The Digital Personal Data Protection (DPDP) Act, 2023 is India's dedicated law for protecting digital personal data. It gives individuals, called Data Principals, rights to access, correct and erase their data and to seek grievance redressal. It requires organisations, called Data Fiduciaries, to collect only the data they need, obtain clear consent unless a legitimate use applies, keep data secure and report breaches. The DPDP Rules, 2025 were notified in November 2025 and apply in phases: Data Protection Board provisions took effect first, Consent Manager provisions apply from 13 November 2026, and most Data Fiduciary obligations apply from 13 May 2027. Penalties can reach ₹250 crore for the most serious contraventions.
Shopping, banking, social media and a growing number of connected devices mean that organisations now collect and store more of our personal information than ever. The DPDP Act was introduced so that this data is handled with responsibility, transparency and respect for individual privacy.
The Act marks a significant step in safeguarding digital privacy in India. It sets rules on how personal data should be collected, stored and shared, gives individuals more control over their data, and places clear obligations on companies to prioritise security, transparency and user consent.
This guide explains the key aspects of the DPDP Act and the DPDP Rules, 2025, what they mean for individuals and for businesses, and how to start preparing. It also covers how data protection sits alongside product approvals such as BIS, WPC and TEC for companies selling connected products in India.
📑 Table of Contents
- 1. What Is the DPDP Act?
- 2. Key Terms You Should Know
- 3. DPDP Rules 2025 and the Compliance Timeline
- 4. Key Provisions of the DPDP Act
- 5. Penalties Under the DPDP Act
- 6. Sensitive Personal Data and Children's Data
- 7. How Will the DPDP Act Impact Companies?
- 8. How to Prepare for DPDP Compliance
- 9. Rights of Individuals Under the DPDP Act
- 10. DPDP Act and Product Compliance in India
- 11. How Rego Services Can Help
- 12. Frequently Asked Questions
1. What Is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is a law passed in India to safeguard personal data in the digital world. It received Presidential assent on 11 August 2023. It was designed to give people more control over their personal data and to make sure organisations handle that data responsibly. The Act applies to digital personal data, meaning personal data collected in digital form or digitised afterwards.
Once its provisions are in force, the Act replaces Section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011, according to legal summaries. You can read the official text of the Act on the MeitY website.
2. Key Terms You Should Know
The person whose data is collected. If you fill out a form online, you are the Data Principal.
The organisation that decides why and how personal data is processed, such as a social media platform or an online shop.
Clear permission from the Data Principal before collecting personal data. It must be easy to understand, specific and withdrawable.
A Data Fiduciary notified by the Central Government based on factors such as data volume, sensitivity and risk. It has extra duties.
A registered entity that helps Data Principals give, manage, review and withdraw their consent.
The body that handles complaints and breaches and can impose penalties under the Act.
3. DPDP Rules 2025 and the Compliance Timeline
The Act needs rules and commencement notifications to become fully operational. The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules, 2025 in November 2025, and the provisions come into force in phases.
The obligations that apply from 13 May 2027 include notices, consent, security safeguards, breach intimation, retention and erasure, Data Principal rights, children's data and the duties of Significant Data Fiduciaries. These dates follow the commencement notification and public legal summaries, so confirm them in the official gazette notifications.
4. Key Provisions of the DPDP Act
Here is what the Act requires organisations to do.
5. Penalties Under the DPDP Act
Non-compliance can lead to heavy fines. Monetary penalties can reach ₹250 crore for the most serious contraventions, such as failing to take reasonable security safeguards. Other contraventions carry lower ceilings listed in the Act's Schedule. The Data Protection Board decides penalties after an inquiry and considers factors such as the nature and gravity of the breach.
High penalties are meant to push organisations to prioritise data security, so treat the figure as a reason to plan early, not as a prediction of what a particular company would pay.
6. Sensitive Personal Data and Children's Data
Many articles say the DPDP Act has special rules for sensitive data such as health, financial or biometric information. Legal summaries point out that this is not how the Act is built.
For children, the Rules require verifiable consent from a parent or lawful guardian before processing a child's data. Organisations handling health, financial or biometric information should still apply stronger security because the harm from a breach is greater.
7. How Will the DPDP Act Impact Companies?
The Act changes how businesses handle personal data.
Companies must draft clear, user-friendly privacy policies that explain their data practices.
Strong security must be implemented to prevent unauthorised access and data breaches.
Businesses must be ready to respond to data requests, show compliance and face regulatory scrutiny.
Non-compliance can result in heavy fines, which makes data security a business priority.
8. How to Prepare for DPDP Compliance
A practical sequence for organisations that process the personal data of people in India:
List what personal data you collect, why you collect it, where it is stored and who it is shared with, including vendors, apps and connected devices.
Draft clear, user-friendly notices that explain what data you collect, the purpose and how individuals can exercise their rights.
Make sure consent is clear, specific and can be withdrawn as easily as it was given, unless a legitimate use applies.
Put reasonable technical and organisational safeguards in place to prevent unauthorised access, loss or alteration of personal data.
