Q: What is DPDPA 2023 and who does it apply to?

The Digital Personal Data Protection Act, 2023 (DPDPA) is India's comprehensive data privacy legislation. It applies to all entities processing digital personal data in India, and to foreign entities processing data of Indian residents under Section 3. There is no revenue or size threshold.

Q: What are the maximum penalties under DPDPA?

DPDPA prescribes penalties up to ₹250 Crores under Section 33. Failure to protect children's data attracts up to ₹200 Crores. The Data Protection Board determines penalties based on severity.

Q: When does DPDPA become fully enforceable?

DPDPA received Presidential Assent in August 2023. DPDP Rules 2025 were notified in November 2025, triggering an 18-month compliance runway. Full enforcement with operative penalties is expected by May 2027.

Q: What is the Vibe Data Privacy Framework?

Vibe Data Privacy™ is AMLEGALS' proprietary governance framework built from the DPDPA 2023 text. It measures compliance across five operational layers — Signal, Pulse, Drift, Dividend, and Culture — producing a single Board-ready Vibe Pulse Score (VPS) from 0 to 100.

Q: Does DPDPA require appointing a Data Protection Officer?

Under Section 10, only Significant Data Fiduciaries are mandated to appoint a DPO. The DPO must be based in India and serves as the point of contact for the Data Protection Board.

Q: Can personal data be transferred outside India under DPDPA?

Section 16 permits cross-border transfers to all countries except those on the government's restricted list (negative list). Unlike GDPR, it does not require adequacy decisions for permitted jurisdictions.

Q: How does DPDPA compare to GDPR?

DPDPA is principles-based with broader exemptions. It uses a negative-list approach to cross-border transfers, has no right to data portability, uses a centralised Data Protection Board, and prescribes fixed penalty amounts rather than revenue percentages.

Q: What is a Significant Data Fiduciary under DPDPA?

Under Section 10, the Central Government may notify Data Fiduciaries as Significant based on volume and sensitivity of data processed, risk to Data Principals, and other factors. SDFs have enhanced obligations including DPO appointment, periodic audits, and DPIAs.

AMLEGALSDPDPA

[email protected]Boardline: +91-8448548549

Jurisdictions

Jurisdictions Hub
India DPDPA
Singapore PDPA
UAE Data Law
Saudi PDPL
EU GDPR
UK GDPR
APAC Guide

Solutions

VIBE Data Privacy™
Compliance Roadmap
Compliance Analyser
Cross-Border Advisory
Global Compliance Landscape
VDP Doctrines

Resources

DPDPA + Rules Mapping
DPDPA Resource Bank
DPO Toolkit
Breach Response
Privacy Guides
How-To Guides
DPDPA Insights
Insights
Glossary
GDPR Fines
Compliance Telemetry

Explore

Practice Areas
Your Role
CISO Corner
Resource Ecosystem
India Did Not Copy GDPR
DPDPA vs GDPR

Connect

About The Firm
Team
Contact
Privacy Policy

Get in Touch