The DPDP Act and Rules, in plain English
What the law asks, when, and how to get ready.
A short summary to help you plan, not legal advice. Read the Act and Rules as published in the Gazette, and consult your legal team.
Who it applies to
Key terms
Data Principal
The person the data is about
Data Fiduciary
Decides why and how data is used
Data Processor
Processes for a Fiduciary
Significant Data Fiduciary
Notified by Government, extra duties
Key duties
What the law asks
Lawful basis
Consent or a listed legitimate use (S. 4, 6, 7)
Notice
Itemised, in 23 languages on request (S. 5, Rule 3)
Security & erasure
Safeguards and timely erasure (S. 8)
Rights
Access, correction, erasure, nomination (S. 11-14)
Breach
Board and people told; report in 72 hours; CERT-In in 6 hours
Children
Verifiable guardian consent under 18 (S. 9)
Penalties
Maximum penalties
| Breach of | Maximum |
|---|---|
| Security safeguards | ₹250 crore |
| Breach notification | ₹200 crore |
| Children's data duties | ₹200 crore |
| Significant Data Fiduciary duties | ₹150 crore |
| Other provisions | ₹50 crore |
| Duties of a Data Principal | ₹10,000 |
Timeline
When it applies
| When | What applies |
|---|---|
| November 2025 | Rules notified; Board provisions |
| November 2026 | Consent Manager registration |
| May 2027 | Most Data Fiduciary duties |
Get ready
Readiness checklist
- List purposes and data
- Find where data sits
- Choose the lawful basis
- Rewrite notices
- Capture consent per purpose
- Sync withdrawals
- Set up rights and grievances
- Plan for 6 and 72 hours
- Set retention periods
- Add guardian consent
- Review transfers and processors
- Train teams, keep evidence