AMLEGALSDPDPA

Knowledge Centre

DPDPA Frequently
Asked Questions

Q: What is DPDPA?

DPDPA (Digital Personal Data Protection Act 2023) is India's comprehensive data protection law. It governs digital personal data processing, establishes data principal rights, and prescribes penalties up to ₹250 crore for violations.

Q: When does DPDPA come into force?

DPDPA was enacted in August 2023. DPDP Rules 2025 were notified in November 2025, with organizations getting 18 months to achieve compliance.

Q: Who must comply with DPDPA?

All data fiduciaries processing digital personal data in India must comply, including foreign companies processing data of Indian residents. This covers IT, fintech, healthcare, e-commerce, and all sectors.

Q: What are DPDPA penalties?

DPDPA penalties range from ₹50 crore for minor violations to ₹250 crore for serious breaches. Children's data violations attract up to ₹200 crore. The Data Protection Board enforces compliance.

Q: Do I need a DPO under DPDPA?

Only Significant Data Fiduciaries (SDFs) must appoint a DPO under DPDPA. The DPO must be India-resident and serve as the contact point for the Data Protection Board.

Authoritative guidance on the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.

15 of 15 entries

Quick Reference

Maximum Penalty

₹250 Crores

Breach Notification

72 Hours

Child Definition

Under 18 Years

Effective Date

11 August 2023

View Full Codex

Have a specific compliance question?

Our data protection team provides authoritative guidance.

Get in Touch

DPDPA Frequently
Asked Questions

How to obtain valid consent under DPDPA 2023?

When to appoint a Data Protection Officer (DPO) under DPDPA?

How to conduct a Data Protection Impact Assessment (DPIA) under DPDPA?

When to report a data breach to the Data Protection Board?

What is a Significant Data Fiduciary (SDF) and what are its additional obligations?

How to process children's data lawfully under DPDPA?

When can personal data be processed without consent under DPDPA?

How to structure cross-border data transfers under DPDPA?

What are the data retention requirements under DPDPA?

What are the penalties for non-compliance under DPDPA?

How to handle Data Principal access and correction requests?

What is the role of Consent Managers under DPDPA?

What security safeguards are required under DPDPA?

When does DPDPA apply to legacy data collected before enforcement?

How to establish a grievance redressal mechanism under DPDPA?

DPDPA FrequentlyAsked Questions

How to obtain valid consent under DPDPA 2023?

When to appoint a Data Protection Officer (DPO) under DPDPA?

How to conduct a Data Protection Impact Assessment (DPIA) under DPDPA?

When to report a data breach to the Data Protection Board?

What is a Significant Data Fiduciary (SDF) and what are its additional obligations?

How to process children's data lawfully under DPDPA?

When can personal data be processed without consent under DPDPA?

How to structure cross-border data transfers under DPDPA?

What are the data retention requirements under DPDPA?

What are the penalties for non-compliance under DPDPA?

How to handle Data Principal access and correction requests?

What is the role of Consent Managers under DPDPA?

What security safeguards are required under DPDPA?

When does DPDPA apply to legacy data collected before enforcement?

How to establish a grievance redressal mechanism under DPDPA?

DPDPA Frequently
Asked Questions