Home / Guides
The DPDP Act, explained by the people who implement it.
Plain-English guides to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Each one starts with the short answer, cites the section or Rule, and ends with what to build.
How the DPDP Rules phase in over 18 months– of the window used · – days left
Today
13 Nov 2025Rules notified
The Data Protection Board is established and Rules 1, 2 and 17 to 21 apply. Its members are yet to be appointed.
13 Nov 2026Consent managers
Rule 4 applies: consent managers can register with the Board and start carrying people's consents to businesses.
13 May 2027Core obligations
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
Foundations
5 guidesDPDP status trackerCurrent status of the DPDP Act and Rules: Board appointments, consent managers, SDFs, deadline changes and court cases. Updated regularly.Read guide →What is the DPDP ActDPDP Act 2023 explained: who it applies to, consent and legitimate uses, every obligation, rights, the Board and penalties up to ₹250 crore from 13 May 2027.Read guide →Enforcement dateDPDP Act enforcement date explained: which sections and Rules started on 13 Nov 2025 and 13 Nov 2026, what starts 13 May 2027, and the status of the Board.Read guide →DPDP Rules 2025DPDP Rules 2025 (G.S.R. 846(E)) summarised: all 23 Rules and seven Schedules, the date each applies from, and what changed from the January 2025 draft.Read guide →DPDP vs GDPRDPDP vs GDPR compared: scope, lawful bases, children, breach reporting, DPOs, transfers and penalties, plus how to reuse a GDPR programme for India.Read guide →
Plan your programme
6 guidesDPDP consultantWhat a DPDP compliance consultant does, when you need one, the questions to ask before you hire, and how an implementation-led engagement runs.Read guide →DPDP compliance checklistDPDP compliance checklist: every Act section and Rule mapped to what to build, the owning team and the evidence to keep, plus how to run a gap assessment.Read guide →Implementation roadmapA DPDP implementation roadmap to 13 May 2027: five phases, ten workstreams, a RACI table, the key dependencies and the traps that cause delay.Read guide →DPDP compliance costWhat DPDP compliance costs depend on: systems, products, roles and sensitive data. One-time vs ongoing costs, typical timelines, and a free scope estimator.Read guide →DPDP penaltiesDPDP Act penalties explained: Schedule amounts up to ₹250 crore, the section 33 factors, how the Board decides, appeals to TDSAT, and how to reduce exposure.Read guide →Consultant vs software vs law firmWho does what in DPDP compliance: law firms for opinions, software for consent and requests at scale, implementation partners for the build.Read guide →
Roles and governance
3 guidesFiduciary vs processorData fiduciary vs data processor under India's DPDP Act: meanings, examples for SaaS, payroll, cloud and payments, section 8(1) accountability and contracts.Read guide →Significant Data FiduciarySignificant data fiduciary under the DPDP Act: section 10(1) criteria, DPO, independent data auditor, yearly DPIA and data audit (Rule 13), and how to prepare.Read guide →Consent managersConsent manager under DPDP: Rule 4 registration from 13 Nov 2026, First Schedule conditions and duties, how fiduciaries integrate, and consent manager vs CMP.Read guide →
Core obligations
8 guidesPrivacy noticeDPDP privacy notice guide: section 5 and Rule 3 contents, Eighth Schedule languages, notices for existing users, cookie banners and a template outline.Read guide →Consent and legitimate usesDPDP consent explained: the section 6 tests, all nine section 7 legitimate uses with examples, withdrawal, burden of proof and how to design consent records.Read guide →Security safeguardsDPDP security safeguards under Rule 6: each control, how to implement and evidence it, one-year log retention, processor contracts and the ₹250 crore penalty.Read guide →Breach notificationDPDP breach notification under Rule 7: what counts as a breach, notices to the Board and each person, the 72-hour report, CERT-In and the ₹200 crore penalty.Read guide →Data principal rightsDPDP data principal rights: access, correction, erasure, grievances and nomination, what Rule 14 makes you publish, the 90-day grievance cap and a workflow.Read guide →Children's dataDPDP children data rules: who counts as a child, verifiable parental consent under Rule 10, Fourth Schedule exemptions for schools, and the ₹200 crore penalty.Read guide →Data retentionDPDP data retention: section 8(7) erasure, the Third Schedule 3-year rule, the 48-hour notice, the 1-year log minimum and a retention schedule template.Read guide →Cross-border transfersDPDP cross border data transfer under section 16: the negative list, Rule 15 orders, SDF localisation, sectoral rules like RBI's and offshore vendor contracts.Read guide →
By industry
2 guidesDPDP for SaaSDPDP for SaaS: when you are a fiduciary or processor, DPA clauses, sub-processor registers, tenant controls, breach notice and what enterprise buyers ask.Read guide →DPDP for fintechDPDP Act for fintech, NBFCs and banks: how it works with RBI rules, KYC retention, the loan-defaulter exemption, Account Aggregators and breach response.Read guide →
Beyond DPDP: adjacent engineering
7 guidesPrivacy engineeringPrivacy engineering for DPDP: find personal data in databases, logs, backups and SaaS, map it, then automate consent, rights requests and deletion with proof.Read guide →AI governanceAI governance in India for AI systems and agents that use personal data: inventory, DPDP assessment, guardrails, human oversight and an audit trail.Read guide →AI red teamingAI red teaming in India for chatbots, copilots, RAG and agents: prompt injection, data leakage and agent permission tests, mapped to DPDP Rule 6 safeguards.Read guide →Data localisationData localisation India: what DPDP, RBI, SEBI and IRDAI require, and how we build Indian-region hosting, keys, backups and DR you can prove.Read guide →Data readiness for AIEnterprise data readiness for AI: quality, catalogues, governance and RAG pipelines built so DPDP access, rights and erasure reach every vector index.Read guide →API and supply chain securityAPI security India: find every API, fix broken object level authorisation, vault secrets, build an SBOM and secure CI/CD, mapped to DPDP Rule 6 safeguards.Read guide →Ransomware readinessRansomware readiness in India: immutable backups, tested restores and one runbook for CERT-In's 6-hour and DPDP's 72-hour reporting clocks.Read guide →