DPDP Act 2023 and DPDP Rules 2025: compliance guide for IT companies

The DPDP Act (Digital Personal Data Protection Act, 2023) is India's data protection law. It governs how organizations process digital personal data of individuals and sets up the Data Protection Board of India to enforce it. The Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, fill in the detail and set a phased start, with most duties applying from about 13 May 2027.

For Indian software, SaaS and IT services companies, the DPDP Act affects both the data you collect for your own business and the data you process for clients. Indian enterprise customers are already adding DPDP clauses to vendor contracts. This guide walks through the Act section by section, the Rules that apply to each duty, and how to prepare in the time left. Section and rule numbers are given so you can check each point against the official text, linked in the sources.

What is the DPDP Act and what does it cover?

The DPDP Act was passed by Parliament in August 2023 as Act No. 22 of 2023. It applies to the processing of digital personal data, meaning personal data collected in digital form, or collected in non-digital form and later digitized (Section 3).

• Personal data is any data about an individual who is identifiable by or in relation to that data (Section 2(t)).
• Processing is a wholly or partly automated operation on personal data, such as collection, storage, use, sharing, disclosure or erasure (Section 2(x)).

The Act does not apply to personal data processed by an individual for personal or domestic purposes, or to personal data that the person or someone under a legal obligation has made publicly available (Section 3(c)).

Unlike the GDPR, the Act does not create a separate class of sensitive personal data. All personal data is treated alike, with extra rules for children, persons with disabilities and Significant Data Fiduciaries.

Is the DPDP Act mandatory, and when does it apply?

Yes, the DPDP Act is binding law. Its duties are being switched on in phases under the commencement notification (G.S.R. 843(E)) and Rule 1 of the DPDP Rules:

The dates for the later phases are counted from publication in the Gazette, so check the exact day with your legal team. Reports in 2026 said the government was considering shortening the 18-month period. As of our last review no amendment had been notified, so plan for 13 May 2027 and watch for a change.

When the main provisions start, Section 44 of the DPDP Act also removes Section 43A from the IT Act, 2000. That ends the older "reasonable security practices" regime under the 2011 SPDI Rules, which Indian IT companies have used until now.

Who must comply with the DPDP Act?

The Act applies to the processing of digital personal data within India, and to processing outside India if it is connected with offering goods or services to data principals in India (Section 3(a) and (b)). The roles are:

• Data fiduciary: anyone who alone or with others decides the purpose and means of processing (Section 2(i)). This is the GDPR's controller.
• Data processor: anyone who processes personal data on behalf of a data fiduciary (Section 2(k)).
• Data principal: the individual the data relates to. For a child, it includes the parent or lawful guardian, and for a person with disability, the lawful guardian (Section 2(j)).
• Significant Data Fiduciary: a fiduciary or class of fiduciaries the government notifies based on factors such as volume and sensitivity of data, risk to data principals and national interest (Section 10).
• Consent manager: a person registered with the Board who acts as a single point of contact for data principals to give, manage, review and withdraw consent (Section 2(g)).

For an IT company the roles split like this:

• You are the data fiduciary for your own employees, job applicants, website visitors, marketing leads and customer account contacts.
• You are usually the data processor for the personal data your clients put into your software or give you under a services contract. The client stays the fiduciary and remains responsible under Section 8(1), so it will pass duties to you by contract.

Processing of data principals outside India under a contract with a foreign person is exempt from most of the Act (Section 17(1)(d)). That matters for Indian IT services firms processing data of foreign residents for foreign clients, although those clients' own laws, such as the GDPR, still apply.

Why does the DPDP Act matter for IT and SaaS companies?

• Large penalties. Up to 250 crore rupees per instance for failing to take reasonable security safeguards.
• Client contracts. Fiduciaries must use processors only under a valid contract (Section 8(2)) and must make sure processors protect data (Section 8(5) and Rule 6). Expect DPDP data processing addenda in renewals.
• Product changes. Consent flows, notices, withdrawal, rights requests, erasure and log retention all need product support.
• A fixed deadline. Unlike voluntary standards, there is a date by which the work must be done.
• Customer trust. Indian consumers and enterprises now know their rights, and the Board will take complaints online.

