DPDP Act
Digital Personal Data Protection Act, 2023
The DPDP Act is India's first comprehensive law governing the processing of digital personal data, enacted on 11 August 2023. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)) with a phased start: the Data Protection Board provisions applied at once, Consent Manager registration follows after 12 months, and most substantive obligations on Data Fiduciaries apply after 18 months, in May 2027. It establishes consent as the primary basis for processing and creates the Data Protection Board of India as enforcer.
Who it applies to
Data Fiduciaries handling digital personal data within India, and processing outside India that is connected to offering goods or services to individuals in India.
Identity requirements
- Obtain free, specific, informed and unambiguous consent before processing personal data, supported by a clear itemized notice
- Provide consent withdrawal that is as easy as giving consent, and honor rights to access, correction and erasure
- Use Consent Managers (a registered intermediary role under the Rules) to record and manage consent where applicable
- Verify parental consent before processing the personal data of children under 18, and avoid targeted advertising directed at children
- Apply enhanced obligations for Significant Data Fiduciaries, including a Data Protection Officer and periodic Data Protection Impact Assessments
- Implement reasonable security safeguards and notify the Board and affected individuals of breaches
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Consent is the core lawful basis, requiring granular notice, easy withdrawal and Consent Manager integration in user-facing identity flows. |
| Identity verification (KYC/proofing) | Verifiable parental consent for users under 18 forces age assurance and identity proofing in onboarding. |
| Breach notification | Data Fiduciaries must notify the Data Protection Board and affected data principals of personal data breaches. |
| Data residency & cross-border transfer | Cross-border transfers are permitted except to countries the central government may restrict, so transfer destinations must be governed. |
| Audit, logging & accountability | Significant Data Fiduciaries must appoint a DPO, run impact assessments and maintain accountability records. |
Upcoming deadlines
Penalties
The Schedule to the Act sets penalties the Data Protection Board can impose after an inquiry, the highest being up to 250 crore rupees (2.5 billion rupees) for failing to take reasonable security safeguards to prevent a personal data breach.
Status and dates last verified against primary sources on 2026-10-31.
DPDP Act: frequently asked questions
- Is the DPDP Act in force yet?
- Partly. The Rules notified on 13 November 2025 brought the Data Protection Board provisions into force immediately, Consent Manager provisions after 12 months (November 2026) and most compliance obligations, including notice, consent, security safeguards and breach notification, after 18 months (May 2027). A proposal to shorten the 18-month window had not been notified as of October 2026.
- Who enforces the DPDP Act?
- The Data Protection Board of India investigates breaches, hears complaints and imposes penalties, while individuals can file and track complaints through a dedicated portal.
- Does the DPDP Act apply to companies outside India?
- Yes. It applies to processing of digital personal data outside India when that processing is connected to offering goods or services to individuals within India.