Skip to main content

Privacy · Law

DPDP Act, 2023, India's personal data protection law

India's law on digital personal data, with the Rules that put it into practice.

Type
Law
Group
Privacy
We help with
ISO 27001 and GRC
Issued by
Not applicable
Free tool

DPDP readiness self-check

Twelve questions, an instant per-area result and your top gaps. Runs in your browser; nothing is stored.

Start the self-check
[01]What it is

What it is.

The Digital Personal Data Protection Act, 2023, with the Digital Personal Data Protection Rules, 2025, governs how organisations (data fiduciaries) process digital personal data in India. It gives individuals (data principals) rights and sets duties for organisations. The Rules were notified on 13 November 2025 and start in phases: the Data Protection Board provisions immediately, consent manager registration from 13 November 2026, and most duties on organisations (notices, safeguards, breach notice, retention and rights) from 13 May 2027.

Who usually needs it

  • Any organisation processing digital personal data in India
  • Businesses handling customer, employee or patient data
  • Platforms processing children's data
[02]What it covers

What it covers.

  • 01

    Consent or legitimate use

    Process personal data only with valid consent or for a legitimate use under the Act.

  • 02

    Notices and rights

    Clear notices, and rights for data principals.

  • 03

    Security and breaches

    Reasonable security safeguards, and breach notification to the Data Protection Board and affected people.

  • 04

    Children

    Verifiable parental consent for processing children's personal data.

  • 05

    Penalties

    Penalties under the Act go up to ₹250 crore.

[03]How we help

How we help with India DPDP Act 2023

We map where personal data enters, lives and leaves your organisation, then work through the duties in the order the DPDP Rules 2025 bring them in: notices and consent records, security safeguards, breach intimation, retention and erasure, and rights requests. The free self-check gives you a first view in minutes. We provide compliance support, not legal advice.

[04]Typical phases

Typical phases.

Each phase ends with something you keep. Timelines depend on scope and are agreed in the proposal.

  1. 1

    Discover

    • Data inventory
    • Processing register
  2. 2

    Assess

    • Gap report
    • Risk-ranked actions
  3. 3

    Implement

    • Notices and consent
    • Safeguards
    • Rights process
  4. 4

    Prepare

    • Breach response plan
    • Staff awareness
  5. 5

    Maintain

    • Periodic review
    • Updated records
[05]FAQ

Questions, answered.

Still have questions?

info@cloudcyber.co.in

Organisations that process digital personal data in India, and in some cases processing outside India connected to offering goods or services to people in India.

Under Rule 7 you must tell the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours. This applies from 13 May 2027.

Penalties under the Act go up to ₹250 crore.

[06]Contact

Let's build what's next.

Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.

Email
info@cloudcyber.co.in
Response
Usually within one business day
Location
Worldwide

What happens next

  1. 01

    Reply

  2. 02

    Discovery call

  3. 03

    Proposal

We use these details to reply to your enquiry and, if you allowed advertising cookies, to measure which ads lead to enquiries. Our Privacy Notice explains retention and your rights.

This page is general guidance, not legal advice. Last reviewed October 2026.