Answer six questions about your data operations. We'll show you exactly which obligations apply, and which don't, with an explanation of each.
The checker above shows which of these apply to you. Here is each one in full, so you can read them without answering anything. For the dates, see DPDPA compliance deadlines.
These apply to any organisation that decides why and how personal data of people in India is processed, whatever its size.
Before collecting personal data, provide a clear, itemised notice explaining what data you collect, for what specific purposes, and how it will be used. Obtain free, informed, specific, and unconditional consent before any collection begins. Consent must be as easy to withdraw as it is to give, and you must maintain verifiable records of every consent obtained.
Every individual whose data you hold has the right to access a summary of their personal data, correct inaccuracies, erase data once consent is withdrawn or the purpose is fulfilled, and nominate another person to exercise these rights on their behalf. You must have a functioning mechanism to receive, track, and respond to these requests within the prescribed timeframes.
Personal data may only be used for the specific purposes stated in your consent notice. Once those purposes are fulfilled, or consent is withdrawn, the data must be deleted. You cannot retain personal data indefinitely or repurpose it for new uses without fresh consent. Retention schedules must be documented and enforced.
You are responsible for ensuring that personal data is accurate and complete, especially when it is used to make decisions affecting the individual or is shared with other organisations. Data principals have a statutory right to request corrections, and you must act on valid requests promptly.
Implement reasonable technical and organisational security measures to prevent personal data breaches. The standard expected is proportionate to the sensitivity and volume of data you process. At minimum: encryption at rest and in transit, access controls, regular security assessments, and vendor due diligence for any third parties that process data on your behalf.
If you have a personal data breach, you must tell each affected individual without delay, and tell the Data Protection Board of India without delay, followed by a detailed report within 72 hours of becoming aware of it (or longer if the Board allows). The notice must describe the breach, the data affected, its likely consequences and the steps you have taken. Failing to notify can attract a penalty of up to ₹200 crore.
Publish accessible contact details for a grievance officer (or equivalent point of contact) so that data principals can raise complaints without difficulty. Complaints must be acknowledged and resolved within prescribed timeframes. Failure to respond or resolve can be escalated by the individual to the Data Protection Board.
Under the DPDPA anyone under 18 is a child, a stricter line than GDPR's.
Before processing personal data of any person under 18, you must obtain verifiable consent from a parent or legal guardian. A simple click-through or tick-box is not sufficient; you need a mechanism that genuinely confirms the consenting adult is who they claim to be. This is one of the most operationally complex requirements in the Act.
You are prohibited from behaviourally tracking, monitoring, or targeting advertising at users you know, or reasonably should know, are under 18. This restriction applies even where valid parental consent has been obtained for the underlying data collection. Algorithmic personalisation or recommendations directed at minors also falls within scope.
The Central Government designates Significant Data Fiduciaries by notification. These duties apply only after designation.
The Central Government will formally notify which organisations are Significant Data Fiduciaries, based on volume of data processed, sensitivity of data, national security risk, and potential harm to data principals. Based on your scale and/or sector, your organisation should proactively plan for SDF designation and the additional obligations it triggers.
SDFs must appoint a Data Protection Officer based in India. The DPO represents the organisation under the Act, is responsible to its Board of Directors, and is the point of contact for its grievance redressal mechanism.
SDFs must carry out a Data Protection Impact Assessment once every twelve months from the date they are notified, and the significant findings must be reported to the Data Protection Board. They must also verify that algorithmic software they use to process personal data does not put Data Principals' rights at risk.
SDFs must have an independent data auditor audit their compliance with the Act once every twelve months, and the auditor's significant findings must be reported to the Data Protection Board.
Personal data may be transferred outside India unless the Central Government restricts transfers to a particular country by notification (a negative-list approach, unlike GDPR's adequacy model). Transfers must also meet any requirements the Government specifies, and sector rules that demand stricter localisation, such as the RBI's, still apply. Significant Data Fiduciaries may be required to keep specified categories of data in India.
Any organisation that processes digital personal data of individuals in India, and organisations outside India that process such data in connection with offering goods or services to people in India. Data used purely for personal or domestic purposes, and data an individual has made public themselves, is outside its scope.
No. Every Data Fiduciary is covered regardless of size. Extra duties apply only to organisations the Government designates as Significant Data Fiduciaries, and the Government can exempt some classes, such as startups, from certain provisions by notification.
The obligations on Data Fiduciaries and the penalty provisions commence on 13 May 2027. Consent Manager registration is mandatory from 13 November 2026.
Up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach or to meet the children's-data obligations, up to ₹150 crore for Significant Data Fiduciary failures, and up to ₹50 crore for other breaches of the Act or Rules.
No. It gives a general indication based on your answers. Confirm your obligations with qualified counsel.
A general guide based on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Not legal advice.
See how DPDPA CMS addresses every obligation that applies to you, and get a walkthrough tailored to your organisation.
hello@dpdpacms.comVerify Before Trust. Use DPDPA CMS in your own environment for 3 months. No charge, no commitment. Pay only if you see value.