India DPDP Act
Enacted India · In force Nov 13, 2025 · next deadline Nov 13, 2026 (in 50 days)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
India's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.
- Who it applies to
- Processing of digital personal data in India, and processing outside India connected with offering goods or services to data principals in India. No revenue or volume threshold; Significant Data Fiduciaries (designated by the government on volume and risk) have extra duties (DPO in India, annual DPIA and audit).
- Penalties
- Schedule to the Act: up to INR 250 crore for failing to take reasonable security safeguards to prevent a breach; up to INR 200 crore for failing to notify a breach or breaching children's-data obligations; up to INR 150 crore for Significant Data Fiduciary obligations; up to INR 50 crore for other breaches. Imposed by the Data Protection Board.
- Enforced by
- Data Protection Board of India (MeitY)
- Official name
- Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025
- Citation
- Act No. 22 of 2023; DPDP Rules 2025 G.S.R. 846(E) (13 Nov 2025); Act commencement notification G.S.R. 843(E)
- Topics
- privacy, children, breach-notification
Research notes
Fact-check 2026-09-22 against the eGazette PDF: Gazette of India Extraordinary No. 760, Part II Section 3(i), dated Thursday 13 November 2025, G.S.R. 846(E). The eGazette ID CG-DL-E-14112025-267650 reflects upload on 14 Nov 2025, which is why some sources cite 14 Nov; the publication date is 13 Nov 2025. Rule 1(3) and 1(4) run 'one year' and 'eighteen months after the date of publication of this Gazette', giving 13 Nov 2026 and 13 May 2027. Corrigendum G.S.R. 892(E) of 11 Dec 2025 fixed wording only. MeitY consulted in early 2026 on shortening the 18-month runway to 12 months; not notified as of verification. The MeitY page is JavaScript-rendered and could not be read directly; dates come from the Rule 1 text in the gazette.
Related
Australia Cyber Security Act (ransomware reporting)Questions about India DPDP Act
- What are the India DPDP Act compliance deadlines?
- Nov 13, 2025: DPDP Rules published; Board and procedural rules in force. Nov 13, 2026: Consent Manager registration rule in force (12 months). May 13, 2027: Main data fiduciary obligations apply (18 months).
- When does India DPDP Act take effect?
- India DPDP Act took effect on Nov 13, 2025. The next milestone is Nov 13, 2026: Consent Manager registration rule in force (12 months).
- Who does India DPDP Act apply to?
- Processing of digital personal data in India, and processing outside India connected with offering goods or services to data principals in India. No revenue or volume threshold; Significant Data Fiduciaries (designated by the government on volume and risk) have extra duties (DPO in India, annual DPIA and audit).
- What are the penalties under India DPDP Act?
- Schedule to the Act: up to INR 250 crore for failing to take reasonable security safeguards to prevent a breach; up to INR 200 crore for failing to notify a breach or breaching children's-data obligations; up to INR 150 crore for Significant Data Fiduciary obligations; up to INR 50 crore for other breaches. Imposed by the Data Protection Board.