BuildWrightDPDP in five minutes
India's data protection law

DPDP in
five minutes

What the law is, what changed, who does the work, and what it costs to get wrong.

Scroll↓
1 · What counts
Personal data
NamePhone numberEmailPayment detailsHealthLocation
All of it counts

India's Digital Personal Data Protection Act, 2023 governs personal data held in digital form.

DPDP Act s.2(t), s.3. Before: SPDI Rules, 2011, Rule 3. Commencement: Rule 1(4), G.S.R. 846(E).
2 · Who's who
Your companyData Fiduciary
The personData Principal
Your vendorsData Processors
Contact personOr a DPO
The BoardRegulator
CERT-InCyber agency

At the centre: your company. The law calls it the Data Fiduciary, and most duties are yours.

s.2(i); ss.11 to 15; s.8(2), s.8(5), Rule 6(1)(f); Rule 9 and s.10(2)(a); ss.28 to 34; CERT-In Directions, 28 April 2022.
3 · Before and now
Before · IT Act and SPDI Rules
What counts

Only sensitive personal data: passwords, financial details, health, sexual orientation, medical records, biometrics.

Now · DPDP
What counts

All personal data about a person who can be identified, held in digital form.

Before: IT Act ss.43A, 46(1A); SPDI Rules 3, 4, 5, 8. Now: DPDP Act ss.2(t), 5, 6, 8(6), 11 to 14, 29, 33, 34; Rules 3, 6, 7, 9, 14. CERT-In Directions, 28 April 2022.
4 · Who does the work
Lawyer1
Developer0
Operations0

LawyerWrite the notice: what you collect, why, how to withdraw, how to complain

Notice s.5, Rule 3; consent s.6(4), s.6(10); security Rule 6(1); vendors s.8(2), Rule 6(1)(f); breach s.8(6), Rule 7; logs Rule 8(3); contact Rule 9; grievance Rule 14(3); erasure s.8(7); children Rule 10. CERT-In Directions, direction (ii).
5 · How it is recorded
Consent recordsRequired
Processing logsRequired
System logs for CERT-InToday
Vendor contractsRequired
Breach fileRequired
Old versions of your noticeAdvised
Requests and complaints logAdvised

Prove each person saw the notice and agreed. Kept by your product, for as long as you rely on that consent.

s.6(10); Rule 6(1)(c), (e); Rule 8(3); CERT-In Directions, direction (iv); s.8(2), Rule 6(1)(f); Rule 7(2)(b); Rule 14(3). Advised items are good practice with no named duty.
6 · When it goes wrong
0:00
hours since you found out
NowTell each person affected and the Board, without delay from 2027
6 hReport to CERT-In applies today
72 hDetailed report to the Board from 2027

Something leaked. The clock starts when you notice.

CERT-In Directions, 28 April 2022, direction (ii). From May 2027: s.8(6); Rule 7(1); Rule 7(2)(a) and (b), the 72 hours running from becoming aware.
6 · What it can cost
₹250 crore
Weak security safeguards
Not reporting a breach
Children's data duties
A person's own duties

The highest ceiling is for weak security.

DPDP Act, the Schedule; imposed under s.33 after an inquiry, credited to the Consolidated Fund of India (s.34), from May 2027. Until then IT Act s.43A covers compensation for sensitive data.
7 · Your checklist

Who does what

CERT-In applies today. Everything else is due when the DPDP Rules take effect in May 2027.

Lawyer
Write the notice: what you collect, why, how to withdraw, how to complain
Security terms in every vendor contractif vendors hold the data
Developer
Keep a record of every consentwith a website or app
A way to withdraw consent as easy as giving itwith a website or app
Encrypt or mask personal data and limit access
Keep processing logs for at least a year
Delete data once its purpose is over
Parental consent before using a child's dataif you handle children's data
Operations
Report a cyber incident to CERT-In within 6 hours
After a breach: tell people and the Board, report within 72 hours
Name and publish a contact for data questions
Answer every grievance within 90 days
WhatsApp usFree consultation
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (G.S.R. 846(E)); CERT-In Directions, 28 April 2022; IT Act, 2000 and SPDI Rules, 2011. BuildWright provides documentation, filing and compliance facilitation. Last checked 25 October 2026.