DPDP Act 2023 & Rules 2025: A Practical Compliance Guide for Businesses

Law

DPDP Act 2023 + DPDP Rules 2025

Rules notified

13 November 2025

Core provisions live

13 May 2027

Top penalty

Up to ₹250 crore

For years, India handled personal data through a patchwork of sectoral rules. That era is ending. The DPDP Act 2023, now backed by the DPDP Rules 2025, gives the country a single framework for digital personal data — and it places concrete, enforceable duties on almost every business that holds customer or employee information. Here's what it means and how to prepare.

Who the law applies to

The framework covers digital personal data collected in India, or collected in connection with offering goods or services to people in India. If your business holds data about identifiable individuals — customers, employees, job applicants, contractors, website users — it's in scope. A few key roles decide your obligations:

• Data Principal — the individual the data is about (your customer, employee or user).
• Data Fiduciary — the organisation deciding why and how data is processed. Most businesses are Data Fiduciaries; an employer is a Data Fiduciary for its staff data.
• Data Processor — a vendor processing data on your behalf (payroll provider, HR tech, cloud host, background-check agency).
• Significant Data Fiduciary (SDF) — larger or higher-risk organisations the government notifies, with extra duties (see below).
• Consent Manager — a registered, India-incorporated platform through which individuals give, review and withdraw consent.

The phased timeline — and why to start now

The DPDP framework doesn't switch on all at once. It commences in stages, which is exactly why the smart move is to begin early rather than wait for the deadline:

1. Already in force (13 Nov 2025): the Data Protection Board provisions and Rules 1, 2 and 17–21 — the institutional and procedural backbone.
2. One year on (13 Nov 2026): Rule 4 and certain specified Act provisions — further operational requirements.
3. Eighteen months on (13 May 2027): the heart of the law — consent, notice, processing, data-principal rights, security safeguards and breach notification (Rules 3, 5–16, 22–23).

What businesses must actually do

Notice and consent

Before processing personal data, give a clear, standalone notice — an itemised list of what you collect, the specific purposes, and how people can withdraw consent, exercise rights and complain. A generic global privacy policy may not meet Indian requirements. Where you rely on consent, it must be free, specific, informed, unambiguous and given by clear affirmative action — and withdrawing it must be as easy as giving it. Blanket employee consent forms won't do.

Purpose limitation and retention

Use data only for the purposes you stated, and delete it once it's no longer needed — subject to genuine legal, statutory or litigation requirements. You need a documented retention-and-deletion framework, not ad-hoc storage forever.

Security safeguards

Adopt real technical and organisational measures: encryption, masking or tokenisation, access controls, logging and monitoring, backups and resilience, and detection and remediation of unauthorised access — plus contractual safeguards with your processors. This is where the heaviest penalty sits.

Breach response

Build an incident-response capability covering detection, containment, assessment, notification to the Board, communication to affected individuals, remediation and post-incident review. The Rules prescribe breach-reporting procedures and timelines.

Data-principal rights

Individuals can seek access to their data, correction and erasure, grievance redressal, and can nominate someone to exercise their rights on death or incapacity. These need working systems, not just policy statements.

Children's data

The Act treats anyone under 18 as a child. Processing their data needs verifiable parental consent, with restrictions on behavioural monitoring and on targeted advertising directed at children.

Vendor (processor) governance

Outsourcing doesn't outsource the liability. As a Data Fiduciary you remain responsible, so you must know who processes your data, why, what they hold, where it's stored, how it's secured, how breaches are reported, and what happens to the data when the contract ends.

Extra duties for Significant Data Fiduciaries

If the government notifies you as an SDF, you must additionally appoint a Data Protection Officer, appoint an independent data auditor, run periodic data-protection impact assessments, and undergo regular audits.

The penalties — why this reaches the board

These are maximums — actual penalties depend on the violation — but the scale makes the point: data protection is now a governance and risk-management issue for leadership, enforced by a dedicated Data Protection Board of India (established 13 November 2025, headquartered in the National Capital Region).

A practical path to compliance

You don't need to do everything at once, but you do need to start in the right order:

• Understand & map. Identify every category of personal data you hold and trace where it lives and who it goes to.
• Assess the basis. For each use, pin down the purpose and lawful basis — consent or a legitimate use — and check your notices.
• Assign ownership. Name a privacy owner (or DPO), define roles and set escalation paths.
• Remediate. Update notices, fix processor contracts, strengthen consent and security, and document retention and breach-response.
• Operationalise rights. Build working flows for access, correction, erasure, nomination and grievances — and test them.
• Audit & evidence. Keep audit trails and documented proof of compliance, ready for any inquiry.

Disclaimer: This article explains the DPDP Act 2023 and DPDP Rules 2025 for general understanding and is current as at the date of publication. Commencement dates are phased and specific obligations, thresholds and procedures are governed by the Act, the Rules and notifications in force — verify the current position and your specific status before acting. This is not legal advice; please consult a qualified professional. Talk to efiletax if you need help.