AMLEGALS — Strategic Lawyering
Privacy · Governance · Strategic counsel India ↔ The world
PERSONAL DATA / A HUMAN STORY
PhotoNot shared
LocationNot shared
MessagesNot shared
Payment detailsNot shared
PurposePublish a selected photo
Photo-sharing serviceAwaiting permission
Withdraw consent · Request erasure →
01 / 04Personal data

Her information. Her life.

A photograph, a location, a conversation, a payment. Each record relates to a person.

Illustrative consent-based journey. Other lawful grounds and retention duties may apply.
DPDPA exposure / Where it starts

Tell us where your data sits. We'll show you where the exposure is.

Map personal data across systems, vendors and borders against the DPDP Act, 2023 and the DPDP Rules, 2025 — and see which obligations apply before 13 May 2027.

Map your exposure
Data protection / The leadership agenda

Data moves. Responsibility stays.

DPDPA advisory and privacy governance for the decisions that shape your business. In India. Across borders. Throughout the data lifecycle.

Explore our practice
India / International business

One business. Many borders. A clear position.

Understand the Indian and overseas dimensions of your data relationships — from market entry to cross-border operations.

Explore international advisory
Governance / The working record

Beyond the policy. Into the organisation.

Connect legal obligations with operational ownership, practical controls and evidence of implementation.

Explore privacy governance
Principal obligations commence
13 May 2027 · DPDP Act, 2023 & DPDP Rules, 2025
--
Days
--
Hours
--
Min
--
Sec
Organisations that trust this practice

Recent work highlights

DKMS
Deepak Nitrite
Thermax
Gather India
SEW-Eurodrive
Nazara Technologies
HCG Hospitals
Health-e
Deepak Phenolics
BioX
Deepak Chem Tech
Dräxlmaier
Independent recognition / 2026
IBLJ INDIA BUSINESS
LAW JOURNAL

Law Firm
Awards.

Recognised in Arbitration & ADR, Corporate, and Technology.

Celebrating excellence & dedication.

Founder conversations

One voice.
Wider conversations.

Anandaday Misshra
Founder & Managing Partner, AMLEGALS

Anandaday Misshra
ManageEngine Insights / DPDPA

DPDPA compliance in India: What it requires, and what it costs to get wrong

With Athira Jayakumar. A conversation on consent, governance and the business implications of privacy.

Open the conversation
HKU / Regulatory Ramblings

Respect Personal Data: A look into India's new personal data privacy law

With Ajay Shamdasani. The founder's perspective on India's data protection framework, from the Regulatory Ramblings podcast.

Open the conversation
In focus DPDP Rules 2025 — A phased transition. A practical plan. Understand the framework
DPDPA compliance

DPDPA compliance and
data privacy compliance.

DPDPA compliance means meeting the duties in the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The Rules were notified on 13 November 2025 and most duties apply from 13 May 2027. Each guide below covers one part of the work and names the provision behind it.

Next step Scope your DPDPA compliance work — send your name and email; the reply comes from [email protected]. Send your details
Our practice

From legal obligation
to everyday operation.

Privacy touches every part of an organisation. We bring legal interpretation, governance and implementation into one conversation.

01 / Build

DPDPA implementation

Understand your position. Map the gaps. Put notices, consent, contracts and operating procedures into place.

Explore DPDPA advisory
02 / Connect

Cross-border data privacy

Coordinate Indian requirements with the privacy frameworks that govern your international operations.

Explore global privacy
03 / Govern

AI & technology governance

Connect AI use cases with legal review, human oversight, vendor terms and evidence of responsible operation.

Explore AI advisory
Specialist advice, through the full privacy lifecycle. View all practice areas
Your responsibility

A different seat.
A shared responsibility.

Find guidance for the decisions on your desk.

Legal & complianceGeneral Counsel & DPOs Leadership & financeBoards & CFOs Security & technologyCISOs & technology teams
Sector perspective

The same law.
A different business context.

A patient record, a payment journey and an AI training dataset raise different questions. Start with the context of your business.

01 Banking & financial servicesFinancial data. Vendors. Regulatory overlap. 02 Healthcare & life sciencesPatient information. Research. Digital care. 03 Technology & AIPersonal data. Model use. Accountability. 04 E-commerce & retailCustomer journeys. Consent. Retention. 05 Insurance & InsurTechPolicyholder data. Claims. Intermediaries. 06 Gaming & digital platformsChildren's data. Age assurance. User rights.
For startups & growing businesses For international companies entering India
The product · Introducing

The DPDPA File

Compliance is a file, not a claim. Fifty-six exhibits. Every obligation, mapped to a control, an owner and an artefact.

Open The DPDPA File
Exhibit · Significant Data Fiduciary

The SDF duties

Once notified an SDF, Section 10 read with Rule 13 adds an India-based DPO, an independent auditor, DPIAs and algorithmic due diligence. The exhibit lists each duty and its artefact.

