A practical introduction to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 — and how organisations can begin assessing their readiness.
The Digital Personal Data Protection Act, 2023 is India's statutory framework governing the processing of digital personal data. The Digital Personal Data Protection Rules, 2025 provide supporting rules for the framework.
The framework addresses how personal data is processed, the responsibilities of Data Fiduciaries, and rights and duties connected with individuals whose personal data is processed.
Organisations should understand the personal data they handle, the purposes for which it is processed, the notices and consent mechanisms that may apply, security safeguards, breach response and how requests or grievances are handled.
The individual to whom the personal data relates. In the case of a child, the term is applied in the manner provided by the Act.
A person who, alone or in conjunction with others, determines the purpose and means of processing personal data.
A person who processes personal data on behalf of a Data Fiduciary.
A Data Fiduciary or class of Data Fiduciaries notified by the Central Government as a Significant Data Fiduciary under the Act.
The Act applies to processing of digital personal data within India where the personal data is collected in digital form, or collected in non-digital form and digitised subsequently. It also applies to processing outside India where the processing is in connection with an activity related to offering goods or services to Data Principals within India.
The Act contains exclusions, including specified personal or domestic purposes and certain publicly available personal data. A specific applicability assessment should consider the organisation's role, processing activities, locations and statutory exclusions.
Review how individuals are informed about personal data processing and how valid consent or another permitted basis is addressed under the Act.
Map categories of personal data, purposes of processing, retention practices and deletion workflows.
Review technical and organisational safeguards, access controls, security practices and vendor/processor arrangements.
Assess incident escalation, investigation, documentation and notification processes against applicable requirements.
Review channels and internal ownership for requests, correction, erasure, grievance handling and other applicable rights.
Review the additional statutory requirements for processing children's personal data, including verifiable parental consent and applicable exemptions.
The commencement notifications provide different effective dates for different provisions. The dates below are calculated from the relevant Gazette notifications.
| Milestone | Scheduled date | High-level description |
|---|---|---|
| Initial commencement | 13 November 2025 | Specified institutional, definitional and enabling provisions of the Act commenced. |
| One-year milestone | 13 November 2026 | Section 6(9) and Section 27(1)(d) of the Act commence. |
| Eighteen-month milestone | 13 May 2027 | Most substantive provisions of the Act listed in the commencement notification commence. |
| Rules commencement | Phased from 14 November 2025 | Rules 1, 2 and 17–21 commenced on publication; Rule 4 after one year; Rules 3, 5–16, 22 and 23 after eighteen months. |
The table is a high-level summary, not a substitute for the exact provision-by-provision wording in the Official Gazette. Confirm the relevant notification and any subsequent amendments before relying on a date.
The Schedule to the Act sets out maximum amounts for specified categories of breach. The Data Protection Board determines a penalty after an inquiry in accordance with the Act.
Failure to take reasonable security safeguards to prevent personal data breach.
Failure to give required notice of a personal data breach to the Board or affected Data Principals.
Breach of additional obligations relating to children under Section 9.
Breach of additional obligations under Section 10.
| Other Schedule category | Maximum / treatment in the Schedule |
|---|---|
| Breach of duties under Section 15 | May extend to ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board | Up to the extent applicable for the underlying breach |
| Any other breach of the Act or Rules | May extend to ₹50 crore |
These are statutory ceilings, not automatic fines. Section 33 requires the Board to consider relevant factors when determining the amount, including the nature, gravity and duration of the breach, type and nature of personal data affected, repetition, mitigation and proportionality.
We help organisations understand what needs attention and prepare a roadmap. Client teams remain responsible for implementation.
Sessions for relevant stakeholders on the Act and organisational responsibilities.
Structured review and a report identifying gaps and areas requiring attention.
Agreed activities and milestones for a period of up to 120 days from initiation.
Follow-up assessments on days 30, 60, 90 and 120.
Consolidated report of progress and assessed readiness.
Remaining legal and regulatory issues may be taken to the client's legal advisors.
The client organisation's management, IT, HR, operations and other relevant teams remain responsible for implementation, working under the guidance of internal or external legal advisors wherever required.
For authoritative wording, refer to the Government of India notifications and the Act.
Official Ministry of Electronics and Information Technology publication.
Gazette notification G.S.R. 843(E), dated 13 November 2025.
Speak with Super Infolabs about awareness training and an initial readiness assessment.
Super Infolabs Pvt. Ltd.