Guides & Frameworks
DPDP Act Compliance: A Practical Guide to India's Data Protection Law
India's Digital Personal Data Protection Act, 2023 (DPDP Act), with its Rules notified in 2025, establishes a modern privacy regime with real obligations and significant penalties - up to ₹250 crore for severe non-compliance. If you process the personal data of individuals in India, this guide explains what you must do.
Who the DPDP Act applies to
The Act applies to the processing of digital personal data of individuals (data principals) in India, whether collected digitally or later digitized. It reaches organizations of all sizes - a 'data fiduciary' is anyone who determines the purpose and means of processing.
A subset of organizations, designated Significant Data Fiduciaries (SDFs) based on volume and sensitivity of data and risk, carry heavier obligations.
Core obligations
- Obtain clear, informed, specific consent - with an easy way to withdraw it
- Provide a plain-language notice describing what data is collected and why
- Honor data-principal rights: access, correction, erasure and grievance redressal
- Notify the Data Protection Board and affected principals of personal-data breaches
- Process only for the stated purpose; delete when no longer needed
- Put in place reasonable security safeguards
Significant Data Fiduciary (SDF) duties
- Appoint a Data Protection Officer (DPO) based in India
- Conduct Data Protection Impact Assessments (DPIAs)
- Undergo periodic independent data-protection audits
- Meet additional obligations the government may specify
Building a DPDP-compliant program
- Map personal data: what you collect, where it flows, who processes it
- Establish lawful basis and rebuild consent flows to the DPDP standard
- Implement data-principal rights and grievance workflows
- Stand up a breach-response process aligned to notification duties
- If you're an SDF: appoint a DPO, run DPIAs, and schedule independent audits
Need help with this in practice?
A5 Cyber Nexus audits, remediates and certifies against these frameworks.
Frequently asked questions
What are the penalties under the DPDP Act?
Penalties are significant and graded by the nature of the breach - up to ₹250 crore for failure to take reasonable security safeguards that leads to a breach. The Data Protection Board adjudicates.
How do I know if I'm a Significant Data Fiduciary?
The government designates SDFs based on factors like the volume and sensitivity of personal data processed and risk to data principals. We help you assess your likely status and stand up the extra obligations if you qualify.
Make it accessible.
Make it attack-ready.
Prove both before launch.
Bring us your app, audit deadline, or security concern. We'll map the fastest path to WCAG conformance, VAPT coverage, and regulator-ready evidence.
