What is the DPDP Act and how does it affect my business in India?
Key takeaways
- The DPDP Act, 2023 received presidential assent on 11 August 2023 and applies to digital personal data processed in India or outside it, where the offering relates to individuals in India.
- The DPDP Rules were notified in the Gazette in mid-November 2025: Rules 1, 2 and 17 to 21 apply immediately, Rule 4 at 12 months, and Rules 3, 5 to 16 and 22 to 23 at 18 months, which is May 2027.
- Rule 7 requires a forthwith intimation to the Data Protection Board, full details within 72 hours, and a notice to every affected data principal.
- Penalties under the Schedule to the Act reach up to Rs 250 crore per instance for failure to take reasonable security safeguards, and up to Rs 200 crore for a notification failure.
- A field survey found 83% of Indian organisations are not yet fully compliant, and CERT-In's 6-hour reporting duty already runs in parallel under Directions 20(3)/2022-CERT-In.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the DPDP Act actually require of a business?
Eight obligations, and they are the ordinary operating rules of any data-handling business. Lawful processing for a legitimate purpose, with consent as the default route. A clear, plain-language privacy notice at the point of collection. Purpose limitation, meaning data collected for one purpose is not repurposed. Data minimisation, collecting only what the purpose needs. Security safeguards appropriate to the sensitivity of the data, and a record of processing activities. Breach notification, which under Rule 7 of the DPDP Rules 2025 means a forthwith intimation to the Board, details within 72 hours, and a notice to each affected person. And data principal rights, including access, correction, erasure and nomination, plus a grievance redressal mechanism. The two that catch companies out are purpose limitation and erasure, because both touch systems that were never built to support them.
When do the DPDP Rules 2025 start applying?
The Rules were notified in the Gazette in mid-November 2025, and the commencement is staggered, which is why a 2026 audit still finds most businesses unprepared. Rules 1, 2 and 17 to 21 apply immediately, which includes the definitions, the consent manager registration and the Board and Data Protection Officer provisions. Rule 4, the obligation of a Data Protection Officer, applies at 12 months. The bulk of the substantive rules, including Rule 7 on personal data breach intimation, apply at 18 months, which is May 2027. That gives a business roughly eight months from now to close the gap, and a field survey finding 83% of organisations not fully compliant is a reasonable place to start.
What does a personal data breach require you to do under Rule 7?
Three obligations, on three clocks. A forthwith intimation to the Data Protection Board as soon as the breach is noticed, without waiting for the full picture. Full details within 72 hours, which means the 72 hours is not an excuse to delay your first notification, it is a deadline for completing the notification. And a notice to each affected data principal stating the nature of the breach, when it happened, the extent of it, the likely consequences, the mitigation taken, the safety steps the principal should take, and a DPO contact point. There appears to be no materiality threshold, which means the definition of breach in the Act carries the weight, and a near miss that touches personal data is worth assessing rather than dismissing.
What does the DPDP Act mean for a small Indian business?
Less paperwork than most people fear, and more engineering than they expect. A small firm that sells on a website, runs a payroll, or holds customer records in a CRM is a data fiduciary and the obligations apply in full; there is no small-business exemption in the Act. What is proportionate is the approach. A one-page privacy notice that says what you collect and why, a written consent mechanism that actually records the consent, a list of where the data lives including the WhatsApp Business account and the payment processor, a retention schedule with real deletion dates, a lockout and MFA on every system that holds personal data, and a named grievance contact. Those seven artefacts, at an indicative Rs 40,000 to Rs 1,50,000 of consulting and implementation work, close most of the gap that an assessor looks for.
| Obligation | Practical meaning | Typical cost to close |
|---|---|---|
| Consent and lawful processing | Consent recorded and provable, purpose stated for each dataset | Rs 15,000 - 40,000 |
| Privacy notice | One plain-language notice at the point of collection | Rs 8,000 - 20,000 |
| Security safeguards | MFA, encryption at rest, access control on every store of personal data | Rs 25,000 - 1,20,000 |
| Data principal rights and erasure | Access, correction, erasure and nomination working end to end | Rs 20,000 - 60,000 |
| Breach response under Rule 7 | Runbook with a Board intimation template and a 72-hour tracker | Rs 12,000 - 35,000 |
What are the frequently asked questions?
Get a straight answer on this
Send us the systems that hold customer personal data, and we will return a DPDP gap assessment with a prioritised closure plan and cost.
Send us the details See pricing