Define who investigates a breach, how affected individuals and the Data Protection Board are informed, and how quickly.
Create a process to respond to access, correction and erasure requests and grievances, and to erase data once its purpose is served.
If notified, plan for a Data Protection Officer, impact assessments and periodic audits.
9. Rights of Individuals Under the DPDP Act
The Act empowers people to control their data and feel more secure online. Individuals have the right to know how their data is used and to have it corrected or erased in specified circumstances.
The Act does not include a general right to data portability. Rights are also subject to legal limits, so an organisation can refuse to erase data it is legally required to keep.
10. DPDP Act and Product Compliance in India
If you manufacture, import or sell connected products in India, such as smart devices, IoT products or devices with a companion app, the DPDP Act may apply to the personal data those products and apps collect. Product approvals and data protection are separate regimes, and one does not replace the other.
| Regime | What it covers |
|---|---|
| DPDP Act | How personal data of individuals is collected, used, stored and protected |
| BIS | Product safety and quality under BIS schemes. See our BIS certification services |
| TEC (MTCTE) | Conformity of notified telecom equipment. See our complete TEC certification guide |
| WPC ETA | Radio-frequency compliance of wireless equipment in licence-exempt bands |
Plan product approvals and data protection together, so that a launch is not held up by one that was missed.
11. How Rego Services Can Help
Rego Services Private Limited helps manufacturers, importers and foreign manufacturers with Indian product certifications such as BIS, WPC ETA, BEE, TEC, EPR and CDSCO licensing. For connected products, we can help you understand which product approvals apply and plan them around your launch.
Rego Services does not provide legal advice on the DPDP Act. For personal data obligations, consult a qualified privacy or legal adviser, and we are glad to coordinate with them on your product timeline.
12. Frequently Asked Questions
1. What is the DPDP Act?
The Digital Personal Data Protection (DPDP) Act, 2023 is India's dedicated law on the processing of digital personal data. It gives individuals (Data Principals) rights over their data and sets duties for organisations (Data Fiduciaries) that collect and use it.
2. When does the DPDP Act apply to businesses?
The Act and the DPDP Rules, 2025 are being brought into force in phases. The Data Protection Board provisions took effect in November 2025, Consent Manager provisions apply from 13 November 2026, and most Data Fiduciary obligations apply from 13 May 2027. Confirm the dates against the official notifications.
3. What is the penalty for non-compliance with the DPDP Act?
Monetary penalties can go up to ₹250 crore for the most serious contraventions, such as failing to take reasonable security safeguards. Other contraventions carry lower ceilings set out in the Act's Schedule. The Data Protection Board decides penalties after an inquiry.
4. Does the DPDP Act have a separate category for sensitive personal data?
No. Legal summaries note that the Act applies to all digital personal data alike and does not create a separate category of sensitive personal data. Higher obligations apply instead to Significant Data Fiduciaries and to the processing of children's data.
5. What rights do individuals have under the DPDP Act?
Data Principals have the right to access information about their personal data, to seek correction and erasure, to grievance redressal, and to nominate another person to exercise their rights in the event of death or incapacity. The Act does not include a general right to data portability.
6. Can personal data be processed without consent?
Yes, in certain situations the Act calls legitimate uses, such as specified government functions, compliance with legal obligations, medical emergencies and employment-related purposes. These are defined narrowly, so check the exact wording of the Act before relying on one.
7. What must a company do if there is a data breach?
The Rules require the Data Fiduciary to inform affected individuals without delay and to report the breach to the Data Protection Board, with a detailed report due within 72 hours according to legal summaries. Confirm the current requirement in the Rules.
8. Who is a Significant Data Fiduciary?
A Data Fiduciary the Central Government notifies as significant based on factors such as the volume and sensitivity of data processed and risk to individuals. Significant Data Fiduciaries have extra duties, including appointing a Data Protection Officer and conducting data protection impact assessments and audits.
9. Where can I read the official text of the DPDP Act?
The Ministry of Electronics and Information Technology (MeitY) publishes the Act. You can read the official text of the DPDP Act, 2023 on the MeitY website.
✓ Key Takeaways
- The DPDP Act, 2023 is India's dedicated law for digital personal data
- It gives individuals rights and places duties on organisations that process their data
- The DPDP Rules, 2025 apply in phases, with most Data Fiduciary obligations from 13 May 2027
- Penalties can reach ₹250 crore for the most serious contraventions
- The Act does not have a separate sensitive data category, but children's data and Significant Data Fiduciaries face stricter rules
- Consent must be clear and withdrawable, and breaches must be reported
- Data protection and product approvals such as BIS, TEC and WPC are separate regimes
- Verify dates and requirements with official sources and a legal adviser
Reviewed by the Rego Services Compliance Team | Last Updated: October 2026 | Key Instruments: DPDP Act, 2023; DPDP Rules, 2025
Official References
- Digital Personal Data Protection Act, 2023: MeitY official text
- Ministry of Electronics and Information Technology: meity.gov.in