Home / Guides
The DPDP Act, explained by the people who implement it.
Plain-English guides to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Each one starts with the short answer, cites the section or Rule, and ends with what to build.
The DPDP Rules, phased in over 18 months– of the window used · – days left
Today
13 Nov 2025Rules notified
Data Protection Board established; Rules 1, 2 and 17 to 21 in force. Members are yet to be appointed.
13 Nov 2026Consent managers
Rule 4 applies: the framework for registering consent managers with the Board is in force.
13 May 2027Core obligations
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
Foundations
4 guidesWhat is the DPDP ActDPDP Act 2023 explained: who it applies to, consent and legitimate uses, every obligation, rights, the Board and penalties up to ₹250 crore from 13 May 2027.Read guide →Enforcement dateDPDP Act enforcement date explained: which sections and Rules started on 13 Nov 2025 and 13 Nov 2026, what starts 13 May 2027, and the status of the Board.Read guide →DPDP Rules 2025DPDP Rules 2025 (G.S.R. 846(E)) summarised: all 23 Rules and seven Schedules, the date each applies from, and what changed from the January 2025 draft.Read guide →DPDP vs GDPRDPDP vs GDPR compared: scope, lawful bases, children, breach reporting, DPOs, transfers and penalties, plus how to reuse a GDPR programme for India.Read guide →
Plan your programme
3 guidesDPDP compliance checklistDPDP compliance checklist: every Act section and Rule mapped to what to build, the owning team and the evidence to keep, plus how to run a gap assessment.Read guide →Implementation roadmapA DPDP implementation roadmap for the 26 weeks to 13 May 2027: five phases, ten workstreams, a RACI table, the key dependencies and the traps that cause delay.Read guide →DPDP penaltiesDPDP Act penalties explained: Schedule amounts up to ₹250 crore, the section 33 factors, how the Board decides, appeals to TDSAT, and how to reduce exposure.Read guide →
Roles and governance
3 guidesFiduciary vs processorData fiduciary vs data processor under India's DPDP Act: meanings, examples for SaaS, payroll, cloud and payments, section 8(1) accountability and contracts.Read guide →Significant Data FiduciarySignificant data fiduciary under the DPDP Act: section 10(1) criteria, DPO, independent data auditor, yearly DPIA and data audit (Rule 13), and how to prepare.Read guide →Consent managersConsent manager under DPDP: Rule 4 registration from 13 Nov 2026, First Schedule conditions and duties, how fiduciaries integrate, and consent manager vs CMP.Read guide →
Core obligations
8 guidesPrivacy noticeDPDP privacy notice guide: section 5 and Rule 3 contents, Eighth Schedule languages, notices for existing users, cookie banners and a template outline.Read guide →Consent and legitimate usesDPDP consent explained: the section 6 tests, all nine section 7 legitimate uses with examples, withdrawal, burden of proof and how to design consent records.Read guide →Security safeguardsDPDP security safeguards under Rule 6: each control, how to implement and evidence it, one-year log retention, processor contracts and the ₹250 crore penalty.Read guide →Breach notificationDPDP breach notification under Rule 7: what counts as a breach, notices to the Board and each person, the 72-hour report, CERT-In and the ₹200 crore penalty.Read guide →Data principal rightsDPDP data principal rights: access, correction, erasure, grievances and nomination, what Rule 14 makes you publish, the 90-day grievance cap and a workflow.Read guide →Children's dataDPDP children data rules: who counts as a child, verifiable parental consent under Rule 10, Fourth Schedule exemptions for schools, and the ₹200 crore penalty.Read guide →Data retentionDPDP data retention: section 8(7) erasure, the Third Schedule 3-year rule, the 48-hour notice, the 1-year log minimum and a retention schedule template.Read guide →Cross-border transfersDPDP cross border data transfer under section 16: the negative list, Rule 15 orders, SDF localisation, sectoral rules like RBI's and offshore vendor contracts.Read guide →
By industry
2 guidesDPDP for SaaSDPDP for SaaS: when you are a fiduciary or processor, DPA clauses, sub-processor registers, tenant controls, breach notice and what enterprise buyers ask.Read guide →DPDP for fintechDPDP Act for fintech, NBFCs and banks: how it works with RBI rules, KYC retention, the loan-defaulter exemption, Account Aggregators and breach response.Read guide →