Questions about the DPDP Act, answered against the Act itself.

India's law governing how digital personal data is processed. It sets out who may process personal data and on what grounds, the duties of the organisations that decide why and how data is processed, the rights of the individuals the data is about, and a Data Protection Board with the power to inquire into breaches and impose monetary penalties.

It covers data collected in digital form and data collected on paper and digitised afterward.

Section 1Section 3

The Rules were published on 13 November 2025, and the Act is being brought into force in three phases by the commencement notification G.S.R. 843(E).

From 13 November 2025: the definitions, the Data Protection Board provisions, and the Rules-making and miscellaneous provisions. From 13 November 2026: registration of Consent Managers and one Board power. From 13 May 2027: nearly every substantive obligation on Data Fiduciaries, including consent, notice, security, breach notification, children's data and Data Principal rights.

Section 1

Any data about an individual who is identifiable by or in relation to that data. A name, phone number, email address, device identifier or account number all qualify when they can be tied back to a person.

The Act applies only to digital personal data: data collected digitally, or collected offline and later digitised.

Section 2Section 3

Any person who, alone or together with others, determines the purpose and means of processing personal data. In plain terms, the organisation that decides why and how the data is processed.

Size is irrelevant, and so is whether it does the processing itself or hands it to a vendor. Most of the Act's obligations sit with the Data Fiduciary.

Section 2Section 8

The individual the personal data is about. Where that individual is a child, the term includes her parent or lawful guardian; where she is a person with disability, it includes her lawful guardian.

Section 2

A person who processes personal data on behalf of a Data Fiduciary, such as a cloud host, payroll vendor or support-desk provider. A Data Fiduciary may engage one only under a valid contract, and stays responsible for compliance regardless of what that contract says.

Section 2Section 8

Almost anything done to it, wholly or partly by automated means: collection, recording, storage, organisation, retrieval, use, combination, sharing, disclosure, restriction, and erasure or destruction. If your systems touch the data, you are processing it.

Section 2

Yes, where the processing relates to offering goods or services to people in India. Where your servers or legal entity sit does not change that. Processing outside India that has no such connection is outside its scope.

Section 3

It must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the stated purpose. Silence, inactivity and pre-ticked boxes do not count.

Any part of a consent that would waive a right under the Act, such as the right to complain to the Board, is invalid to that extent. If consent is disputed, the Data Fiduciary has to prove that valid notice was given and consent obtained.

Section 6

An itemised description of the personal data and the purpose it will be processed for, how to withdraw consent, how to exercise her rights, and how to complain to the Board. It must be given before or together with the consent request, and be available in English or any Eighth Schedule language.

Rule 3 adds that the notice must stand on its own, separate from other information, and must carry the actual link for withdrawing consent, exercising rights and reaching the Board.

Section 5

Yes, at any time, and withdrawing must be as easy as giving consent was: the same channel, and no more steps. Once consent is withdrawn, the Data Fiduciary and its Data Processors must stop processing within a reasonable time, unless another lawful ground applies.

Withdrawal does not make earlier processing unlawful.

Section 6

Only for the "certain legitimate uses" listed in Section 7: data the person voluntarily provided for a specific purpose and has not objected to; State subsidies, benefits, services, licences and permits; State functions and national security; legal disclosure obligations; court orders; medical emergencies; treatment during an epidemic; safety during a disaster or breakdown of public order; and employment purposes.

That list is complete. There is no general "legitimate interest" ground beyond it.

Section 4Section 7

An entity through which a Data Principal can give, manage, review and withdraw her consent across Data Fiduciaries. A Consent Manager is accountable to the Data Principal and must be registered with the Data Protection Board.

The registration requirement starts on its own earlier date, 13 November 2026.

Section 6

Processing can continue on them until they are withdrawn, but the Data Fiduciary must send an equivalent notice, covering what data was processed and why, plus the rights and complaint information, as soon as reasonably practicable.

Section 5

Four: to obtain a summary of the personal data held and how it is processed, including who it has been shared with (Section 11); to have it corrected, completed, updated or erased (Section 12); to readily available grievance redressal (Section 13); and to nominate someone to exercise these rights if she dies or becomes incapacitated (Section 14).

The access, correction and erasure rights run against Data Fiduciaries she has given consent to.

Section 11Section 12Section 13Section 14

The Act itself does not fix a number of days. It leaves the response period for access, correction, erasure and grievance requests to be prescribed, and Rule 14 of the DPDP Rules, 2025 sets it. Publish the period you work to alongside your request channel.

