Compliance & Frameworks 13 min read

DPDPA Explained: India's Data Protection Law and How to Get Compliant

A complete, jargon-free guide to India's Digital Personal Data Protection Act, 2023 — who it applies to, consent and notice, data principal rights, penalties up to ₹250 crore, the 2027 deadline, and how to get compliant.

Overview

DPDPA Explained: India's Data Protection Law and How to Get Compliant

If your business touches the personal data of anyone in India — customers, users, employees — a new law now decides how you're allowed to handle it. It's the Digital Personal Data Protection Act, 2023 (DPDPA), India's first comprehensive data-protection law, and after years of waiting, it finally has teeth: the DPDP Rules, 2025 were notified in November 2025, and the clock to full compliance is now running.

This is the complete, jargon-free guide: what the DPDPA actually is, who it applies to, what it asks of you, the penalties for getting it wrong, and how to get ready before the deadline arrives.

What the DPDP Act 2023 is

The DPDPA is India's law for protecting the digital personal data of individuals. In simple terms, it sets the rules for how organisations may collect, use, store, and share the personal data of people in India — built around one core idea: you hold that data in trust, and the person it belongs to has rights over it.

It applies to digital personal data — data in digital form, or physical data that's later digitised. Crucially, it's extraterritorial: it covers processing that happens inside India, and processing done anywhere in the world if it relates to offering goods or services to people in India. So a company with no office in India can still be squarely on the hook.

The key players: who's who under the DPDPA

The Act gives everyone a specific role. Get these straight and the rest of the law reads much more easily.

Term	Who they are
Data Principal	the individual the data is about (the equivalent of a "data subject")
Data Fiduciary	the organisation that decides why and how personal data is processed (like a "controller")
Data Processor	a third party that processes data on a Fiduciary's behalf (a vendor, a cloud tool)
Consent Manager	a registered platform where people grant, review, and withdraw consent in one place
Significant Data Fiduciary (SDF)	a Fiduciary the government designates for large-scale or high-risk processing — with extra duties

The word "fiduciary" is deliberate: it frames the organisation as a trustee of the individual's data, not just a collector of it.

DPDPA Explained: The DPDP Act 2023, Rules 2025 & Compliance | Securion.ai

Back to Resources

Compliance & Frameworks 13 min read

DPDPA Explained: India's Data Protection Law and How to Get Compliant

Overview

DPDPA Explained: India's Data Protection Law and How to Get Compliant

This is the complete, jargon-free guide: what the DPDPA actually is, who it applies to, what it asks of you, the penalties for getting it wrong, and how to get ready before the deadline arrives.

What the DPDP Act 2023 is

The key players: who's who under the DPDPA

The Act gives everyone a specific role. Get these straight and the rest of the law reads much more easily.

Term	Who they are
Data Principal	the individual the data is about (the equivalent of a "data subject")
Data Fiduciary	the organisation that decides why and how personal data is processed (like a "controller")
Data Processor	a third party that processes data on a Fiduciary's behalf (a vendor, a cloud tool)
Consent Manager	a registered platform where people grant, review, and withdraw consent in one place
Significant Data Fiduciary (SDF)	a Fiduciary the government designates for large-scale or high-risk processing — with extra duties

The word "fiduciary" is deliberate: it frames the organisation as a trustee of the individual's data, not just a collector of it.

How to comply: the security controls the Rules require (Rule 6)

This is where the DPDPA differs from ISO 27001. ISO hands you a catalogue of 93 named controls to work through. The DPDPA instead asks for "reasonable security safeguards" — a principle, not a checklist. That sounds vaguer, but Rule 6 of the DPDP Rules, 2025 pins it down to a concrete, minimum set of measures every Data Fiduciary (and its processors) must have. These are your controls — and each one is measurable.

