Fast facts
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection statute. It establishes a consent-centred model in which a Data Fiduciary may process digital personal data only for a lawful purpose, either with the data principal's consent or for a defined set of legitimate uses.
Its structure is deliberately lighter than GDPR — there is no separate legal basis for legitimate interest, no statutory DPIA requirement for every processor, and no data localisation mandate for most sectors. But it is materially stricter in two respects: consent notices must be granular and available in the Eighth Schedule languages, and the penalty ceiling of ₹250 crore per instance of failure to prevent a breach is among the highest globally.
The DPDP Rules, notified in stages, give operational shape to consent management, breach notification, children's data verification and the Significant Data Fiduciary obligations. Organisations that treat DPDPA as a lighter GDPR consistently underestimate the engineering work in consent granularity, verifiable parental consent, and the erasure obligation that follows withdrawal.
Who it applies to
Penalties
Up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach; up to ₹200 crore for failure to notify a breach or to meet obligations relating to children's data; up to ₹50 crore for other breaches of the Act. Penalties are per instance of non-compliance.
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
Up to ₹250 crore for failing to take reasonable security safeguards, assessed per instance of non-compliance rather than per organisation. For a business processing personal data at consumer scale, the exposure is material enough to belong in the enterprise risk register rather than the compliance log.
The Act applies extraterritorially to any organisation processing digital personal data in connection with offering goods or services to data principals in India. Overseas incorporation is not a shield, and most consumer-facing and B2B SaaS businesses serving Indian customers are caught.
Consent granularity, Eighth Schedule language delivery, verifiable parental consent under 18 and erasure that reaches backups are all product requirements, not policy statements. Organisations that treat DPDPA as a documentation exercise consistently discover this six weeks before their deadline.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: The boundary that matters in practice is the fiduciary-versus-processor determination, made per processing activity rather than per organisation. Most groups are a fiduciary for some activities and a processor for others, and getting that wrong misallocates every downstream obligation.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
Clear, itemised notice before or at the time of consent, in English or any Eighth Schedule language at the principal's option, describing the personal data collected and the purpose. Consent must be free, specific, informed, unconditional, unambiguous and as easy to withdraw as to give.
Processing is limited to the purpose for which consent was given. Personal data must be erased once the purpose is served or consent is withdrawn, unless retention is required by law.
Rights to access a summary of processing, correction and completion, erasure, grievance redressal, and nomination of another individual to exercise rights in the event of death or incapacity.
Verifiable parental consent for anyone under 18, and consent from the lawful guardian of a person with disability. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
Reasonable security safeguards to prevent personal data breaches, with notification to the Data Protection Board and to each affected data principal in the form and manner prescribed.
Designated fiduciaries must appoint an India-based Data Protection Officer accountable to the board, appoint an independent data auditor, and conduct periodic Data Protection Impact Assessments and audits.
The areas your teams will actually be building in, with control counts where the framework defines them.
Notice generation, granular consent capture, multilingual delivery, versioning, withdrawal handling and downstream propagation.
Complete record of digital personal data, its purpose, retention basis and the systems and processors that touch it.
Intake, verification, fulfilment and audit trail for access, correction, erasure, nomination and grievance requests.
Valid contracts with every processor, flow-down of obligations, and assurance that processors delete on instruction.
Technical and organisational measures proportionate to risk, including encryption, access control, logging and backup integrity.
Detection, assessment, Board notification and data principal communication within prescribed timelines.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–4
Inventory digital personal data across applications, integrations, analytics, vendors, logs and backups. Determine fiduciary or processor role for every processing activity, including intra-group flows.
Weeks 4–6
Gap analysis covering notice, consent, rights, children's data, processor governance, security safeguards and breach response, scored by likelihood and business impact.
Weeks 6–10
Specify the consent data model, event schema, multilingual notice delivery and rights fulfilment workflow tightly enough for engineering to build from.
Weeks 10–20
Implement consent propagation, rights workflows, retention enforcement and breach detection alongside your teams, with evidence generation wired in as controls go live.
Week 20 onward
Propagation testing, rights SLA validation, breach rehearsal against the notification clock, and the quarterly assurance rhythm that keeps the position current.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
Enacted August 2023. Obligations commence in phases as the DPDP Rules are notified, with transition periods for specific duties. Organisations should be operationally ready rather than waiting for a final commencement date.
Discovery and gap assessment
Weeks 1–6
Establishes what you hold and where you stand. Produces a defensible baseline and an effort-sized remediation backlog.
Architecture and design
Weeks 6–10
Consent, rights and retention specified for build. This is where engineering effort is determined.
Implementation
Weeks 10–20
The variable phase. Length depends almost entirely on how much consent and retention change your systems require.
Validation and handover
Weeks 20–24
Propagation testing, rights SLA proof, breach rehearsal and board reporting established.
The sequence we follow, and the parts where first-time implementations most often lose time.
Establish the complete digital personal data inventory across systems, vendors and analytics.
Determine fiduciary and processor roles for every processing activity, including group entities.
Design and build the consent architecture — granular, multilingual, versioned and withdrawable.
Instrument data principal rights with SLA tracking against statutory response windows.
Implement retention and erasure logic that genuinely deletes, including in backups and analytics.
Prepare Significant Data Fiduciary artefacts — DPO appointment, DPIA methodology, audit readiness.
Turn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityA named, qualified DPO — accountable, available and independent.
Statutory Data Protection Officer capability delivered as a service: named point of contact, regulator liaison, DPIA sign-off and board reporting, without a full-time hire.
Explore capabilityCertification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityNot a table of statutory contrasts. The seven places where the two regimes diverge enough to change your data model, your consent screens and your engineering backlog.
The designation is discretionary, so the useful question is not whether you are one but what it would cost to be treated as one. Three additional duties, and why we tell large consumer platforms to assume it.
The Act set the principles. The Rules set the engineering requirements. Here is what changes in your systems — notice structure, breach clocks, and verifiable parental consent.
Sequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question