A Data Principal must use your grievance channel before she can take a complaint to the Board, so it is the real first line, not a formality.

Section 11Section 13

Only where keeping the data is still necessary for the purpose it was collected for, or another law requires it to be retained. Otherwise it must erase the data, and be ready to justify any refusal if challenged.

Section 12

Yes, five: comply with the law when exercising her rights; not impersonate anyone; not suppress material information when applying for State-issued documents or identifiers; not file false or frivolous complaints; and give only verifiably authentic information when seeking correction or erasure.

A breach can draw a penalty of up to ₹10,000. It is the only penalty in the Act that falls on the individual rather than an organisation.

Section 15

Section 8 applies on top of whichever lawful ground is used: stay responsible for compliance regardless of contracts; engage processors only under a valid contract; keep data accurate where it drives a decision or is shared; implement technical and organisational measures; take reasonable security safeguards; notify breaches; erase data when it is no longer needed; publish a contact for processing queries; and run an effective grievance mechanism.

Section 8

Until the Data Principal withdraws consent or the purpose it was collected for is no longer being served, whichever comes first, unless another law requires it to be kept. At that point the Data Fiduciary must erase it and have its Data Processors do the same.

Section 8

Yes, wherever the data will be used to make a decision about the Data Principal or disclosed to another Data Fiduciary. It must be complete, accurate and consistent in those cases.

Section 8

A Data Processor may only be engaged under a valid contract. There is no informal-arrangement exception. Under Rule 6, that contract should bind the processor to the same security safeguards the Data Fiduciary itself must take.

The Data Fiduciary stays accountable for what its processors do.

Section 8

It must publish, on its website or app, the business contact details of a Data Protection Officer (where one is required) or another person who can answer questions about its processing. The same contact must appear in every consent request.

Section 6Section 8

A Data Fiduciary, or a class of them, that the Central Government notifies as significant, based on factors such as the volume and sensitivity of the data processed, the risk to Data Principals, and potential impact on sovereignty, electoral democracy, State security or public order.

It is a designation, not a self-assessment. No size or revenue threshold makes an organisation one automatically.

Section 10

Three, on top of the ordinary duties: appoint an India-based Data Protection Officer who answers to the board and is the grievance point of contact; appoint an independent data auditor; and carry out periodic Data Protection Impact Assessments and audits, plus the further measures in Rule 13.

Breaching these carries a penalty of up to ₹150 crore.

Section 10

A periodic assessment a Significant Data Fiduciary must carry out, covering the rights of Data Principals, the purpose of the processing, and how the risks to them are managed. It is required of Significant Data Fiduciaries, not of every Data Fiduciary.

Section 10

Anyone under 18.

Section 2Section 9

Verifiable consent from a parent or lawful guardian is required before processing a child's personal data, with the mechanisms set by Rule 10. The same applies to a person with disability who has a lawful guardian.

Two things are barred even with consent: processing likely to harm a child's well-being, and tracking, behavioural monitoring or targeted advertising directed at children. Breaching these duties carries a penalty of up to ₹200 crore.

Section 9

Yes, narrow ones in Rule 12. Certain classes, including clinical establishments, schools, crèches and school-transport operators, are exempt for processing tied to health, safety or education. Certain purposes are exempt whoever does them, including government benefits in the child's interest, email-account creation, real-time location for safety, and age-gating itself.

The government can also notify an age above which a specific Data Fiduciary is exempt, but only by naming it. It is not a general safe harbour.

Section 9

The Schedule to Section 33 sets maximums: up to ₹250 crore for failing to take reasonable security safeguards; up to ₹200 crore for failing to notify a breach; up to ₹200 crore for breaching the children's-data duties; up to ₹150 crore for breaching Significant Data Fiduciary duties; up to ₹10,000 for a Data Principal breaching her duties; and up to ₹50 crore for breaching any other provision.

The government can raise these by notification, but never beyond double the original figures.

Section 33Section 42

Within the Schedule's ceiling, it must weigh the nature, gravity and duration of the breach; the type and sensitivity of the data; whether the breach was repeated; any gain made or loss avoided; how quickly and effectively it was mitigated; whether the penalty is proportionate and would deter; and its likely impact on the person.

Documented mitigation after a breach is something the Board has to take into account.

Section 33

No. The Act's penalties are monetary, imposed by the Board after an inquiry and a hearing. It creates no imprisonment or criminal offence of its own. Repeat penalties can, however, lead to the Central Government blocking public access to a Data Fiduciary's platform.