56
Exhibits
44
Sections
23
Rules, 2025
7
Schedules
₹250 Cr
Maximum penalty
The framework · Proprietary

Inviolum™

A governance framework built from the DPDPA statutory text — not translated from the GDPR. It measures your compliance stance against all 44 Sections and 23 Rules, and resolves to one Board-ready number.

Inviolum Pulse Score
0 – 100

A single Board-ready index, assessed against the Act and the Rules — reported the way a finance committee reads a metric.

Trust Engineering

Depth across the disciplines that engineer trust.

Explore Trust Engineering

The systematic conversion of legal, regulatory, contractual and governance obligations into continuously operating business systems that can be measured, monitored and independently verified — organised across ten engineering disciplines.

Legal Engineering
01
Legal Engineering
Encode statutory obligations into machine-readable rules and continuously operating controls.
 Data Privacy Engineering
02
Data Privacy Engineering
Design privacy into the data architecture itself — consent, rights, purpose limitation and erasure.
 AI Governance Engineering
03
AI Governance Engineering
Govern AI systems through measurable, auditable frameworks across the model lifecycle.
 Regulatory Engineering
04
Regulatory Engineering
Harmonise overlapping RBI, SEBI, IRDAI, CERT-In and global demands into one operating model.
 Compliance Engineering
05
Compliance Engineering
Move compliance from periodic audits to continuous, policy-as-code verification.
 Contract Engineering
06
Contract Engineering
Instrument DPA clauses, SCCs and SLA commitments into monitored contract intelligence.
 Cyber Governance Engineering
07
Cyber Governance Engineering
Bridge CISO operations and board governance — incident, breach and posture management.
 Risk Engineering
08
Risk Engineering
Quantify regulatory risk in business terms — penalty exposure and board-ready registers.
 Evidence Engineering
09
Evidence Engineering
Design evidence chains that satisfy regulators, auditors and courts on demand.
 Digital Trust Analytics
10
Digital Trust Analytics
Measure trust posture with the same rigour as financial metrics — scorecards and dashboards.
Across borders

Different markets.
Connected responsibilities.

Section 3(b) extends India's data protection regime to every organisation offering goods or services to Data Principals in India — regardless of where it is incorporated.

Multinational compliance
MNC compliance14 min

The DPDPA Obligation for Multinationals

A GDPR programme cannot be transplanted to the DPDPA. The Board examines Indian law. Not your global framework.

Read the analysis
Cross-border transfers
Cross border12 min

Cross Border Transfers Under the DPDPA

Section 16 permits transfers today. It can restrict them by executive notification tomorrow. The architecture must exist before that day.

Read the analysis
Investment due diligence
Investment & DD11 min

DPDPA Due Diligence for Foreign Investment

The gap discovered in the legal memo is the one that kills the transaction. The investors who find it have already decided.

Read the analysis
Maximum penalty · Schedule to the DPDPA, 2023
₹250
Crores

The Schedule prescribes the maximum. The Board determines the quantum under Section 33.

The only variable is your evidence — and when you begin building it.

Your starting point

What is on
your agenda?

Choose your role and priority to find relevant guidance across the practice.

Insights & knowledge

Explore the questions.
Examine the detail.

Articles, compliance analyses, working resources and answers from the AMLEGALS privacy practice.

The Consent Trap
ArticleMarch 2026

The Consent Trap: Why 90% of Indian Consent Mechanisms Will Fail DPDPA Scrutiny

Consent obtained minus consent understood equals zero legal defence. The gap between collection and validity is where the penalties live.

Read ↗ The Privacy Dividend
FrameworkMarch 2026

The Privacy Dividend: How Compliance Investment Returns More Than Penalty Avoidance

Companies that invest in trust outperform those that invest in damage control. Here is the model and the maths behind it.

Read ↗ DPDPA Readiness Survey
ReportFebruary 2026

DPDPA Readiness: A 50-Company Survey Across 12 Industries

Fifty organisations from BFSI and pharma to IT services and manufacturing. The gap between awareness and action is staggering.

Read ↗
Consent & Rights14 min
Consent Management Under DPDPA
Breach Response16 min
Data Breach Notification Under DPDPA
International13 min
Cross-Border Data Transfers Under DPDPA
Penalties14 min
DPDPA Penalties and Fines Structure
Read the full statutory analysis ↗All insights ↗
Compliance intelligence

The analyses that
define the terrain.

Each analysis maps a specific obligation to its operational reality — statutory text, regulatory overlap, implementation architecture and evidence requirements.

