India's privacy law rests on consent, a short list of duties and a digital Board.

The DPDP Act sets the rules for any organisation that handles digital personal data in India, and for organisations abroad that handle such data while serving customers in India with goods or services. It names three main roles: the data fiduciary, the data principal and the data processor. Enforcement lies with the Data Protection Board of India (the Board), and appeals from its orders go to the appellate tribunal TDSAT.

Spelled out: Digital Personal Data Protection Act, 2023.

The Act is short, and the detail sits in the DPDP Rules, 2025, notified in November 2025. The Rules start in stages: the Board provisions applied on publication, consent manager registration one year later, and most fiduciary duties eighteen months after publication. Processing is lawful only with consent or for one of the legitimate uses listed in section 7. The Schedule sets penalty ceilings: up to 250 crore rupees where reasonable security safeguards are not maintained, up to 200 crore for a missed breach notification or a violation of the children's provisions, and up to 50 crore for other breaches by a fiduciary. There is no DPDP certificate; compliance is shown through your own records.

Board papers

A board briefing on readiness, owners and the phase-in dates that apply to the company.

Customer and vendor contracts

New clauses on roles, safeguards, breach notice and erasure that reference the Act.

The privacy notice and consent flow

A standalone notice stating the purpose and how to withdraw consent or complain to the Board.

A readiness assessment

A gap review that maps each duty in the Act and Rules to an owner and evidence.

GDPR

The EU regulation. It has six lawful bases and broader rights; the DPDP Act has consent plus listed legitimate uses and a narrower set of rights.

IT Act, 2000 and its SPDI Rules

The earlier regime, which dealt with sensitive personal data. Section 43A of the IT Act is omitted by the DPDP Act, so the two should not be read as stacking.

• Map your personal data and decide your role for each activity.
• Mark the Rules' commencement dates in your plan and work backwards.
• Rewrite the notice and consent flow, then the grievance and rights process.
• Fix vendor contracts and security logging before the safeguards duty applies.

• GuideThe DPDP Act, 2023 in plain wordsWho it covers, the key terms, and how the law is laid out.
• GuideThe DPDP Rules, 2025What the Rules add to the Act, and how they phase in.
• GuideThe Data Protection Board and penaltiesHow enforcement works and the ceilings the Act sets.

Sources: Digital Personal Data Protection Act, 2023, sections 3, 4, 7, 18, 44 and the Schedule; Digital Personal Data Protection Rules, 2025, rule 1; PIB note on the DPDP Rules, 2025 (November 2025). Not legal advice.