Plan DPDP Act 2023 and DPDP Rules 2025 compliance: timelines, consent, data principal rights, Significant Data Fiduciary obligations, breach response and penalties.
India's data protection regime is now live. The DPDP Act 2023, with the DPDP Rules 2025, runs an 18-month phased rollout through May 2027 — but the clock started the day the rules were notified, and the organisations that wait until their obligation date will find the hardest work left to do. The regime reaches beyond technology teams: consent architecture, notice design, retention schedules, breach response and the elevated duties placed on Significant Data Fiduciaries reshape how businesses collect and use personal data at every level.
This hub gives you the practical picture: what the timelines actually mean for your organisation, how to design consent and notice systems that work for users and for regulators, what the Data Principal rights require in operating terms, when you become a Significant Data Fiduciary and what that adds, and how penalties change the risk calculus for inaction. It is written for DPOs, privacy leads, product owners and counsel who need a compliance programme that is buildable — not just a reading list.
The Digital Personal Data Protection Act, 2023 (DPDP Act) has turned data protection from a best practice into a legal requirement for every organization that processes digital personal data of individuals in India — including many companies based outside India.
With the DPDP Rules 2025 notified in November 2025, obligations are now concrete: itemized notices, free and specific consent, purpose-based retention, breach reporting within 72 hours and new duties for Significant Data Fiduciaries. This hub is built for teams that need to understand the law and then turn it into operating controls.
Use this hub when your product or enterprise processes personal data of individuals in India — whether you operate in India, or serve Indian customers from the US, the Gulf, Europe, Asia or Australia. The Act applies extraterritorially to processing connected with offering goods or services to people in India.
The mistake many teams make is treating DPDP compliance as a document exercise after the product is designed. Consent flows, privacy notices, retention windows, breach response and governance obligations shape product design, user journeys, data architecture and procurement.
A practical compliance roadmap should connect legal interpretation with operational design. The goal is to know what is in scope, which controls are required, who owns them, how evidence is collected and how the program changes as rules evolve.
Map scope: what personal data you process, for whom, and whether Indian residents are in scope.
Design notices, consent and data principal rights workflows into user journeys.
Define retention, security safeguards, breach response and evidence ownership.
Review controls before May 2027 full enforcement and whenever scope changes.
Use these questions in internal planning before selecting tools, budgeting a project or booking a deeper advisory session.
Start with the service path, then use the guide to build a complete compliance plan.
A useful hub should help a visitor make a decision, not just collect links. For this topic, a strong next step produces these concrete outputs.
The Digital Personal Data Protection Act, 2023 is India's national data protection law. It governs how organizations process digital personal data, grants individuals rights over their data and establishes the Data Protection Board of India to enforce penalties.
The Rules were notified in November 2025 with an 18-month phased rollout: Board provisions from November 2025, Consent Managers and cross-border mechanisms from November 2026, and full Data Fiduciary enforcement from May 2027.
Yes. The Act applies to processing of digital personal data outside India when it is connected with offering goods or services to individuals within India — a key consideration for international companies serving Indian customers.
Penalties are financial, up to ₹250 crore for failure to take reasonable security safeguards leading to a breach and up to ₹200 crore for breach-notification failures or violations of children's data obligations. There are no criminal penalties under the Act.
Use the hub as a starting point, then map the consent flows, controls, workflows, training and delivery plan for your organization.
Book a Discovery Call