Compliance Cost Analysis
Cost heads, complexity bands and scope variables for implementation across organisation sizes.
13 May 2027 Deadline Roadmap
Phased commencement timeline, 30/90/180-day milestones and the Board-readiness evidence checklist.
DPDPA for CFOs
Penalty exposure quantification, Ind AS 37 provisioning, D&O insurability and Board disclosure.
Vendor Claims Register
No DPDPA certification body exists in India. How to evaluate vendor compliance claims against the statute.
Consent Manager Framework
Rule 4 registration, First Schedule Part A obligations and intermediary architecture for the consent lifecycle.
BFSI Compliance Architecture
RBI localisation, IRDAI overlay and SEBI KYC governance — reconciled with the Act Section by Section.
Cross-Border Transfers
The Section 16 negative-list regime, Rule 15 requirements and sectoral localisation mandates mapped.
GDPR vs DPDPA Comparison
Structural divergences: consent architecture, transfer mechanisms, penalties and enforcement models.
Knowledge Hub

DPDPA 2023 — every obligation,
every resource.

44 Sections. 23 Rules. One knowledge architecture — from statutory analysis to sector-specific compliance, from Board governance to operational implementation.

OfficesNew Delhi · Ahmedabad · Mumbai · Bengaluru · Pune · Kolkata · Chennai · Prayagraj · Surat · Vadodara
Speak with a practitioner ↗
Insights & answers

What practitioners and boards are asking.

Twenty-eight answers, each grounded in the statutory text rather than in a vendor's framework.

