DPDP Act

Who it applies to

Processing of digital personal data within India, and processing outside India connected with offering goods or services to Data Principals in India.

Key requirements

• Process personal data only for a lawful purpose with valid consent or for certain 'legitimate uses'.
• Give clear notice and let Data Principals withdraw consent as easily as they gave it.
• Take reasonable security safeguards to prevent personal data breaches.
• Verifiable parental consent for children's data, with limits on tracking and targeted advertising.
• Rights of access, correction, erasure, grievance redress and nomination for Data Principals.
• Extra duties (such as a Data Protection Officer, audits and impact assessments) for Significant Data Fiduciaries.

Breach and incident notification

Every personal data breach must be notified to the Data Protection Board of India and to each affected Data Principal, in the form and timing set by the DPDP Rules 2025.

Penalties

Penalties set in the Schedule to the Act and imposed by the Data Protection Board, the highest being up to INR 250 crore for failing to take reasonable security safeguards.

Go deeper