DPDP at a Glance
India’s Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 in a quick summary.
The law that governs how organisations collect, use, store, share and delete digital personal data.
Who’s who under DPDP?
Data Principal
The individual whose personal data is processed.
Data Fiduciary
Organisation that decides why and how personal data is processed. (Comparable to Data Controller)
Data Processor
Vendor/service provider that processes personal data on behalf of the Data Fiduciary.
Consent Manager
Registered entity that enables individuals to give, manage, review and withdraw consent.
Data Protection Officer (DPO)
India-based privacy lead appointed by Significant Data Fiduciaries.
Significant Data Fiduciary
Organisation notified by Government based on volume, sensitivity and risk.
DPDP Key Aspects
Applicability
- Digital personal data processed in India.
- Offline data that is later digitised.
- Organisations outside India offering goods or services to individuals in India.
- Personal or domestic use and certain lawfully public data are generally excluded.
Children's data
- A child is defined as anyone below 18 years.
- Organisations generally need verifiable parental or guardian consent.
- Must not process data in a way likely to harm a child.
- No tracking or behavioural monitoring of children.
- No targeted advertising directed at children.
- Limited exemptions apply for specified purposes such as healthcare, education and child safety.
Consent and lawful use
- Consent must be free, specific, informed, clear and easy to withdraw.
- Organisations should collect only the data necessary for the stated purpose.
- Allows specific legitimate uses permitted by the Act (e.g., voluntary sharing, medical emergencies, employment purposes).
Security & breach reporting
- Reasonable security safeguards must be in place to prevent data breaches.
- Affected individuals and the Data Protection Board must be informed without delay.
- More detailed information must generally be submitted to the Board within 72 hours, unless additional time is allowed.
Data obligations
- Clearly explain what data is collected and why.
- Keep personal data accurate and secure.
- Limit employee and vendor access.
- Use Data Processors under valid contracts.
- Delete data when it is no longer required, unless legally retained.
- Provide an accessible privacy contact and grievance process.
Significant Data Fiduciaries
- Appoint an India-based Data Protection Officer (DPO).
- Appoint an independent data auditor.
- Conduct annual Data Protection Impact Assessments (DPIAs) and audits.
- Assess whether algorithms and technical systems may create risks for individuals.
- Follow any notified data-transfer restrictions.
Data Principal rights
- Access a summary of their personal data and its processing details.
- Know who their data has been shared with, subject to legal exceptions.
- Correct, complete or update inaccurate information.
- Request erasure where retention is no longer necessary.
- Withdraw consent easily.
- Raise grievances through accessible pathways.
- Nominate another person to exercise rights in the event of death or incapacity.
- Note: The Act does not specifically provide GDPR-style rights to data portability or a standalone 'right to be forgotten.'
Penalties for non-compliance
- Up to ₹250 crore for failure to maintain reasonable security safeguards.
- Up to ₹200 crore for breach-notification failures or violations involving children.
- Up to ₹150 crore for breach of Significant Data Fiduciary obligations.
- Up to ₹50 crore for other violations.
DPDP Timeline
DPDP Act enacted
The Act received Presidential assent on 11 August 2023.
Final DPDP Rules notified
DPDP Rules, 2025 and the phased enforcement schedule notified.
Consent Manager provisions
Provisions related to Consent Managers come into force (1 year after notification).
Major compliance obligations take effect
Most operational requirements become enforceable (18 months after notification).
The 18-month transition period is already underway. Organisations should prepare their policies, processes, systems and employees before 14 May 2027.
Innvikta translates DPDP compliance into everyday action.
We help employees recognise personal data, handle it responsibly and respond correctly when something goes wrong—turning regulatory requirements into practical, role-relevant behaviour.
Frequently Asked Questions
Innvikta provides role-based, bite-sized DPDP compliance training modules tailored specifically for employees handling personal data in India. Our platform ensures verifiable training records to help Data Fiduciaries demonstrate accountability and compliance to the Data Protection Board of India (DPBI).
Innvikta offers specialised modules designed for various departments—including HR, Customer Support, IT, and Finance. Each module translates complex DPDP rules (like consent notices, data principal rights, and secure processing) into everyday practical scenarios relevant to the employee's role.
Yes. Innvikta's compliance dashboard generates audit-ready reports tracking employee participation, assessment scores, and completion rates. This provides concrete evidence of "reasonable security safeguards" to protect personal data as mandated under Section 8 of the DPDP Act.
Organisations can deploy Innvikta's automated training platform to launch simulated phishing scenarios and interactive compliance modules across their entire workforce. With automatic reminders and custom risk scoring, you can build a strong privacy-first culture in days.
Ready to Build a DPDP Compliant Workforce?
Deploy role-based awareness modules and establish a robust privacy-first compliance culture across your team.
