Regulations › Rest of world › India
DPDP Act
Digital Personal Data Protection Act 2023 (India)
WhenIn effect since 13 November 2025
Who enforces itData Protection Board of India
Who it applies toOrganizations processing digital personal data in India, and outside India when offering goods or services to people in India.
Tell the regulatorIntimate the Board without delay, then a detailed report within 72 hours of becoming aware
DPO requiredOnly Significant Data Fiduciaries notified by the government must appoint a DPO; others publis…
RegistrationNo general controller registration
Transfers abroadTransfers allowed except to countries the government restricts by notification
Request deadlineGrievances must be answered within a reasonable period not exceeding 90 days
Maximum fineUp to INR 250 crore (about USD 30m) per instance for security safeguard failures
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to processing outside India connected with offering goods or services to data principals in India.s.3(b) · source ↗
Lawful basis
3
Consent is the default basis; processing without consent only for listed 'legitimate uses' (s.7). No general legitimate interests ground.ss.4(1), 7 · source ↗
Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Consent
2
Consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the specified purpose.s.6(1) · source ↗
Consent may also be given through a registered Consent Manager (s.6(7)-(9)). Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Sensitive data
0
No separate sensitive data category; volume and sensitivity only factor into Significant Data Fiduciary designation.s.10(1)(a) · source ↗
Children
3
Child means under 18; verifiable parental consent required; no tracking, behavioral monitoring or targeted advertising directed at children.ss.2(f), 9; Rule 10 · source ↗
Removal of Difficulties Order 2026 (S.O. 5458(E)) reworded s.9(1) only. Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
People's rights
Rights
1
Access to information, correction, completion, updating and erasure, grievance redressal and nomination. No portability, objection or automated-decision rights.ss.11-14 · source ↗
Counted: access, correction, deletion. Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Request deadline
1
Grievances must be answered within a reasonable period not exceeding 90 days.Rule 14(3) · source ↗
Read in Hindi gazette text (English extraction partial). Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Marketing
0
No specific direct marketing rule; marketing requires consent like other processing; targeted ads to children banned.s.9(3) · source ↗
Telemarketing is regulated separately by TRAI (TCCCPR 2018), not covered here.
Governance
DPO required
1
Only Significant Data Fiduciaries notified by the government must appoint a DPO; others publish contact of a DPO or responsible person.ss.10(2)(a), 8(9) · source ↗
No SDF notified as of Oct 2026. Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
DPO qualifications
2
DPO must be based in India and answer to the board; no qualification or certification prescribed.s.10(2)(a) · source ↗
Level reflects local residency requirement.
Registration
0
No general controller registration. Only Consent Managers must register with the Data Protection Board.s.6(9); Rule 4 · source ↗
Consent Manager registration applies from 13 Nov 2026.
DPIA
2
Significant Data Fiduciaries must conduct a DPIA and independent data audit once every twelve months and report to the Board.s.10(2)(c); Rule 13(1)-(2) · source ↗
Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Records
1
No general record of processing; fiduciaries must keep processing logs and related data for at least one year.Rule 6(1)(e); Rule 8(3) · source ↗
Rules read in Hindi text. Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Retention
3
Erase when purpose ends or consent is withdrawn; large e-commerce, gaming and social platforms must erase after three years of inactivity with 48 hours' notice.s.8(7); Rule 8; Third Schedule · source ↗
Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Breaches
Tell the regulator
3
Intimate the Board without delay, then a detailed report within 72 hours of becoming aware.s.8(6); Rule 7(2) · source ↗
Initial notice 'without delay' treated as immediate. 72-hour figure garbled in Hindi extraction; corroborated by secondary sources. Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Tell people
3
Inform each affected data principal of every breach without delay, regardless of risk level.s.8(6); Rule 7(1) · source ↗
Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Transfers
Transfers abroad
0
Transfers allowed except to countries the government restricts by notification; conditions may be set by order.s.16; Rule 15 · source ↗
Negative-list model; no country restricted as of Oct 2026. Stricter sectoral rules (e.g. RBI) prevail under s.16(2).
Localization
2
Significant Data Fiduciaries must keep government-specified personal data in India; sectoral regulators may impose more.Rule 13(4); s.16(2) · source ↗
No data categories specified yet. Substantive duties commence 13 May 2027 under G.S.R. 843(E); not yet enforceable as of as_of date.
Enforcement
Maximum fine
3
Up to INR 250 crore (about USD 30m) per instance for security safeguard failures.s.33; Schedule · source ↗
Criminal liability
0
No criminal offences; only monetary penalties imposed by the Board.s.33 · source ↗
Private action
1
Civil courts barred; data principals complain to the Data Protection Board after exhausting grievance redressal. No compensation provision.ss.13(3), 39 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws