Compliance · India
DPDP Act 2023
The Digital Personal Data Protection Act sets out how organisations may collect, use, store and erase the personal data of people in India. The DPDP Rules were notified on 13 November 2025 and come into force in phases. The government can amend these phase dates, so we confirm the position at the start of each engagement. We work out which parts apply to you, close the gaps, and help your team keep it running day to day with TrustOS, our DPDP compliance platform.
Who it applies to
Is this law relevant to you?
Any organisation that processes digital personal data in India, and companies abroad, including US firms, that offer goods or services to people in India.
Core obligations
What the law asks of you
A plain language summary. Your legal team should confirm how each point applies to your business.
- Notice and consent
- A clear notice, valid consent and an easy way to withdraw it, for each purpose.
- Data principal rights
- Requests for access, correction, erasure and grievances answered within the set time.
- Security safeguards
- Reasonable security safeguards to prevent personal data breaches.
- Breach notification
- Tell the Data Protection Board and each affected person without delay, then send the Board a detailed report within 72 hours.
- Retention and erasure
- Delete data once the purpose is served or consent is withdrawn.
- Processor oversight
- Contracts with, and checks on, vendors who process data on your behalf.
- Children's data
- Verifiable parental consent, and no tracking or targeted advertising aimed at children.
- Significant data fiduciaries
- A DPO, independent audits and impact assessments, if you are notified as one.
How we help
From gap to evidence
- Check what applies and list the personal data you hold
- Compare current practice with the Act and the rules
- Draft notices, consent screens and rights request steps
- A breach response plan, tested with drills
- Set up TrustOS for consent, rights, breaches and audit evidence
- Make the required changes in your apps and databases
Run it day to day with TrustOS
Our DPDP compliance platform keeps consent, rights requests, breach response and audit evidence in one place.
Does the DPDP Act apply to a company based outside India?
Yes, if it processes the personal data of people in India in connection with offering them goods or services.
What are the penalties?
Up to INR 250 crore for failing to take reasonable security safeguards, up to INR 200 crore for failing to notify a breach or for breaching the duties on children's data, up to INR 150 crore for Significant Data Fiduciary duties, and up to INR 50 crore for most other breaches.
Where should we start?
Begin by listing the personal data you hold and checking which parts of the Act apply. Our DPDP Readiness Check gives you a first view in a few minutes.
Request a DPDP Act 2023 assessment
Regulations
Other laws we advise on
Start a conversation
Compliance that holds up in practice.
Start with a short assessment. We tell you which laws apply, what to fix first and what it will take.
A specialist replies within one working day. The first conversation is free.