What Is the DPDP Act 2023? Rules, Penalties, Compliance and Business Guide

India’s Digital Personal Data Protection (DPDP) Act, 2023, privacy act India establishes a legal framework for processing digital personal data while recognizing individuals’ rights over their information. It affects how businesses collect, use, store, share, and protect personal data through websites, mobile applications, online services, and other digital platforms.

The Digital Personal Data Protection Rules, 2025, provide further details on implementing the Act. Because the law follows a phased commencement schedule, businesses need to understand both their applicable obligations and the provisions scheduled to take effect later.

For companies operating in India, including e-commerce platforms, fintech businesses, healthcare providers, educational institutions, SaaS companies, and mobile app developers, preparing for DPDP compliance involves more than publishing a privacy policy. It requires reviewing data collection, consent, security, retention, vendor relationships, and user-request procedures.

This guide explains what the DPDP Act covers, who needs to prepare for it, the maximum penalties, the implementation timeline, and the practical steps businesses can take.

What Is the DPDP Information technology Law in India 2023?

The Digital Personal Data Protection Act, 2023, is an information technology law in India governing the processing of digital personal data. It received Presidential assent on 11 August 2023.

The Act establishes responsibilities for organizations that determine why and how personal data is processed. It also provides rights and protections for individuals whose data is processed.

For example, when a customer creates an account on a shopping website, the business may collect their name, phone number, email address, delivery address, and order history. The business needs to assess why it collects each category of information, identify the applicable legal basis, explain its practices, and protect the data according to applicable requirements.

The DPDP Act is relevant to personal data collected directly in digital form and personal data collected offline and subsequently digitized, subject to the Act’s scope and exemptions.

What Is the Main Purpose of the DPDP Act?

The main purpose of the DPDP Act is to establish rules for lawful personal data processing while protecting individuals’ rights.

Its key objectives include:

• Giving individuals greater visibility into how their personal data is processed.
• Establishing responsibilities for organizations processing personal data.
• Setting requirements for consent and other permitted grounds for processing.
• Providing mechanisms for individuals to exercise applicable rights.
• Requiring reasonable security safeguards and prescribed breach notifications.
• Establishing penalties for specified violations.

The Act is not a blanket prohibition on collecting personal information. Businesses can process personal data for permitted purposes when they meet the applicable legal requirements.

What Are the DPDP Rules 2025?

The Digital Personal Data Protection Rules, 2025, provide operational details for implementing the DPDP Act. They address matters such as notices, consent mechanisms, security safeguards, personal data breach notifications, children’s data, and the exercise of individual rights.

The Rules were notified in November 2025 and introduced a phased commencement schedule. This means that businesses should not assume that every requirement became effective immediately upon notification.

Organizations should review the official Rules and commencement notifications to determine which provisions apply at a given time.

DPDP Act and DPDP Rules: What Is the Difference?

Both are important. Reading the Act without considering the Rules and commencement notifications may leave businesses with an incomplete understanding of their obligations.

DPDP Act Compliance Deadline: Key Dates Businesses Should Know

The Digital Personal Data Protection (DPDP) Act, 2023, follows a phased implementation schedule under the DPDP Rules, 2025. Different provisions take effect at different times, so businesses should identify the deadlines that apply to their data processing activities.

Who Needs to Comply With the DPDP Act?

The DPDP Act can apply to organizations that process digital personal data in India, subject to the Act’s scope and exemptions. It can also apply to processing outside India when the processing is connected with offering goods or services to individuals in India.

The organization responsible for determining the purpose and means of processing personal data is generally referred to as the Data Fiduciary.

Depending on their activities, the following organizations may need to assess their obligations:

1. IT and Software Development Companies

Software companies may process personal data through websites, SaaS products, customer portals, employee systems, and mobile applications.

They should identify which data they collect, which processing activities they control, and which activities they perform on behalf of clients. Their contractual responsibilities may differ depending on their role.

2. E-Commerce and Online Marketplaces

E-commerce businesses commonly process names, addresses, phone numbers, order histories, payment-related information, and customer support records.

They should review their privacy notices, data-sharing arrangements, retention practices, security measures, and procedures for responding to applicable user requests.

3. Banking, Fintech, and Financial Services

Financial services may process identity details, transaction information, contact details, and other personal data.

