Overview
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive law on personal data. It applies to every organisation that processes digital personal data in India, from large companies to schools, hospitals, coaching institutes, housing societies, startups and professional firms.
The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement. The consent manager framework applies from 13 November 2026, and the core obligations of Data Fiduciaries, the rights of Data Principals and the penalty provisions apply from 13 May 2027. Penalties run up to ₹250 crore, so organisations need to prepare now.
With a background in computer science (B.Tech) as well as law, Rahul Gupta can work with both management and technical teams: understanding how data actually flows through apps, websites and vendors, and translating legal duties into practical steps.
Matters handled
- DPDP gap assessment and data mapping
- Privacy notices compliant with Section 5
- Consent design and withdrawal flows (Section 6)
- Legitimate-use analysis (Section 7)
- Data processing agreements with vendors
- Information security and breach response plans
- Children's data and verifiable parental consent
- Significant Data Fiduciary obligations: DPO, DPIA, audit
- Grievance redressal mechanism
- Representation before the Data Protection Board
- Appeals to the TDSAT
- Privacy policies for websites and apps
How a matter proceeds
Key dates
| Date | Milestone | Status |
|---|---|---|
| 11 Aug 2023 | DPDP Act receives Presidential assent | Done |
| 13 Nov 2025 | DPDP Rules notified; Data Protection Board provisions in force | In force |
| 13 Nov 2026 | Consent Manager registration framework (Rule 4) | In force |
| 13 May 2027 | Notice, consent, Fiduciary obligations, rights, children's data and penalties | Upcoming |
Maximum penalties (Schedule to the Act)
| Breach | Up to | Provision |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore | Sec. 8(5) |
| Failure to inform the Board and affected persons of a breach | ₹200 crore | Sec. 8(6) |
| Breach of obligations relating to children | ₹200 crore | Sec. 9 |
| Breach of Significant Data Fiduciary obligations | ₹150 crore | Sec. 10 |
| Breach of any other provision | ₹50 crore | — |
| Breach of duties by a Data Principal | ₹10,000 | Sec. 15 |
Check your readiness: try the free DPDP Readiness Check. Twelve questions show where your organisation stands.
Frequently asked questions
Does the DPDP Act apply to small businesses and professionals?
Yes. It applies to any person who processes digital personal data, including data collected offline and later digitised. Some exemptions can be notified for certain classes, such as startups, but most organisations will have obligations.
When do the obligations start?
The consent manager framework applies from 13 November 2026. Notice, consent, Fiduciary obligations, Data Principal rights and penalties apply from 13 May 2027.
Is a cookie banner enough?
No. The Act requires a clear notice of purpose and rights, consent that is free, specific, informed and unambiguous, easy withdrawal, security safeguards, breach reporting and a grievance mechanism.
What happens if there is a data breach?
The Data Fiduciary must inform the Data Protection Board and each affected Data Principal. Failure to do so can attract a penalty of up to ₹200 crore.
Discuss your matter
Book a consultation in person in Jaipur, over the phone or on a video call.