All DPDPA FAQs ↗
01What is DPDPA 2023 and who does it apply to?+
The Digital Personal Data Protection Act, 2023 governs digital personal data. Section 3 covers processing in India where data is collected digitally or collected in non-digital form and digitised later. It also covers processing outside India connected with offering goods or services to Data Principals within India. There is no general revenue or size threshold, but the Act contains exclusions and exemptions, including personal or domestic processing and specified publicly available data.
02What are the maximum penalties under DPDPA?+
The Schedule sets a ceiling of up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to meet the additional obligations relating to children, as determined by the Board after inquiry. These are ceilings, not fixed charges. Section 33(2) requires consideration of factors including the nature, gravity and duration of the breach, the type of data, repetition and mitigation.
03What is the Inviolum Framework by AMLEGALS?+
Inviolum™ is AMLEGALS' proprietary governance framework built from the DPDPA 2023 statutory text. It measures compliance across five operational layers — Signal (privacy frequency across consent records and data flows), Pulse (governance stance against all 44 Sections and 23 Rules), Drift (compliance entropy and deviations from baseline), Dividend (privacy ROI through trust metrics and audit readiness) and Culture (organisational privacy maturity) — producing a single Board-ready Inviolum Pulse Score from 0 to 100.
04When will DPDPA be fully enforceable?+
The Act received Presidential Assent on 11 August 2023. The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). Commencement is phased: institutional provisions including the Data Protection Board commenced on 13 November 2025; the Consent Manager framework under Rule 4 commences on 13 November 2026; and the substantive obligations on notice, consent, breach reporting, children's data, Significant Data Fiduciaries, rights and cross-border transfers commence on 13 May 2027. Treat the current period as the build window.
05How does DPDPA compare to GDPR?+
The laws have different structures. Section 16 of the DPDPA allows the Government to restrict transfers to notified countries; GDPR provides transfer mechanisms including adequacy decisions and appropriate safeguards. The DPDPA has no right to data portability and enforcement sits with the Data Protection Board. Its penalties have rupee-denominated ceilings, not fixed charges or turnover-based percentages. Its scope includes data collected digitally and data collected in non-digital form and digitised later.
06What is a Significant Data Fiduciary under DPDPA?+
Under Section 10, the Central Government may notify a Data Fiduciary as Significant based on the volume and sensitivity of data processed, risk to Data Principals and other prescribed factors. SDFs carry enhanced obligations including a mandatory DPO appointment based in India, periodic audits by independent auditors, and Data Protection Impact Assessments. Rule 13 requires a DPIA and audit once in every twelve-month period from notification and a report of significant observations to the Board.
07Does DPDPA apply to foreign companies?+
Yes. Section 3 extends applicability to the processing of digital personal data outside India where that processing is in connection with offering goods or services to Data Principals within India. This extraterritorial scope means foreign companies must comply regardless of their physical location.
08What are the DPDP Rules 2025 and when were they notified?+
The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)) under Section 40. They contain 23 Rules and 7 Schedules covering notice requirements (Rule 3), Consent Manager registration and obligations (Rule 4), breach notification form and manner (Rule 7), children's data safeguards (Rule 10), SDF obligations including DPIA, audit and algorithmic due diligence (Rule 13), Data Principal rights (Rule 14), cross-border transfer requirements (Rule 15), the Data Protection Board (Rules 17 to 21) and appeals (Rule 22). Commencement is phased, with the substantive obligations commencing on 13 May 2027.
09What are the consent requirements under Section 6?+
Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to data necessary for the specified purpose. Section 5 read with Rule 3 requires a notice accompanying or preceding the consent request that itemises the data and purposes and explains how to exercise rights. Withdrawal must be comparable in ease to giving consent under Section 6(4). Section 7 permits specified uses, subject to their conditions, including employment, certain State functions and medical emergencies; it is not a general public-interest permission.
10What is the data breach notification obligation?+
Section 8(6) requires every Data Fiduciary to inform both the Data Protection Board of India and each affected Data Principal of a personal data breach. Rule 7 prescribes a staged model: affected Data Principals must be intimated without delay; the Board must receive an initial intimation without delay; and a detailed report must follow to the Board within 72 hours of becoming aware of the breach, or such longer period as the Board may allow on request. Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore, as determined by the Board after inquiry under Section 33 and the Schedule.
11How does DPDPA protect children's personal data?+
Section 9 requires verifiable parental consent before processing a child's data, meaning anyone below eighteen years. Data Fiduciaries must not undertake tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 prescribes the manner of obtaining verifiable parental consent. Processing that may cause a detrimental effect is prohibited, and the penalty for non-compliance is up to ₹200 crore, as determined by the Board after inquiry under Section 33 and the Schedule. These duties are subject to the exemptions in Section 9 read with Rule 12 and the Fourth Schedule.
12Does DPDPA apply to US SaaS companies selling to Indian customers?+
Section 3 covers processing outside India connected with offering goods or services to Data Principals within India. A US SaaS company is a Data Fiduciary where it determines the purposes and means of processing, and a Data Processor where it processes on behalf of another Data Fiduciary. Its role can differ by activity. Applicable duties include notice and consent where required, security safeguards, breach intimation and Data Principal rights. A Data Fiduciary must engage a processor under a valid contract under Section 8(2).
13What happens if a foreign company ignores DPDPA compliance?+
Non-compliance exposes the entity to penalties under Section 33 read with the Schedule, up to ₹250 crore for failure to take reasonable security safeguards, as determined by the Board after inquiry. The Board can issue directions, impose penalties and require remedial measures. Beyond money, non-compliance risks reputational damage, contract termination by Indian partners and, where the conditions in Section 37 are met, a Government blocking direction after an opportunity to be heard. Blocking is not an automatic consequence of a breach.
14How is DPDPA different from PDPA Singapore and LGPD Brazil?+