Organizations in this sector should assess DPDP requirements alongside any other applicable financial-sector, cybersecurity, and record-retention rules. DPDP compliance does not automatically replace those separate obligations.

4. Healthcare and Medical Technology

Hospitals, clinics, telemedicine platforms, and health applications may handle patient details, appointment information, medical records, and other sensitive information.

They should evaluate access controls, data-sharing practices, storage arrangements, and retention requirements. Other healthcare and professional obligations may also apply.

5. Education and E-Learning Platforms

Schools, colleges, coaching platforms, and online learning services may process student details, attendance records, performance data, and information about children.

These organizations should pay particular attention to children’s data where applicable, along with parental consent requirements and any relevant exemptions or sector-specific obligations.

6. Social Media and Digital Platforms

Social networks, community platforms, and content applications may process account details, messages, profile information, device identifiers, and usage information.

They should assess what personal data is necessary for each purpose, how it is shared, and which user controls and security safeguards are required.

7. Dating App Businesses

Dating applications may process profile photographs, age information, location details, preferences, messages, and verification records.

A dating app development company should review its data practices at each stage, including account creation, profile matching, messaging, verification, subscriptions, and account deletion.

For example, if an app collects location information to recommend nearby profiles, it should assess whether that collection is necessary for the stated purpose and whether its notices, consent mechanisms, and technical controls meet the applicable requirements.

8. International Businesses Serving Indian Users

A company located outside India may also need to assess the Act if its processing falls within the provisions concerning offering goods or services to individuals in India.

The applicability depends on the actual activities and legal scope, not simply on where the company’s headquarters are located.

Key Requirements Under the DPDP Act 2023

The exact obligations depend on the relevant provisions, their commencement dates, and the organization’s role. The following areas are important for compliance planning.

1. Provide Clear Privacy Notices

Organizations should explain what personal data they process and why they process it, using clear and accessible language.

Where the Act and Rules require a notice, it must include the prescribed information. Businesses should avoid vague explanations that do not help users understand the relevant processing activities.

For example, instead of saying only that data is collected to improve services, a company should explain the specific purposes for which it uses account details, location information, or usage data.

2. Obtain Valid Consent Where Required

Consent is one of the grounds for processing personal data under the Act. Where consent is required, it should meet the applicable legal conditions and be supported by an appropriate process for recording and managing it.

Businesses should also identify where the Act permits processing for certain legitimate uses without consent, rather than assuming consent is mandatory for every activity.

A privacy notice alone does not automatically establish valid consent.

3. Protect Personal Data

Organizations must assess the security safeguards required under applicable provisions.

Practical measures may include:

• Restricting access according to job responsibilities.
• Encrypting personal data where appropriate.
• Monitoring access to sensitive systems.
• Reviewing security configurations and vulnerabilities.
• Maintaining incident-response procedures.
• Evaluating the security practices of relevant vendors.

The appropriate safeguards depend on the nature of the processing, the risks, and applicable legal requirements.

4. Prepare for Personal Data Breaches

Businesses should establish a process to identify, investigate, contain, and document personal data breaches.

They should also determine how to make notifications to the Data Protection Board of India and affected individuals when required by the applicable provisions and Rules.

A response plan should identify responsible personnel, escalation procedures, communication channels, and evidence-preservation practices.

5. Support Applicable Individual Rights

The Act provides individuals with rights that include access to information about their personal data, correction, completion and updating, erasure in applicable circumstances, grievance redressal, and nomination, subject to the relevant provisions and conditions.

Businesses should create a process for receiving and responding to requests within the applicable requirements.

They should also explain how users can raise grievances and how those grievances will be handled.

6. Review Data Retention and Erasure

Keeping personal data indefinitely can create unnecessary operational and security risks.

Organizations should define retention periods based on the purpose of processing, applicable legal requirements, and relevant exceptions. They should also determine when data can be erased and how erasure requests should be handled.

7. Review Third-Party Data Sharing

A business may use cloud hosting providers, analytics tools, payment services, customer support software, or marketing platforms.

It should identify which providers receive personal data, understand their role, and review the contractual and security arrangements that apply.

Using a third-party provider does not automatically remove the organization’s own responsibilities under applicable law.

8. Assess Whether Additional Obligations Apply

Some organizations may be notified as Significant Data Fiduciaries and become subject to additional obligations, such as specified assessments, audits, or other requirements.

