- India's Digital Personal Data Protection Act
Trusted by 1875+ Enterprise & SMBs
Overview: DPDP Compliance
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first standalone law on personal data. It sets out how organisations, called Data Fiduciaries, must collect, use, store and protect digital personal data. It also defines the rights of individuals, called Data Principals.
Requirements of DPDP Act 2023
Individuals have rights to information, correction, erasure, and complaint resolution, while organizations face penalties for violations.
Individual Rights: The Act grants you a range of rights, including:
- Right to Information: You can access the data an organization holds about you and understand how it's being used.
- Right to Correction: You can request corrections to any inaccurate or incomplete data.
- Right to Erasure: Under certain circumstances, you can request the deletion of your data.
- Right to Complaint Resolution: A designated authority will address any grievances you may have regarding data privacy violations.
Organizations must ensure accurate data, implement strong security measures, and report breaches promptly. Data Controllers have been termed as Data Fiduciary under the 2023 Bill.
- The Digital Personal Data Protection Act (DPDP) 2023 establishes a comprehensive framework for the processing of personal data within India.
- This framework places specific obligations on data fiduciaries, defined as entities determining the purpose and means of processing personal data.
- These obligations aim to ensure the responsible handling of personal data and safeguard the privacy rights of individuals.
- Under Section 7, fiduciaries are obligated to process personal data accurately and in line with legitimate uses.
The Government of India officially notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. These Rules bring the DPDP Act 2023 into practical operation by defining how organisations must handle notice, consent, data retention, security measures, and overall governance.
India's DPDP Rules 2025 lay out strict technical, legal, and governance requirements for Data Fiduciaries, Data Processors, and Consent Managers. Below is the summary of the key rules.
Implementation Phase:
Rule 2 explains important terms used across the Rules:
- User Account: Any identifier used to access a service (email, mobile number, username, etc.)
- Verifiable Consent: Consent that meets Rule 10 and Rule 11 requirements, especially for children and persons with disabilities
- Techno-Legal Measures: Combined technical and legal safeguards referenced in Rules 20 and 22
Rule 2 explains important terms used across the Rules:
- User Account: Any identifier used to access a service (email, mobile number, username, etc.)
- Verifiable Consent: Consent that meets Rule 10 and Rule 11 requirements, especially for children and persons with disabilities
- Techno-Legal Measures: Combined technical and legal safeguards referenced in Rules 20 and 22
Before collecting data, organisations must provide:
- A clear, standalone notice
- An itemised list of data being collected
- A specific purpose (no generic statements)
- A direct link for withdrawal of consent or grievances
Consent Managers must:
- Register within one year of the DPDP Rules coming into force
- Meet eligibility norms: Indian company, Rs 2 crore net worth, adequate technical capability
- Maintain consent records for 7 years
- Ensure shared data is unreadable
- Avoid conflicts of interest
Every organisation must implement:
- Encryption, masking, pseudonymisation/tokenisation
- Role-based access controls
- Logging and monitoring
- Regular backups
- One-year log retention even after user deletion requests
On detecting a breach, organisations must:
- Inform affected users and the Data Protection Board immediately
- Submit a detailed report within 72 hours
- Data must be deleted when the purpose is fulfilled
- Certain sectors must delete data if users stay inactive for a defined period
- 48-hour prior notice before data erasure
- Logs must still be kept for one year
If classified as an SDF, organisations must:
- Conduct DPIAs
- Appoint a senior-level DPO
- Perform periodic audits
- Maintain enhanced monitoring and governance
- Parental consent must be verifiable
- Must rely on approved ID proofs or virtual tokens
- Platforms must prevent fake parental consent
- Consent must come from a verified lawful guardian
- Must be validated under relevant Indian laws
Organisations must provide easy ways for users to:
- Access, correct, and erase their data
- File complaints
- A grievance officer must respond within 90 days.
- Personal data can be transferred outside India unless the Government restricts specific countries:
- Consent withdrawal must be simple, transparent, and as easy as giving consent.
These rules define upcoming Government standards for:
- Secure processing
- Algorithmic transparency
- Interoperable formats and record-keeping
- Government may request data for national security, legal compliance, etc.
- Organisations may be barred from informing users in certain cases
- Exemptions apply for research, archiving, and statistical work.
DPDP Compliance & Audit with Kratikal
Kratikal's structured, end-to-end approach helps your organisation achieve clear priorities, aligned teams, and effective implementation with measurable security outcomes.
Initiation & Scoping
Review business operations, network architecture, and data environments to define scope, stakeholders, systems, processes, and departments handling personal data.
Gap Assessment
Evaluate data flows, policies, consent, rights management, breach readiness, and third-party dependencies to identify gaps against DPDPA requirements.
Documentation Development
Develop organisation-specific policies, procedures, SOPs, and practical guides covering data protection, retention, consent management, and grievance handling requirements.