The DPDPA covers digital personal data, including data collected in non-digital form and digitised later. It uses rupee-denominated penalty ceilings and does not provide a data portability right. Section 16 permits restrictions on transfers to notified countries, supplemented by Rule 15 and applicable sector rules. Singapore's PDPA and Brazil's LGPD have different transfer conditions and grounds for processing. Their compliance programmes need an India-specific assessment rather than assuming the laws are interchangeable.
15What is algorithmic due diligence under the DPDP Rules 2025?+
Rule 13 introduces algorithmic due diligence as an obligation for Significant Data Fiduciaries. It requires SDFs to verify that algorithmic systems processing personal data are not likely to pose a risk to the rights of Data Principals — including algorithms used for profiling, automated decision-making or content recommendation.
16What are the DPDPA obligations for the BFSI sector?+
Banks, insurers, NBFCs and payment aggregators carry overlapping obligations. Under the Act: Section 5 notice, Section 6 consent, Section 8 breach notification and Section 10 SDF obligations if notified. In addition, RBI data localisation circulars mandate that payment system data be stored exclusively in India, IRDAI requires health and claims data retention, and SEBI mandates KYC data governance. The sector must reconcile these sectoral mandates with the Act to avoid regulatory conflict.
17How should a multinational structure its DPDPA compliance programme?+
Across four layers: entity mapping to identify which group entities qualify as Data Fiduciaries or Data Processors; data flow mapping to trace cross-border transfers under Section 16 and Rule 15; consent architecture design reconciling Section 6 consent with GDPR consent or legitimate interests already in place; and governance documentation including privacy notices, Data Processing Agreements, breach response protocols and DPO appointment for SDF-designated entities.
18What is a DPDPA Data Protection Impact Assessment?+
Section 10 and Rule 13 require notified Significant Data Fiduciaries to undertake a Data Protection Impact Assessment and an audit once in every twelve-month period from notification. The SDF must cause the person carrying out the assessment and audit to submit a report containing significant observations to the Board. This is not merely an on-request reporting duty. GDPR Article 35 instead uses a likely-high-risk test for its DPIA requirement.
19What is the Rule 15 cross-border transfer requirement?+
Rule 15 supplements Section 16. While Section 16 empowers the Central Government to restrict transfers to notified countries on a negative-list approach, Rule 15 further allows requiring that personal data made available to any foreign State, its agencies or persons or entities under its control meet prescribed requirements. Sectoral localisation mandates under the RBI, IRDAI and SEBI continue to apply independently. Unlike the GDPR, the DPDPA does not require adequacy decisions for permitted jurisdictions.
20What is the Consent Manager framework under the Rules?+
Rule 4 establishes the Consent Manager framework. A Consent Manager is an entity registered with the Board under the First Schedule Part A that acts as a single point of contact for Data Principals to give, manage, review and withdraw consent. Foreign companies can engage a registered Consent Manager, but legal responsibility for lawful processing remains with the Data Fiduciary. The registration framework commences on 13 November 2026.
21How does DPDPA apply to the insurance sector?+
Insurance companies face obligations overlaid with IRDAI requirements: Section 5 notice for policy data, Section 6 consent for health and claims data, Section 8 breach notification and potential Section 10 SDF obligations. IRDAI mandates on data retention, claims processing and policyholder data governance must be reconciled with the Act. AMLEGALS builds sector-specific reconciliation matrices mapping each IRDAI requirement to the corresponding provision.
22What DPDPA obligations apply to e-commerce platforms?+
Section 5 notice obligations at scale, Section 6 consent challenges for multiple processing purposes across marketing, analytics, personalisation and payment, Section 8 breach notification for large user bases, and potential SDF designation under Section 10 for high-volume processors. We advise on consent architecture design, vendor data processing agreements, cross-border transfer mechanisms for international fulfilment, and children's data protection under Section 9.
23Does DPDPA apply to the online gaming industry?+
Yes. Gaming platforms face acute Section 9 challenges because they cannot simply add an age gate. Verifiable parental consent under Rule 10 is required before processing any child's data, and behavioural monitoring, tracking and targeted advertising directed at children are prohibited. Gaming companies must also address Section 6 consent for gameplay analytics, in-app purchase data and social features, plus Section 8 breach notification obligations. Apply the exemptions in Section 9, Rule 12 and the Fourth Schedule where their conditions are met; an age gate alone does not establish compliance.
24What is the DPDPA compliance cost for organisations in India?+
Costs vary by organisation size, sector, processing complexity and existing governance maturity. Key cost heads include legal advisory, consent architecture implementation, privacy notice drafting, data mapping and flow analysis, breach notification infrastructure, DPO appointment for SDFs, Data Protection Impact Assessments, vendor agreement restructuring and ongoing compliance monitoring. We provide structured scope assessments so organisations can understand their specific investment requirement.
25Is there a DPDPA certification body in India?+
The Act and Rules do not establish a general government-issued DPDPA compliance certificate for organisations. An independent audit or a private assessment is different from statutory certification. A vendor's readiness or compliance claim should be checked against its scope, evidence, assessor and limitations; the label alone does not prove compliance or regulatory approval.
26Who provides DPDPA compliance services in Delhi NCR?+
AMLEGALS provides counsel-led DPDPA compliance services from its New Delhi office at A-24, ILBS Colony, Vasant Kunj, New Delhi 110070. The firm advises on DPDP Act 2023 implementation, DPDP Rules 2025 compliance, consent architecture, breach notification, DPO services, cross-border transfers and Significant Data Fiduciary obligations. Contact [email protected] or +91-8448548549.
27Who provides DPDPA compliance services in Mumbai?+
AMLEGALS provides DPDPA compliance advisory from its Mumbai office. Services include implementation, consent management, breach notification protocols, DPO advisory, cross-border transfer structuring and the proprietary Inviolum Framework assessment. The firm serves BFSI, pharmaceutical, e-commerce and technology entities across Maharashtra.
28Who provides DPDPA compliance services in Ahmedabad?+
AMLEGALS operates from its Ahmedabad office, providing DPDPA compliance services to manufacturing, pharmaceutical, chemical and technology companies in Gujarat. Services include DPDP Act implementation, DPDP Rules compliance, consent architecture, Significant Data Fiduciary advisory and the Inviolum Pulse Score assessment.
Start a conversation