Businesses should not assume that every organization has the same obligations. Their size, processing activities, and any applicable government notification can affect the requirements they need to meet.

How Can Businesses Prepare for DPDP Compliance in 2026?

Businesses can start with a structured review of their current data practices instead of waiting until every provision has commenced.

Step 1: Map Personal Data

Identify the personal data collected through websites, mobile applications, customer forms, employee systems, and third-party integrations.

Record the purpose of collection, storage location, access permissions, sharing arrangements, and retention practices.

Step 2: Review Data Collection

For each data field, ask whether it is necessary for a defined purpose.

For example, an application should assess whether it needs precise location data, whether an approximate location would be sufficient, and how the information is used.

Step 3: Review Privacy Notices and Consent

Check whether the notices accurately explain the processing activities. Review consent flows wherever consent is required, including how users can withdraw consent.

Step 4: Improve Security Controls

Assess access permissions, storage systems, authentication, backups, monitoring, and incident-response procedures. Address weaknesses based on risk and applicable requirements.

Step 5: Create User Request Procedures

Define how the organization will receive, verify, track, and respond to requests concerning personal data and grievances.

Step 6: Review Vendors and Contracts

List third-party providers that process personal data. Check contractual responsibilities, access controls, security measures, and arrangements for incidents or termination of services.

Step 7: Prepare for Breach Response

Create a documented process for identifying incidents, assessing their impact, escalating them internally, and making required notifications.

Step 8: Check Applicable Deadlines

Compare current practices with the provisions that are already in force and those scheduled to commence later. Keep records of decisions and planned corrective actions.

Step 9: Train Relevant Teams

Ensure that product, engineering, marketing, customer support, security, and legal teams understand their responsibilities.

Step 10: Review Compliance Regularly

Data practices change when a business launches features, enters new markets, integrates new vendors, or changes its technology stack. Schedule periodic reviews and update documentation when necessary.

This checklist is a practical starting point, not a guarantee of legal compliance. Businesses should seek qualified legal advice for questions about their specific obligations.

What Are the Penalties Under the DPDP Act 2023?

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) is being implemented in phases. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 under Gazette Notification G.S.R. 846(E). The main compliance requirements are scheduled to take effect on 13 May 2027.

The Act provides for significant financial penalties for specific violations. The maximum penalty can reach ₹250 crore, but this is not an automatic fine for every violation. The actual penalty depends on the type of violation and the applicable legal process.

These amounts reflect the penalty framework in the Act. Businesses should consult the statutory Schedule and applicable Rules before relying on a particular penalty figure.

Why Should Businesses Take These Penalties Seriously?

A data protection failure can create costs beyond a financial penalty. It may lead to incident-response expenses, operational disruption, customer concerns, contractual disputes, and reputational harm.

Organizations should therefore approach compliance as part of their risk-management process rather than treating it as a document-writing exercise.

What Are the Benefits of DPDP Compliance?

Preparing for the DPDP Act can help businesses improve how they manage personal data.

Greater Transparency

Clear notices help users understand why their data is collected and how it is used.

Better Data Management

Mapping data and reviewing retention practices can help organizations identify unnecessary collection, duplicate records, and poorly controlled access.

Stronger Security Practices

Reviewing safeguards and incident-response procedures can help businesses identify weaknesses before they become more serious problems.

Better Customer Confidence

People may be more comfortable using a service when its privacy practices are understandable and its data-handling processes are responsible. Compliance alone, however, does not guarantee customer trust.

More Structured Vendor Management

Reviewing third-party access and contractual responsibilities helps businesses understand where their data goes and how providers handle it.

Improved Compliance Planning

Tracking implementation dates and applicable requirements helps organizations prioritize work and allocate resources more effectively.

Conclusion

The DPDP Act, 2023, and the DPDP Rules, 2025, establish an important framework for protecting digital personal data in India. Businesses should understand the law’s scope, identify the provisions applicable to their activities, and prepare for requirements according to the official commencement schedule.

Practical preparation includes mapping personal data, reviewing notices and consent processes, strengthening security, managing vendor relationships, and creating procedures for user requests and data breaches.

The most effective approach is to treat data protection as an ongoing part of business operations and product development. Regular reviews can help organizations identify gaps, prepare for upcoming requirements, and manage personal data more responsibly.

FAQ’s