When can you process personal data under the DPDP Act?

Section 4 allows processing only for a lawful purpose, and only on one of two grounds:

Consent (Section 6)

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. Any part of a consent that infringes the Act is invalid to that extent. Withdrawing consent must be as easy as giving it, and after withdrawal you and your processors must stop processing within a reasonable time unless the Act allows otherwise.

Certain legitimate uses (Section 7)

The Act lists situations where consent is not needed. Those most relevant to businesses are:

• Where the data principal voluntarily provided the data for a specified purpose and has not said they do not consent to its use for that purpose (Section 7(a)).
• Fulfilling an obligation under a law, or complying with a judgment, decree or order (Section 7(d) and (e)).
• Medical emergencies, epidemics and disasters (Section 7(f) to (h)).
• Purposes of employment, or to safeguard the employer from loss or liability, such as preventing corporate espionage, protecting trade secrets or providing services to employees (Section 7(i)).

There is no general "legitimate interests" ground like the GDPR's. If your purpose does not fit Section 7, you need consent.

Notice (Section 5 and Rule 3)

Every request for consent must come with, or be preceded by, a notice. Rule 3 requires the notice to be understandable on its own, in clear and plain language, and to give an itemized description of the personal data and the specified purposes, a link to withdraw consent as easily as it was given, and how to exercise rights and complain to the Board. Notices must be available in English or any language in the Eighth Schedule to the Constitution (Section 5(3)).

What are a data fiduciary's obligations?

Section 8 sets the general duties of every data fiduciary. With the Rules, they are:

What security safeguards do the DPDP Rules require?

Rule 6 sets the minimum content of "reasonable security safeguards". A data fiduciary must protect personal data in its possession or control, including processing by a processor, with measures that include at least:

• Securing personal data through encryption, obfuscation, masking or virtual tokens.
• Controlling access to the computer resources it uses.
• Visibility into access through logs, monitoring and review, so that unauthorized access can be detected, investigated and fixed.
• Measures for continued processing if confidentiality, integrity or availability is compromised, such as backups.
• Keeping those logs and personal data for one year for detecting unauthorized access and investigating it, unless a law requires otherwise.
• Contract terms with processors requiring them to take reasonable security safeguards.
• Appropriate technical and organizational measures to make sure the safeguards are observed.

The Rules do not name a security standard. Many Indian IT companies already run ISO 27001, which gives a documented, auditable way to show these safeguards. If you are also covered by CERT-In's directions, remember they have their own six-hour incident reporting rule and 180-day log retention requirement, which run alongside the DPDP rules.

How does breach reporting work under the DPDP Act?

A personal data breach is any unauthorized processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability (Section 2(u)). There is no harm threshold: every breach is reportable.

1. To each affected data principal, without delay: a description of the breach, its likely consequences, the measures taken or being taken, safety steps the person can take, and a business contact who can answer questions (Rule 7(1)).
2. To the Board, without delay: a description of the breach, including its nature, extent, timing, location and likely impact (Rule 7(2)(a)).
3. To the Board, within 72 hours of becoming aware, or a longer period the Board allows on request: updated and detailed information, the facts and circumstances and reasons for the breach, mitigation, findings on the person who caused it, remedial measures, and a report on the intimations given to data principals (Rule 7(2)(b)).

As a processor, you are not named in Rule 7, but your client cannot meet these timelines without you. Expect contracts to require you to tell the client within a few hours and to support its reports.

How long can you keep personal data?

