Your GDPR work is a head start in India, not a finish line.

Data Fiduciary

Your GDPR controller: decides the purpose and the means.

Data Processor

Same idea as under the GDPR: processes on the fiduciary's behalf.

Data Principal

The data subject. For a child or a person with a disability who has a lawful guardian, it includes the parent or guardian.

Consent Manager

New. A Board-registered intermediary that lets people give, review and withdraw consent across fiduciaries.

Significant Data Fiduciary

No GDPR twin. A fiduciary the central government designates for extra duties, based on factors such as volume and sensitivity of data.

Data Protection Board of India (the Board)

The enforcement body, closer to a single national adjudicator than to the EU's network of authorities.

• Leaning on legitimate interests. The DPDP Act has no balancing-test basis. Without consent you need one of the specific legitimate uses it lists.
• Treating 16 as the age of a child. The Act counts anyone under 18 as a child, and processing their data needs verifiable consent from a parent or guardian.
• Scoping in paper files. The Act covers digital personal data, including paper data later digitised. A GDPR scope list may be wider than you need, or miss digitised archives.
• Telling people only when risk is high. Here every affected Data Principal is to be told of a breach, and the Board too.
• Expecting portability requests. The Act gives no data portability right. It does give a right to nominate someone to act after death or incapacity.

• Children's processing limits. No tracking, behavioural monitoring or targeted advertising directed at children, subject to exemptions the Rules set.
• Duties on Data Principals. People must not file false or frivolous complaints or impersonate others. Your grievance process should record this.
• Grievance before escalation. A person must use your grievance route before approaching the Board, so the route has to work and keep records.
• A transfer model that runs backwards. The GDPR permits transfers only on approved grounds. The DPDP Act allows transfers unless the government restricts a country by notification.
• Notice for older consents. Where consent was given before the Act began, a notice must go out as soon as reasonably practicable.

The Rules add the operating detail, including a fuller breach report to the Board within 72 hours and staggered start dates for most duties. Confirm each date against the notification before planning around it.

• The DPDP Act, 2023 in plain wordsWho it covers, the key terms, and how the law is laid out.
• What a data fiduciary must doThe duties, from notice to security to erasure.
• Valid consent and noticesWhat a notice says and what makes consent count.
• Processing without consentThe legitimate uses and the exemptions, and their limits.
• Personal data breaches under the DPDP ActWho must be told, what they are told, and your records.
• Significant data fiduciariesThe extra duties: DPO, audits and impact assessments.
• The Data Protection Board and penaltiesHow enforcement works and the ceilings the Act sets.
• The DPDP Rules, 2025What the Rules add to the Act, and how they phase in.

Sources: The Digital Personal Data Protection Act, 2023 (Sections 2, 3, 5 to 11, 13 to 17, 27, 29, 32, 33 and the Schedule); the Digital Personal Data Protection Rules, 2025 (MeitY notification); Regulation (EU) 2016/679 (GDPR), Articles 6, 8, 20, 30, 33, 34, 44 to 49 and 83.