Foundation
Without knowing what personal data you hold, where it lives, and why it exists, no compliance process (notices, consent, security, rights) can function. Start here.
Foundation
- Build Data Inventory & Map Flows
- Draft Accurate Notices
- Establish Consent Mechanisms
- Set Up Grievance Channel
- Assign Compliance Roles
- Implement Basic Security Controls
Compliance Build-Out
- Implement Rights Workflows
- Define Retention & Erasure Rules
- Build Breach Response Protocol
- Update Processor Contracts
- Create Internal Evidence Packs
- Enhance Logging & Monitoring
Governance & Maturity
- Establish Governance Committee
- Conduct SDF Assessment (if applicable)
- Automate Rights & Erasure
- Prepare for Consent Managers
- Continuous Team Training
- Quarterly Risk Reviews
Downloads & Templates
Implementation-Ready Tools
Standardised templates to help you build a strong, evidence-driven compliance posture. From notices to breach logs, these resources accelerate your readiness.
Coming Soon
We are finalizing our comprehensive library of 25+ battle-tested notices, consent forms, and breach logs.