What does your next decision need?

Tell us what you are working on. The practitioner with the relevant statutory expertise will respond directly. Confidential. Counsel-led. Statutory basis from the first engagement.

Data privacy desk
[email protected]
Boardline
+91-8448548549

DPDPA compliance in India: questions and answers

Which law firm should I contact for DPDPA compliance in India?

AMLEGALS advises on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, including gap assessments, notices and consent architecture, processor contracts, breach response, Significant Data Fiduciary readiness and DPO support. The practice is led by Anandaday Misshra, Founder & Managing Partner, with more than 28 years of overall legal and regulatory experience. Contact: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].

How can I quickly find out my DPDPA penalty exposure?

The DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment asks where your personal data sits; a partner replies within one working day with a first view on your penalty exposure. Highest listed maximum for a specified contravention: ₹250 crore under the Schedule to the Act.

What happens after I send a DPDPA enquiry to AMLEGALS?

The enquiry is routed to the firm's data privacy team ([email protected] or [email protected]). A partner reviews the facts you share and responds with a first view and a proposed scope. Confidential lawyer-client communications for legal advice may attract privilege, subject to applicable law.

Can a foreign company engage AMLEGALS for DPDPA compliance?

Yes. The Act applies to processing of digital personal data outside India where the processing is connected with any activity relating to the offering of goods or services to Data Principals within the territory of India. The statutory test is the offering of goods or services within India — not the citizenship or residence of the individual. AMLEGALS advises overseas businesses offering goods or services to individuals in India, including on cross-border transfer and processor contracts. Contact: https://amlegalsdpdpa.com/contact.

When do DPDPA obligations apply to businesses?

The Act and Rules follow phased commencement. Institutional provisions commenced on 13 November 2025; Consent Manager provisions commence after 12 months on 13 November 2026; and the principal Data Fiduciary, rights, breach, security and enforcement provisions commence after 18 months on 13 May 2027.

What are the personal data breach notification timelines under the DPDP Rules, 2025?

Section 8(6) requires every Data Fiduciary to inform both the Data Protection Board of India and each affected Data Principal of a personal data breach. Rule 7 prescribes a staged model: affected Data Principals must be intimated without delay; the Board must receive an initial intimation without delay; and a detailed report must follow to the Board within 72 hours of becoming aware of the breach, or such longer period as the Board may allow on request. Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore, as determined by the Board after inquiry under Section 33 and the Schedule.

What is a Significant Data Fiduciary and what extra duties apply?

Under Section 10, the Central Government may notify a Data Fiduciary as Significant based on the volume and sensitivity of data processed, risk to Data Principals and other prescribed factors. SDFs carry enhanced obligations including a mandatory DPO appointment based in India, periodic audits by independent auditors, and Data Protection Impact Assessments. Rule 13 requires a DPIA and audit once in every twelve-month period from notification and a report of significant observations to the Board.

Is a Data Protection Officer mandatory under DPDPA?

A Data Protection Officer based in India is mandatory for Significant Data Fiduciaries under Section 10(2). Other Data Fiduciaries must publish the business contact information of a DPO, if applicable, or of a person able to answer questions about processing (Section 8(9) read with Rule 9).

What does DPDPA require for children's personal data?

Section 9 requires verifiable parental consent before processing a child's data, meaning anyone below eighteen years. Data Fiduciaries must not undertake tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 prescribes the manner of obtaining verifiable parental consent. Processing that may cause a detrimental effect is prohibited, and the penalty for non-compliance is up to ₹200 crore, as determined by the Board after inquiry under Section 33 and the Schedule. These duties are subject to the exemptions in Section 9 read with Rule 12 and the Fourth Schedule.

How does DPDPA regulate cross-border transfer of personal data?

Rule 15 supplements Section 16. While Section 16 empowers the Central Government to restrict transfers to notified countries on a negative-list approach, Rule 15 further allows requiring that personal data made available to any foreign State, its agencies or persons or entities under its control meet prescribed requirements. Sectoral localisation mandates under the RBI, IRDAI and SEBI continue to apply independently. Unlike the GDPR, the DPDPA does not require adequacy decisions for permitted jurisdictions.

Can personal data be processed without consent under DPDPA?

Section 7 of the Act permits processing for “certain legitimate uses” without fresh consent in defined situations. This concept was described during the Bill stage as “deemed consent”, but the enacted terminology is “certain legitimate uses under Section 7”.

Is a Data Fiduciary responsible for its vendors under DPDPA?

Yes. Section 8(1) makes the Data Fiduciary responsible for compliance in respect of processing undertaken by it or on its behalf by a Data Processor. Section 8(2) requires a Data Fiduciary to engage a Data Processor under a valid contract. Detailed contractual clause architecture is an implementation best practice guided by Section 8(2).

What does a DPDPA compliance programme include?

A programme typically covers a personal data inventory and data map, notices (Section 5, Rule 3), consent and consent-withdrawal flows (Section 6), processor contracts (Section 8(2)), security safeguards (Rule 6), breach intimation procedures (Rule 7), erasure schedules (Rule 8), Data Principal rights handling (Rule 14), children's data controls (Rule 10) and, for SDFs, DPIA, audit and DPO (Rule 13).

Which sectors does AMLEGALS advise on DPDPA?

Sector briefings cover banking and BFSI, fintech and NBFCs, healthcare and pharma, EdTech, e-commerce and D2C, SaaS and IT services, telecom, insurance, HR and staffing, hospitality, online gaming and government vendors. See https://amlegalsdpdpa.com/dpdpa-exposure-assessment.

What is the legal framework for data protection in India?

India's framework is the Digital Personal Data Protection Act, 2023 (Presidential assent 11 August 2023; 44 sections) read with the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025 (G.S.R. 846(E)) with 23 Rules and 7 Schedules.

What is the maximum penalty under DPDPA?

The Schedule sets a ceiling of up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to meet the additional obligations relating to children, as determined by the Board after inquiry. These are ceilings, not fixed charges. Section 33(2) requires consideration of factors including the nature, gravity and duration of the breach, the type of data, repetition and mitigation.

