Regulations › Rest of world › India
DPDP Act
Digital Personal Data Protection Act 2023 (India)
WhenIn effect since 13 November 2025
Who enforces itData Protection Board of India
Who it applies toOrganizations processing digital personal data in India, and outside India when offering goods or services to people in India.
Tell the regulatorIntimate the Board without delay, then a detailed report within 72 hours of becoming aware
DPO requiredOnly Significant Data Fiduciaries notified by the government must appoint a DPO; others publis…
RegistrationNo general controller registration
Transfers abroadTransfers allowed except to countries the government restricts by notification
Request deadlineGrievances must be answered within a reasonable period not exceeding 90 days
Maximum fineUp to INR 250 crore (about USD 30m) per instance for security safeguard failures
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws