Corporate practice

Data Protection & Privacy

The Digital Personal Data Protection Act, 2023 is coming into force in stages. Its core duties apply from 13 May 2027, and preparing for them takes most organisations the better part of a year.

DPDP Act readiness, privacy notices and consent, breach response, processor contracts, cross-border transfers and CERT-In compliance.

Where the law stands

13 November 2025: the DPDP Rules, 2025 were notified. The provisions setting up the Data Protection Board took effect immediately.
13 November 2026: the registration and duties of Consent Managers take effect.
13 May 2027: the substantive obligations take effect: notice and consent, security safeguards, breach intimation, Data Principal rights, children’s data, erasure and the duties of Significant Data Fiduciaries.

Until then, section 43A of the IT Act and the SPDI Rules, 2011 continue to apply, as do the CERT-In Directions of 2022, which require cyber incidents to be reported within six hours and logs to be kept for 180 days. For the detail, see The DPDP Rules, 2025: what applies when.

What the Act will require

A clear, standalone notice and free, specific, informed and unambiguous consent, or a “legitimate use” under section 7.
Reasonable security safeguards, and contracts with every processor.
Notice of a personal data breach to the Data Protection Board and to each affected person, with a detailed report to the Board within 72 hours.
Erasure once the purpose is served, and a working grievance process.
Verifiable parental consent before processing the data of anyone under 18.
For Significant Data Fiduciaries: a Data Protection Officer based in India, independent audits and annual impact assessments.

Penalties run to ₹250 crore for failing to take reasonable security safeguards, and to ₹200 crore for failing to notify a breach or for breaching the obligations on children’s data.

How we help

DPDP readiness assessments and gap analysis
Data mapping and retention schedules
Privacy notices, consent flows and policies
Processor and data-sharing agreements
Breach response plans and incident reporting
Children’s data and age assurance
Cross-border transfer analysis
Representation before the Data Protection Board

Key laws

Digital Personal Data Protection Act, 2023
Digital Personal Data Protection Rules, 2025
Information Technology Act, 2000 (section 43A)
SPDI Rules, 2011
CERT-In Directions, 2022

Frequently asked questions

When does the DPDP Act come into force?

In stages. The DPDP Rules, 2025 were notified on 13 November 2025, when the provisions establishing the Data Protection Board took effect. Consent Manager registration follows on 13 November 2026. The substantive obligations on businesses, including notice, consent, security, breach intimation, Data Principal rights and children’s data, apply from 13 May 2027.

Does the DPDP Act apply to companies outside India?

Yes, if they process digital personal data outside India in connection with offering goods or services to people in India (section 3). A foreign SaaS provider, app or e-commerce business with Indian users is likely to be covered.

What are the penalties under the DPDP Act?

Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach; up to ₹200 crore for failing to notify a breach, or for breaching the additional obligations relating to children; up to ₹150 crore for a Significant Data Fiduciary’s breach of its additional obligations; and up to ₹50 crore for other breaches. The Data Protection Board decides the amount, considering factors such as the nature, gravity and duration of the breach.