Does DPDPA apply to companies outside India?

The Act applies to processing of digital personal data outside India where the processing is connected with any activity relating to the offering of goods or services to Data Principals within the territory of India. The statutory test is the offering of goods or services within India — not the citizenship or residence of the individual.

What makes consent valid under DPDPA?

Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to data necessary for the specified purpose. Section 5 read with Rule 3 requires a notice accompanying or preceding the consent request that itemises the data and purposes and explains how to exercise rights. Withdrawal must be comparable in ease to giving consent under Section 6(4). Section 7 permits specified uses, subject to their conditions, including employment, certain State functions and medical emergencies; it is not a general public-interest permission.

What must a DPDPA privacy notice contain?

Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to data necessary for the specified purpose. Section 5 read with Rule 3 requires a notice accompanying or preceding the consent request that itemises the data and purposes and explains how to exercise rights. Withdrawal must be comparable in ease to giving consent under Section 6(4). Section 7 permits specified uses, subject to their conditions, including employment, certain State functions and medical emergencies; it is not a general public-interest permission.

What rights do individuals have under DPDPA?

Data Principals have the right to access information about processing (Section 11), correction, completion, updating and erasure (Section 12), grievance redressal (Section 13) and nomination (Section 14). Rule 14 governs the manner in which these rights are exercised.

What security safeguards does DPDPA require?

Section 8(5) requires reasonable security safeguards to prevent personal data breach. Rule 6 specifies minimum measures including encryption, obfuscation, masking or virtual tokens, access control, visibility over access through logs and monitoring, measures for continued processing after compromise, and retention of logs for one year unless otherwise required by law.

When must personal data be erased under DPDPA?

Section 8(7) requires erasure once the specified purpose is no longer served or consent is withdrawn, unless retention is required by law. Rule 8 and the Third Schedule prescribe time periods for specified classes of Data Fiduciaries, with prior intimation to the Data Principal before erasure.

How does DPDPA differ from the GDPR?

The laws have different structures. Section 16 of the DPDPA allows the Government to restrict transfers to notified countries; GDPR provides transfer mechanisms including adequacy decisions and appropriate safeguards. The DPDPA has no right to data portability and enforcement sits with the Data Protection Board. Its penalties have rupee-denominated ceilings, not fixed charges or turnover-based percentages. Its scope includes data collected digitally and data collected in non-digital form and digitised later.

What are the key GDPR thresholds?

The GDPR (Regulation (EU) 2016/679) has applied since 25 May 2018. Article 33 requires notification of a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours. Article 83 sets administrative fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

What is the EU AI Act and when does it apply?

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases: prohibited AI practices from 2 February 2025 and general-purpose AI model obligations from 2 August 2025, with later phases for other obligations. Where an AI system processes personal data of individuals in India, DPDPA obligations apply in parallel.

What is Saudi Arabia's data protection law?

Saudi Arabia's Personal Data Protection Law, issued by Royal Decree M/19 of 2021, came into effect on 14 September 2023 and is supervised by the Saudi Data & AI Authority (SDAIA). Businesses serving both Saudi and Indian individuals must map obligations under each law separately.

What is the UAE federal data protection law?

The UAE federal Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. Financial free zones such as DIFC and ADGM have their own data protection regimes. Businesses processing personal data of individuals in India must also address DPDPA separately.

What are the penalty ceilings in the Schedule to DPDPA?

The Schedule lists maximum penalties per category of contravention: up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach; up to ₹200 crore for failure to intimate a personal data breach to the Board or affected Data Principals; up to ₹200 crore for non-fulfilment of additional obligations relating to children; up to ₹150 crore for non-fulfilment of additional obligations of a Significant Data Fiduciary; up to ₹10,000 for breach of the duties of a Data Principal under Section 15; and up to ₹50 crore for breach of any other provision of the Act or Rules.

What is the Data Protection Board of India?

The Data Protection Board of India is established under Section 18 of the Digital Personal Data Protection Act, 2023. It inquires into personal data breaches and complaints, directs urgent remedial or mitigation measures and imposes penalties under Section 33. Its constitution and functioning provisions (Rules 1, 2 and 17–21) commenced on 13 November 2025.

Can a DPDPA penalty order be appealed?

Yes. Under Section 29, a person aggrieved by an order or direction of the Data Protection Board may appeal to the Appellate Tribunal (the Telecom Disputes Settlement and Appellate Tribunal) within sixty days. Rule 22 governs the manner of appeal.

What is a voluntary undertaking under DPDPA?

Under Section 32, the Data Protection Board may accept a voluntary undertaking from a person in respect of any matter related to observance of the Act at any stage of proceedings. Acceptance bars proceedings on the contents of the undertaking, except where the person fails to adhere to it.

What is a Consent Manager under DPDPA and when do the provisions apply?

