Q: What is DPDPA 2023 and when does it come into full enforcement?

The Digital Personal Data Protection Act, 2023 (DPDPA) is India's first comprehensive data protection legislation governing how organisations collect, process, store, and protect digital personal data. Full enforcement begins 13 May 2027, with DPDP Rules 2025 notified on 13 November 2025.

Q: What is the maximum penalty under DPDPA 2023?

The maximum statutory ceiling is ₹250 crore under Section 33 read with the Schedule to the DPDPA 2023. The Data Protection Board determines the actual penalty quantum based on statutory factors including the nature and gravity of the contravention.

Q: Who needs to comply with DPDPA 2023?

Every organisation — Indian or foreign — that processes digital personal data of individuals in India must comply. This includes Data Fiduciaries, Data Processors, and Significant Data Fiduciaries who face enhanced obligations under the Act and Rules.

Q: What is the VIBE Data Privacy framework?

VIBE Data Privacy is AMLEGALS' proprietary AI-enabled DPDPA compliance evaluation platform that maps organisational readiness across all 44 sections of DPDPA 2023 and the DPDP Rules 2025, generating enforcement-grade evidence packages.

Q: What is a Significant Data Fiduciary under DPDPA?

A Significant Data Fiduciary (SDF) is a Data Fiduciary designated by the Central Government based on criteria including volume and sensitivity of data processed, risk to data principals, and potential impact on sovereignty and security. SDFs have enhanced obligations including mandatory DPO appointment and Data Protection Impact Assessments.