Section 8(7) requires erasure once the data principal withdraws consent or it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, unless retention is needed to comply with law. Rule 8 adds:

• For the classes in the Third Schedule, the purpose is treated as no longer served if the person has not approached you or exercised their rights for three years. The classes are e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh registered users, and social media intermediaries with at least two crore registered users.
• At least 48 hours before erasing on that basis, you must tell the person their data will be erased unless they log in or contact you.
• Personal data, related traffic data and logs of processing must be kept for at least one year from the processing, for the purposes in the Seventh Schedule, such as investigations, unless another law requires longer.

What are the rules for children's data?

A child under the Act is anyone under 18 (Section 2(f)). This affects edtech, gaming, social and consumer apps, and also B2B products used by schools.

• You need verifiable consent of a parent or lawful guardian before processing a child's personal data (Section 9(1)).
• You must not process data in a way likely to cause a detrimental effect on a child's well-being (Section 9(2)).
• You must not track or monitor children's behavior, or target advertising at them (Section 9(3)).
• Rule 10 requires due diligence to check that the person giving consent is an identifiable adult, using reliable identity and age details already held or a virtual token from an authorized entity, such as a DigiLocker-based token.
• The Fourth Schedule exempts some classes and purposes from parts of Section 9, including clinical establishments and health professionals, educational institutions, and childcare and transport providers for safety tracking, within set limits.
• Rule 11 sets the equivalent process for verifiable consent from the lawful guardian of a person with disability.

What rights do data principals have?

Sections 11 to 14 give data principals these rights, with the process set by Rule 14:

• Access to information about the personal data processed, the processing activities, and the identities of other fiduciaries and processors it was shared with (Section 11).
• Correction, completion, updating and erasure of personal data (Section 12).
• Grievance redressal by the fiduciary or consent manager, which must be used before complaining to the Board (Section 13).
• Nomination of another person to exercise rights in the event of death or incapacity (Section 14).

Rule 14 requires you to publish on your website or app how to make a request and what identifier you need, and to respond to grievances within the period you publish, no longer than 90 days. There is no right to data portability and no right to object to automated decisions, which differ from the GDPR. Data principals also have duties under Section 15, such as not filing false or frivolous complaints, with a penalty of up to 10,000 rupees.

What extra duties apply to Significant Data Fiduciaries?

The government can notify a fiduciary or class of fiduciaries as Significant Data Fiduciaries (SDFs). As of our last review, no list of SDFs had been notified. If you are named, Section 10 and Rule 13 require you to:

• Appoint a data protection officer based in India who represents the SDF, is responsible to the board of directors or similar governing body, and is the point of contact for grievances.
• Appoint an independent data auditor.
• Carry out a data protection impact assessment and an audit once every twelve months, and have the person who did them report significant observations to the Board.
• Check that technical measures, including algorithmic software used to host, display, upload, modify, publish, transmit, store, update or share personal data, are not likely to pose a risk to data principals' rights.
• Make sure personal data and traffic data that the government specifies, on a committee's recommendation, is not transferred outside India.

Large IT and SaaS companies serving Indian consumers, and their processors, should watch for SDF notifications, because SDF clients will pass these duties into vendor contracts.

Can you transfer personal data outside India?

Yes, in general. Section 16 lets the central government restrict transfers to specified countries by notification, which is a negative list approach. No such list had been notified as of our last review. Rule 15 adds that transfers are subject to any requirements the government sets by general or special order for making data available to a foreign state or its agencies. Stricter sector laws still apply, such as RBI's rule on storing payment system data in India (Section 16(2)).

For Indian IT services companies serving foreign clients, the bigger question is usually the client's law. EU clients, for example, need a GDPR transfer mechanism to send data to India. See our GDPR guide.

What training does the DPDP Act require?

The Act and Rules do not contain a clause that says "train every employee". Training still follows from the duties:

• Section 8(4) requires appropriate technical and organizational measures to ensure effective observance of the Act. Staff who do not know the rules cannot observe them.
• Rule 6 requires organizational measures to make sure security safeguards are observed, and breach detection depends on people reporting what they see.
• Rule 7 sets breach timelines that only work if staff know to escalate at once.
• Rule 14 requires a working process for rights requests and grievances, which support and HR teams must know how to handle.
• Section 10 requires SDFs to run DPIAs and audits, and auditors usually check staff awareness.