A Consent Manager is a person registered with the Data Protection Board that acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (Section 2(g) and Section 6(7)–(9)). Rule 4 and the First Schedule govern registration and obligations; these provisions commence on 13 November 2026.

What duties do Data Principals have under DPDPA?

Section 15 requires Data Principals to comply with applicable law, not impersonate another person, not suppress material information when providing personal data for official documents, not register false or frivolous grievances or complaints, and furnish only verifiably authentic information when exercising the right to correction or erasure. Breach can attract a penalty of up to ₹10,000.

How long does a Data Fiduciary have to respond to a grievance under DPDPA?

Rule 14 requires Data Fiduciaries and Consent Managers to publish the means by which Data Principals can exercise rights and to respond to grievances within a period not exceeding ninety days. Under Section 13(3), a Data Principal must exhaust the grievance redressal opportunity before approaching the Board.

Which businesses must erase inactive user data after three years under the DPDP Rules?

The Third Schedule, read with Rule 8, specifies that e-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh registered users in India, must erase personal data three years after the Data Principal last approached them or exercised rights, subject to listed exceptions. At least forty-eight hours before erasure, the Data Principal must be informed that the data will be erased unless they log in or initiate contact.

Who counts as a child under DPDPA?

Under Section 2 of the Act, a child is an individual who has not completed eighteen years of age. Processing a child's personal data requires verifiable consent of a parent or lawful guardian (Section 9, Rule 10). Rule 11 addresses persons with disability who have a lawful guardian.

Does DPDPA apply to employee personal data?

Yes. Digital personal data of employees is within scope. Section 7(i) recognises processing for purposes of employment or for safeguarding the employer from loss or liability, such as preventing corporate espionage and maintaining confidentiality of trade secrets, as a certain legitimate use; notice, security, retention and rights obligations otherwise continue to apply.

Does GDPR compliance make a company DPDPA-compliant?

No. The laws differ on scope, lawful grounds, children, breach intimation, penalties and cross-border rules. On becoming aware of a personal data breach, a Data Fiduciary must (1) intimate each affected Data Principal without delay, (2) give the Data Protection Board an initial description without delay, and (3) furnish the Board with updated and detailed information within 72 hours — or such longer period as the Board may allow on request. There is no blanket 72-hour deadline for notifying Data Principals. Existing GDPR programmes need a documented India gap assessment. AMLEGALS carries this out for foreign companies: https://amlegalsdpdpa.com/dpdpa-for-companies.

What does it cost to become DPDPA-compliant?

Cost depends on the volume and sensitivity of personal data, the number of systems, vendors and touchpoints, cross-border flows and whether the entity is or may be notified as a Significant Data Fiduciary. AMLEGALS scopes this after a first review; an indicative guide is at https://amlegalsdpdpa.com/dpdpa-compliance-cost-india and enquiries go to https://amlegalsdpdpa.com/contact.

Does AMLEGALS provide DPO-as-a-service for DPDPA?

Yes. AMLEGALS provides Data Protection Officer support, including for entities that must publish the contact of a person able to answer questions about processing under Section 8(9) and Rule 9, and readiness for Significant Data Fiduciary obligations under Section 10 and Rule 13. Details: https://amlegalsdpdpa.com/dpo-as-a-service.

Does AMLEGALS help with a personal data breach under DPDPA?

Yes. The breach response practice covers containment advice, intimation to affected Data Principals and the Data Protection Board under Rule 7, parallel CERT-In reporting where applicable, and post-incident remediation. See https://amlegalsdpdpa.com/data-breach-response-dpdpa or write to [email protected] or [email protected].

Where can I find free DPDPA tools?

Free resources include the DPDPA compliance checklist (https://amlegalsdpdpa.com/dpdpa-compliance-checklist), penalty calculator (https://amlegalsdpdpa.com/dpdpa-penalty-calculator), readiness check (https://amlegalsdpdpa.com/dpdpa-readiness-check), document guides (https://amlegalsdpdpa.com/dpdpa-documents) and DPDPA Studio (https://amlegalsdpdpa.com/dpdpa-studio). Content is general legal information and not legal advice.

Who is the founder of AMLEGALS?

Anandaday Misshra is Founder & Managing Partner of AMLEGALS, with more than 28 years of overall legal and regulatory experience. The team is listed at https://amlegalsdpdpa.com/team.

What is the source of the legal statements on this website?

Statutory statements are taken from the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025), as published by MeitY. Law reviewed as on 27 July 2026. Content is general legal information and not legal advice.

How do I contact AMLEGALS for DPDPA advice today?

Send the enquiry form at https://amlegalsdpdpa.com/contact, write to [email protected] or [email protected], or start with the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment. Include your sector, where personal data is collected, key vendors and any cross-border flows so the first response can be specific.

Contact AMLEGALS about DPDPA compliance in India · DPDPA Exposure Assessment