DPDP Act: India's Data Protection Law Explained for IT Companies

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s data protection law. The Government of India notified the DPDP Rules, 2025 on 13 November 2025, bringing the law into force in three phases. The Data Protection Board of India was set up straight away, consent manager rules follow in November 2026, and almost all obligations on businesses apply from May 2027. For IT, SaaS and edtech companies, the time to prepare is now.

This guide is general information, not legal advice.

What is the DPDP Act?

The Act sets rules for processing digital personal data: personal data collected in digital form, or collected offline and later digitised.

It does not apply to personal data processed for purely personal or domestic purposes, or to personal data that the data principal or someone under a legal obligation has made publicly available.

History and timeline

India introduced the law to give effect to the fundamental right to privacy, replace the limited protections under the IT Act’s Section 43A and SPDI Rules, and support the digital economy with clear rules.

Main objectives:

1. Protect individuals’ personal data and privacy.
2. Allow lawful processing for legitimate purposes.
3. Make organisations accountable, with meaningful penalties.
4. Keep compliance simple and digital by design.

Who needs to comply?

The Act applies to:

1. Processing of digital personal data within India.
2. Processing outside India if it is connected with offering goods or services to data principals in India.

Is it mandatory?

Yes. Penalties are set in the Schedule to the Act and imposed by the Board after an inquiry:

The Board considers factors such as the nature, gravity and duration of the breach, the type of data, repetition, gains or losses, and mitigation steps. The government can also, on the Board’s reference, block public access to a data fiduciary’s platform after repeated penalties.

Key requirements

Grounds for processing

Unlike the GDPR, there is no general “legitimate interests” or “contract” ground.

Notice (Section 5 and Rule 3)

Before or at the time of asking for consent, give a notice that stands on its own, in clear and plain language, and itemises the personal data and the specific purposes, explains how to withdraw consent and exercise rights, and how to complain to the Board. Notices must be available in English or any of the languages in the Eighth Schedule of the Constitution.

Data fiduciary obligations (Section 8)

• Remain responsible for processing, including by processors.
• Engage processors only under a valid contract.
• Ensure completeness, accuracy and consistency where data is used for decisions or disclosed.
• Implement reasonable security safeguards (Rule 6), including:
• encryption, obfuscation, masking or virtual tokens;
• access control;
• visibility of access through logs, monitoring and review;
• backups and measures for continued processing after compromise;
• retention of logs and personal data needed to detect and investigate breaches for at least one year;
• security provisions in processor contracts.
• Notify personal data breaches (see below).
• Erase personal data when the purpose is no longer served or consent is withdrawn, unless retention is legally required, and make processors erase it too.
• Publish contact details of a DPO or a person who can answer questions.
• Set up an effective grievance redressal mechanism.

Breach notification (Rule 7)

There is no “risk” threshold: every personal data breach must be reported.

Retention for large platforms (Rule 8)

E-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh, must erase personal data after three years of the user’s inactivity, unless needed for legal reasons or to keep their account, after notifying the user at least 48 hours before.

Children and persons with disabilities (Section 9 and Rules 10 and 11)

• A child is anyone under 18.
• Obtain verifiable consent of a parent (or lawful guardian for a person with disability who cannot decide) before processing, using reliable identity and age details, for example through government-issued tokens or a Digital Locker service.
• Don’t process children’s data in a way likely to harm their well-being.
• No tracking, behavioural monitoring or targeted advertising directed at children.
• The Rules exempt certain classes, such as healthcare, educational institutions and child-care providers, for specified purposes.

Rights of data principals (Sections 11 to 14)

Significant Data Fiduciaries (Section 10 and Rule 13)

• Appoint a DPO based in India, responsible to the board.
• Appoint an independent data auditor.
• Carry out a data protection impact assessment and audit every 12 months, and report significant findings to the Board.
• Verify that algorithmic software doesn’t pose risks to data principals’ rights.
• Follow any restrictions on transferring specified personal data outside India, as the government decides based on committee recommendations.

Cross-border transfers (Section 16 and Rule 15)

Transfers outside India are allowed unless the government restricts transfers to specific countries. Sector rules with stricter localisation, such as RBI payment data localisation, still apply.

How to implement the DPDP Act

1. Map personal data: what you collect, why, the legal ground, where it is stored, who you share it with, how long you keep it.
2. Decide your role for each activity: data fiduciary or processor.
3. Review legal grounds: where you rely on consent, redesign consent flows; check which uses fit “legitimate uses”.
4. Rewrite notices to meet Rule 3, with itemised data and purposes and language options.
5. Build consent withdrawal that is as easy as giving consent, and plan for consent manager integration from November 2026.
6. Strengthen security against Rule 6: encryption, access control, logging and one-year log retention, backups.
7. Set up breach response for immediate notification to individuals and the 72-hour detailed report to the Board.
8. Handle children’s data: age assurance, verifiable parental consent, and switch off tracking and targeted ads for under-18s. This is critical for edtech and LMS platforms.
9. Update processor contracts with security and erasure terms.
10. Set retention and erasure schedules, including the three-year inactivity rule if it applies to you.
11. Publish DPO or contact details and a grievance process.
12. If you may be an SDF, plan for a DPO in India, annual DPIA and independent audit.