A practical DPDP training plan for an IT company covers everyone at onboarding and once a year, with role-based modules for support, HR, marketing, product and engineering. Topics include what counts as personal data, consent and notice, legitimate uses for employee data, spotting and reporting a breach, handling access and erasure requests, children's data, and safe use of AI tools with client data.

How do you prepare for the DPDP Act step by step?

1. Map personal data. List processing activities, the data, the people it relates to, purposes, systems, processors and retention.
2. Decide your role per activity. Fiduciary or processor. Flag any processing of children's data.
3. Pick the ground for each purpose. Consent or a Section 7 legitimate use. Write down why.
4. Rewrite notices and consent flows to meet Section 5 and Rule 3, with an easy withdrawal link and language options.
5. Close security gaps against Rule 6. Encryption or masking, access control, logging with one-year retention, monitoring and backups.
6. Build the breach process for intimation without delay and the 72-hour detailed report, and align it with CERT-In's six-hour rule.
7. Set retention and erasure rules, including the 48-hour warning where the Third Schedule applies.
8. Publish a contact and grievance process with a response period of no more than 90 days.
9. Update contracts. Processor terms for your vendors, and DPDP addenda for your clients.
10. Plan for children's data if your product may be used by people under 18.
11. Train staff and keep records.
12. Review before 13 May 2027 and then yearly.

What are the penalties under the DPDP Act?

Section 33 and the Schedule to the Act set maximum monetary penalties per instance. The Board decides the amount after an inquiry, considering factors such as the nature, gravity and duration of the breach, the type of data affected, repetition, any gain or loss avoided, and steps taken to reduce the effects (Section 33(2)).

Appeals against Board decisions go to the Telecom Disputes Settlement and Appellate Tribunal (Section 29). The Act has no criminal offences, and penalties go to the government: it does not set up a route for affected individuals to claim compensation.

How does the DPDP Act compare with the GDPR?

Other Indian laws that apply alongside it include the IT Act, 2000, the CERT-In directions, the IT Rules, 2021 for intermediaries, and sector rules such as RBI's IT directions and SEBI's CSCRF.

Key DPDP Act terms

Data fiduciaryThe person who decides the purpose and means of processing. Data processorThe person who processes personal data on behalf of a data fiduciary. Data principalThe individual the personal data relates to, or their parent or lawful guardian. Significant Data Fiduciary (SDF)A fiduciary notified by the government that has extra duties. Consent managerA Board-registered person that lets individuals give, manage and withdraw consent through one platform. Data Protection Board of IndiaThe body that inquires into breaches, imposes penalties and handles complaints, working as a digital office. Legitimate useOne of the situations in Section 7 where consent is not needed.

DPDP Act FAQs

Official sources and references

We checked these sources while writing and reviewing this guide. Where a rule is a proposal or a draft, the guide says so.

• Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), MeitY Official text of the Act
• Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, 13 November 2025 Rules 1 to 23 and the Schedules
• Commencement notification, G.S.R. 843(E), 13 November 2025 Which sections of the Act are in force
• Corrigenda to the DPDP Rules, G.S.R. 892(E), 10 December 2025 Corrections to the notified Rules
• PIB backgrounder on the DPDP Rules, 17 November 2025 Government summary of the phased timeline
• DPDP Act, consolidated text on India Code Consolidated text as on 19 November 2025

Next steps

1. Build your personal data inventory and mark where you are a fiduciary and where a processor.
2. Record consent or a Section 7 legitimate use for each purpose.
3. Test whether you can inform the Board without delay and file a detailed report within 72 hours.
4. Assign DPDP training to every team, with due dates before May 2027. Book a demo to see how LMS Advisor tracks it.
5. Update processor contracts and client addenda with DPDP security and breach terms.