Section 33Section 37

Yes, as a last resort. If the Board has penalised a Data Fiduciary two or more times and advises that blocking is in the public interest, the Central Government can, after hearing the Data Fiduciary, direct that public access to the resource it uses to serve people in India be blocked.

Section 37

On a personal data breach, the Data Fiduciary must notify the Board and every affected Data Principal without delay, then give the Board a full report covering the cause, impact and mitigation within 72 hours of becoming aware of it (Rule 7).

Failing to notify carries a penalty of up to ₹200 crore.

Section 8

Reasonable safeguards to prevent a breach. Rule 6 spells out what that includes: encryption, masking or similar measures; access control; monitoring and logging; backups; processor contracts that bind the same safeguards; and keeping breach-related logs for one year.

Failing to take reasonable safeguards is the Act's highest-penalty breach, up to ₹250 crore.

Section 8

Yes. Transfer is permitted by default. The Central Government can restrict transfers to specific countries or territories by notification, and only a notified restriction narrows that default.

Section 16

Not as a general rule. It takes the notified-restriction approach described above. But it does not override other Indian laws: a stricter sectoral localisation rule that applies to your data or industry still applies on top.

Section 16Section 38

The body the Act sets up to enforce it: a Chairperson and Members appointed by the Central Government, each serving a two-year term. It works as a digital office by design, receiving, hearing and deciding complaints digitally.

It acts on breach notifications, complaints from Data Principals, government references and court directions. It can inquire, issue binding directions, order interim measures and impose penalties, with a civil court's powers to summon witnesses and inspect documents.

Section 18Section 19Section 27Section 28

Yes, two ways. The Board can direct the parties to mediation. It can also accept a voluntary undertaking, a commitment to take or stop specified action, at any stage of a proceeding, which bars further proceedings on its contents. Breaching an accepted undertaking is treated as a breach of the Act.

Section 31Section 32

To the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), within 60 days of receiving the order. The Tribunal can admit a late appeal for sufficient cause, and aims to decide appeals within six months.

Civil courts have no jurisdiction over matters the Board handles and cannot grant injunctions against action under the Act, so the Tribunal is the route.

Section 29Section 39

Section 17 carves out narrow, purpose-bound cases from most of the Chapter II and III obligations. These include enforcing legal rights; courts, tribunals and regulators; preventing and investigating offences; India-based processing of foreign residents' data under contract; court-approved mergers; and assessing loan defaulters. Accountability and security safeguards still apply even then.

The government can also exempt notified State bodies, research and statistical processing that does not feed decisions about individuals, and notified classes of Data Fiduciaries, including startups, from specific duties.

Section 17

Yes. Personal data an individual processes for a purely personal or domestic purpose is outside the Act, and so is data the Data Principal made public herself or that someone was legally obliged to publish. The carve-out does not cover anything done in a business or organisational capacity.

Section 3

Not automatically. The Central Government can notify Data Fiduciaries or classes of them, including startups, as exempt from specific provisions such as notice, accuracy, erasure, Significant Data Fiduciary duties and the access right. Until your organisation or class is actually notified, the full Act applies.

Section 17

A privacy policy does not replace the Section 5 notice. The notice must stand on its own, be given at or before the consent request, and carry working links for withdrawal, rights requests and complaints to the Board. Alongside it, publish the contact for processing queries and a reachable grievance channel.

It commences on 13 May 2027, eighteen months after the DPDP Rules, 2025 were published.

Section 5Section 8

Enough to prove, if challenged, that valid notice was given and consent obtained, because Section 6(10) puts that burden on the Data Fiduciary. Also keep the breach-related logs Rule 6 requires to be retained for one year, and records organised well enough to answer a government information request.

Section 6Section 8Section 36

Yes. Employee data is personal data. Processing for employment purposes, or to protect the employer from loss or liability, is a legitimate use that does not need consent. It must stay scoped to that relationship, not general monitoring, and every other obligation, including security, accuracy and breach notification, still applies.

Section 7Section 8

It adds to other laws rather than replacing them, and prevails only where there is a genuine conflict. It also amends the IT Act: Section 43A, the old compensation provision for negligent data handling, is omitted from 13 May 2027, when the DPDP breach and penalty regime takes over.

Section 38Section 44

Map what personal data you hold and why; tie each processing activity to consent or a specific Section 7 legitimate use; put a compliant notice and consent flow in front of every collection point; set up request and grievance channels; and review security safeguards and processor contracts against Rule 6.

It commences on 13 May 2027, eighteen months after the DPDP Rules, 2025 were published.

Section 4Section 5Section 6Section 8