Implementation
Deploy ROPA, DPIAs, security safeguards, policies, DPO processes, transfer assessments, and employee training to embed compliance into daily operations.
Auditing & Continuous Compliance
Audit implemented controls, identify non-conformities, guide corrective actions, verify closure, and support sustained compliance with evolving DPDP Act requirements.
Why Do Organizations Need To Be DPDP Compliant?
DPDP compliance is a legal requirement, not a voluntary standard. It applies to any organisation that processes digital personal data in India, or offers goods or services to individuals in India. Substantive obligations apply from May 2027. The Rules give organisations 18 months from notification to prepare, so early starters get the most from that window.
Who Needs To Be DPDP Compliant?
BFSI, NBFCs and Fintech
Healthtech and Diagnostics
HR Tech and Staffing Platforms
E-commerce, Social Media and Online Gaming
SaaS Companies and IT Services Firms
Edtech and Platforms Handling Children's Data
Indian GCCs and Foreign Companies Serving Indian Users
Our Trust Block
Client Testimonials
We conducted the security audit through Kratikal Solutions, and the process was executed very effectively. The audit was thorough, and the findings were clear and actionable, reflecting a high standard of professionalism. We appreciate the detailed assessment and prompt responses throughout the activity.
We appreciate the detailed assessment and prompt responses throughout the activity. Your structured approach, timely coordination, and clarity in reporting helped us navigate the process efficiently. The findings and recommendations shared are insightful and will certainly assist us in strengthening our security posture.
Benefits
Lower Penalty Exposure
Documented safeguards reduce exposure to Rs 250 crore penalties.
Breach Response Readiness
Meet breach-reporting duties to the Board and individuals.
Customer Trust
Clear notices show customers how data is used.
Leaner Data Holdings
Retention limits shrink your breach surface.
Built on Your ISO 27001 Work
Extend your existing ISMS instead of duplicating.
FAQs
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's data protection law governing the processing of digital personal data. It establishes obligations for Data Fiduciaries and rights for Data Principals while setting requirements for lawful and secure data processing.
The DPDP Act applies to organisations that process digital personal data in India and certain organisations outside India when processing data in connection with offering goods or services to individuals in India.
Key DPDP requirements include providing clear notices, obtaining valid consent where required, enabling Data Principal rights, maintaining appropriate security safeguards, managing data retention, responding to breaches, and meeting additional obligations where applicable.
The Digital Personal Data Protection Rules, 2025 provide the operational framework for implementing obligations under the DPDP Act. They cover areas including notices, consent management, security safeguards, breach-related requirements, Data Principal rights, and obligations for certain organisations.
The DPDP Act and Rules have a phased commencement framework. Several Rules provisions take effect 18 months after their November 14, 2025 notification, while other provisions commenced earlier. Organisations should therefore prepare according to the specific commencement date applicable to each obligation.
A Data Fiduciary is an organisation that determines the purpose and means of processing personal data. It is responsible for meeting applicable obligations under the DPDP Act, including implementing appropriate security safeguards.
A Data Principal is the individual to whom personal data relates. The DPDP framework provides Data Principals with rights relating to their personal data, including access, correction, updating, erasure, and nomination, subject to applicable provisions.
Data Principals have rights that include access to information about their personal data, correction and updating, erasure, grievance redressal, and nomination. Organisations must establish processes to receive and respond to applicable requests.
The DPDP Act provides for financial penalties of up to Rs 250 crore for certain breaches, including failure to take reasonable security safeguards to prevent personal data breaches. Other violations carry different maximum penalties under the Act's Schedule.
A DPDP compliance audit evaluates an organisation's personal data processing practices, policies, controls, governance, consent mechanisms, security safeguards, rights-management processes, and breach readiness against applicable DPDP requirements.
Organisations can begin with data discovery and scoping, map personal data flows, assess existing controls, identify compliance gaps, develop required policies and procedures, implement safeguards, establish rights and breach-response processes, and conduct periodic audits.
Consent is a key basis for processing personal data where required under the Act. Organisations must provide clear information and enable individuals to give, manage, and withdraw consent in accordance with applicable requirements. The 2025 Rules also prescribe requirements for clear and standalone notices.
Yes. The DPDP Act can apply to organisations outside India when processing digital personal data in connection with offering goods or services to Data Principals in India, subject to the Act's scope and applicable provisions.
Depending on the organisation and processing activities, DPDP readiness may require privacy policies, notices, consent mechanisms, data inventories and processing records, retention procedures, rights-request workflows, breach-response procedures, security safeguards, DPIAs for relevant high-risk processing, vendor controls, and employee training.
Kratikal supports organisations through DPDP initiation and scoping, gap assessment, documentation development, implementation, and auditing. The approach helps identify compliance gaps, implement relevant controls, establish governance processes, and maintain ongoing DPDP readiness.