Documentation and policies

• Personal data inventory and data flow maps
• Notices (in required languages) and consent records
• Legitimate use assessments
• Information security policy and evidence of Rule 6 safeguards
• Log retention policy (minimum one year)
• Breach response procedure, templates for individuals and the Board, and breach register
• Processor contracts and sub-processor list
• Retention and erasure schedule
• Children’s data procedures and parental consent records
• Grievance redressal procedure and records
• DPO appointment, DPIAs and audit reports (for SDFs)

Audits, assessments and enforcement

• The Data Protection Board of India inquires into breaches based on complaints, government references, court directions or breach intimations, and is designed to operate as a digital office.
• Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
• SDFs must have annual independent data audits.
• No official certification. ISO 27701 and ISO 27001 are useful evidence of accountability and reasonable security.

Cost

Benefits

• Readiness for Indian and global customers who expect privacy compliance.
• Lower breach risk and penalty exposure.
• A foundation shared with GDPR, making cross-border business easier.
• User trust, especially for children’s and education platforms.

Risks of non-compliance

• Penalties up to INR 250 crore per breach.
• Blocking of platforms after repeated penalties.
• Lost contracts with enterprise and government customers.
• Reputational damage.

Common mistakes

• Waiting until May 2027. Engineering changes such as consent, logging and erasure take months.
• Assuming GDPR compliance is enough. The DPDP Act has no legitimate interests ground, defines children as under 18 and has no risk threshold for breach reporting.
• Bundled consent buried in terms and conditions.
• Tracking or targeted ads for under-18 users.
• Deleting logs too soon: the Rules require at least one year.
• No processor contracts.

Challenges for IT companies

• Age assurance without collecting excessive data, especially for edtech, gaming and social apps.
• Being a processor for Indian customers while they expect DPDP-ready contracts and security.
• Two breach reporting regimes: the DPDP Board and CERT-In’s six-hour reporting for cyber incidents.
• Erasure across systems and backups.
• Consent manager integration from November 2026.

Best practices

• Build one privacy programme for the DPDP Act and the GDPR, with India-specific settings.
• Use a consent management platform that supports withdrawal and audit trails.
• Default to no behavioural tracking for users who may be under 18.
• Combine breach playbooks for CERT-In (six hours) and the DPDP Board (immediate and 72 hours).
• Keep security logs for at least one year, in line with both the DPDP Rules and CERT-In’s 180-day log requirement.

Tools that help

How the DPDP Act relates to other frameworks

Real-world examples

• Phased rollout. The government chose an 18-month runway for most obligations, recognising the engineering work needed for consent, logging and children’s data.
• Edtech and children. Because the Act defines children as under 18 and bans tracking and targeted ads for them, Indian edtech and LMS platforms face some of the biggest design changes.
• Illustrative scenario, not a real company: an Indian LMS company serving schools maps its data, moves consent for optional analytics into a separate notice, adds verifiable parental consent for students, switches off ad pixels for logged-in learners, extends log retention to one year, and updates processor contracts with its cloud and email providers.

Frequently asked questions

When does the DPDP Act come into force? In phases: the Board and core provisions from 13 November 2025, consent managers from November 2026, and most obligations from May 2027.

Does the DPDP Act apply to foreign companies? Yes, if they process personal data outside India in connection with offering goods or services to people in India.

Who is a child under the DPDP Act? Anyone under 18.

How quickly must breaches be reported? To affected individuals and the Board without delay, with a detailed report to the Board within 72 hours.

Is there a minimum company size? No general size threshold. The government can exempt certain classes, such as some startups.

What are the penalties? Up to INR 250 crore for failing to take reasonable security safeguards, with other caps for other breaches.

Does the DPDP Act allow data transfers outside India? Yes, except to countries the government restricts. Sector rules may still require local storage.

What happens to the SPDI Rules? Section 43A of the IT Act and the SPDI Rules are omitted when the relevant DPDP provisions commence in May 2027.

Do we need a DPO? Significant Data Fiduciaries must appoint a DPO based in India. Other data fiduciaries must publish contact details of a DPO or a person who can answer questions.

Next steps

• Map personal data and the legal ground for each purpose.
• Redesign consent and notices for Rule 3.
• Extend log retention to at least one year.
• Build breach notification for individuals and the Board.
• If you serve under-18s, plan parental consent and switch off tracking for them.