Rule 6 safeguard	What it means in practice	How to measure / evidence it
Encryption & masking	Encrypt personal data at rest and in transit; mask, obfuscate, or tokenise it where you can	% of data stores encrypted, key-management policy, tokenisation coverage
Access controls	Least-privilege access to every system holding personal data; multi-factor authentication	access-review reports, MFA coverage, joiner–mover–leaver records
Logging & monitoring	Log and review who accesses personal data, to detect unauthorised access, investigate, and remediate	log coverage, alerting rules, review cadence
Log retention (1 year)	Keep those access logs for at least one year	retention configuration, log-store audit
Backups & resilience	Be able to keep processing if data is destroyed or compromised	backup success rate, tested restore (RTO / RPO)
Breach detection & response	Detect, investigate, and remediate breaches quickly	detection tooling, an incident runbook, drill records
Processor safeguards	Contractually bind every vendor to the same measures — you stay accountable	signed data-processing agreements, vendor security reviews

The breach clock (Rule 7). If a breach does happen, the timing is strict: notify affected individuals without delay (in clear language — what happened, the likely impact, what you're doing, and what they should do), and file a detailed report to the Data Protection Board within 72 hours of becoming aware. You can only hit that clock if your logging and detection (the controls above) are already working.

So how do you measure compliance? Because "reasonable" isn't a number, you prove it by adopting a recognised control framework and keeping live evidence against it. In practice, that means mapping the Rule 6 safeguards onto a control set you already understand — ISO 27001, SOC 2, or NIST — then scoring every control as implemented, partial, or not started, assigning an owner, and keeping the evidence current for the day the Board asks. That control-by-control, evidence-backed view is exactly how you turn a principle into something you can measure.

Enforcement: the Data Protection Board and the penalties

Enforcement sits with the Data Protection Board of India (DPB) — a digital-first body that investigates breaches and complaints and imposes penalties. The financial stakes are serious; penalties are per instance, set against a schedule:

Failure	Penalty up to
Failure to take reasonable security safeguards (leading to a breach)	₹250 crore
Failure to notify a personal data breach (Board / affected individuals)	₹200 crore
Breach of obligations relating to children	₹200 crore
An SDF's failure to meet its additional obligations	₹150 crore
Breach of any other provision of the Act or Rules (residuary)	₹50 crore

The pattern is clear: the law reserves its heaviest penalty for organisations that fail to secure the data in the first place.

DPDPA vs GDPR: how they differ

If you already comply with the EU's GDPR, you have a head start — but the DPDPA is not a copy of it.

	DPDPA (India)	GDPR (EU)
Scope	digital personal data only	personal data in any form
Lawful bases	consent + a few defined "legitimate uses" (no "legitimate interests")	six bases, including legitimate interests
Children	under 18 need verifiable parental consent; no tracking or targeted ads	16 (or 13 in some states)
Cross-border	allowed except to restricted countries (negative list)	adequacy decisions / standard clauses
Regulator	Data Protection Board of India (digital-first)	national data-protection authorities
Headline penalty	₹250 crore per instance	up to 4% of global turnover

The DPDPA is deliberately leaner and more consent-centric — which sounds simpler, but the narrow lawful bases mean you can't lean on "legitimate interests" the way GDPR programmes often do.

DPDPA Explained: India's Data Protection Law and How to Get Compliant

Overview

DPDPA Explained: India's Data Protection Law and How to Get Compliant

What the DPDP Act 2023 is

The key players: who's who under the DPDPA

DPDPA Explained: India's Data Protection Law and How to Get Compliant

Overview

DPDPA Explained: India's Data Protection Law and How to Get Compliant

What the DPDP Act 2023 is

The key players: who's who under the DPDPA

What you must do: the obligations of a Data Fiduciary

How to comply: the security controls the Rules require (Rule 6)

The rights it gives people

Significant Data Fiduciaries: the higher bar

Children's data and moving data across borders

Enforcement: the Data Protection Board and the penalties

The timeline: when you actually have to comply

Who needs to care

Why it matters for your organisation

The honest part: it's a lot of work — securion.ai can help

Free download: the DPDPA readiness kit

FAQ

Official reference

Overview

DPDPA Explained: India's Data Protection Law and How to Get Compliant

What the DPDP Act 2023 is

The key players: who's who under the DPDPA

Overview

DPDPA Explained: India's Data Protection Law and How to Get Compliant

What the DPDP Act 2023 is

The key players: who's who under the DPDPA

Consent and notice: the foundation

What you must do: the obligations of a Data Fiduciary

How to comply: the security controls the Rules require (Rule 6)

The rights it gives people

Significant Data Fiduciaries: the higher bar

Children's data and moving data across borders

Enforcement: the Data Protection Board and the penalties

The timeline: when you actually have to comply

DPDPA vs GDPR: how they differ

Who needs to care

Why it matters for your organisation

The honest part: it's a lot of work — securion.ai can help

Free download: the DPDPA readiness kit

FAQ

Official reference