DPDP Act 2023 Compliance Guide: Rules, Deadlines, and Penalties for Indian Businesses (2026)

Last verified: March 2026. This post is updated as new rules and enforcement actions are announced. Bookmark it.

If your business collects personal data of anyone in India — a customer’s phone number, an employee’s Aadhaar, a user’s email address — you are now subject to India’s first comprehensive data protection law. The Digital Personal Data Protection Act, 2023 (DPDP Act) received Presidential assent in August 2023, and the DPDP Rules were notified on November 13, 2025. The clock is ticking: full compliance is required by May 13, 2027, and penalties for violations reach up to Rs 250 crore per instance.

This guide breaks down every obligation under the DPDP Act, the three-phase implementation timeline, the specific requirements for Significant Data Fiduciaries, the consent manager framework, children’s data rules, the penalty schedule, and a step-by-step compliance checklist your business can start following today.

What Is the DPDP Act and Why It Matters Right Now

The Digital Personal Data Protection Act, 2023 governs how organisations collect, process, store, and share personal data of individuals in India. It applies to all digital personal data processed within India and to processing outside India if it relates to offering goods or services to individuals in India. The Act introduces a framework built around three key roles: Data Fiduciaries (organisations that determine the purpose and means of processing personal data), Data Processors (those who process data on behalf of fiduciaries), and Data Principals (individuals whose personal data is being processed).

The reason 2026 is the critical compliance year is straightforward. Phase 1 of the DPDP Rules became active on November 13, 2025, establishing the Data Protection Board and activating the penalty framework. Phase 2 activates on November 13, 2026, opening Consent Manager registration and expanding enforcement powers. Phase 3 — full substantive compliance — is mandatory from May 13, 2027. Every organisation must have its consent infrastructure, breach notification systems, privacy notices, children’s data protections, and Data Principal rights mechanisms fully operational within the next fourteen months.

The Act applies to your business if you process digital personal data in any form — whether you are a startup with ten users, a listed company with millions of customers, a hospital storing patient records digitally, or a SaaS platform serving Indian clients from abroad. The only exemptions are personal data processed for purely personal or domestic purposes and data made publicly available by the Data Principal or under any law.

The Three-Phase Implementation Timeline

The DPDP Rules follow a phased rollout designed to give organisations time to build compliance infrastructure. Each phase brings new obligations into force, and missing a phase deadline does not exempt you from its requirements.

Phase 1 became active on November 13, 2025. This phase established the Data Protection Board of India with its headquarters in the National Capital Region. The Board now has the authority to hear complaints from Data Principals, investigate non-compliance, and impose penalties. The administrative machinery of the Act is fully operational. If a data breach occurs today, the Board can investigate and penalise.

Phase 2 activates on November 13, 2026. This phase opens the registration framework for Consent Managers — intermediary platforms that manage consent on behalf of Data Principals. It also activates the Board’s full inquiry powers into consent management breaches. After this date, any entity operating as a Consent Manager without registration faces enforcement action.

Phase 3 is the hard deadline: May 13, 2027. By this date, every Data Fiduciary must have fully operational systems for issuing privacy notices before collecting data, obtaining and recording valid consent, enabling consent withdrawal that is as simple as giving consent, detecting and reporting breaches to the Board and affected individuals, responding to Data Principal rights requests (access and erasure), implementing children’s data protections, and maintaining records as prescribed by the Rules.

The penalty framework is already active. Waiting until 2027 to begin compliance work is not an option — the Data Protection Board can already investigate and penalise breaches of the provisions that are currently in force.

Key Obligations for Every Data Fiduciary

Every organisation that qualifies as a Data Fiduciary under the DPDP Act — which includes virtually any business processing personal data digitally — must comply with a set of baseline obligations. These apply regardless of your size, sector, or whether you are designated as a Significant Data Fiduciary.

Privacy Notice Requirements

The privacy notice obligation is foundational. Before collecting personal data based on consent, you must provide a clear, standalone notice in plain language explaining exactly what personal data you are collecting, the specific purpose for which you are processing it, how the Data Principal can exercise their rights under the Act, and how they can file a complaint with the Data Protection Board. This notice cannot be buried in a terms-of-service document. It must be a separate, clearly identifiable communication provided before or at the time of data collection. Internal links: see our guide on privacy notice drafting for templates and formats.

Consent Collection and Withdrawal

Consent under the DPDP Act must meet five conditions: it must be free, specific, informed, unconditional, and unambiguous. General or bundled consent — the “I agree to all terms” checkbox that covers data collection along with twenty other unrelated conditions — does not satisfy the Act’s requirements. Each purpose of processing requires separate, specific consent. Critically, the mechanism you provide for withdrawing consent must be as simple as the mechanism through which consent was originally given. If a user can consent with one click, they must be able to withdraw with one click.

Data Breach Notification

Data breach notification requirements are among the most operationally demanding provisions. When a personal data breach occurs, you must notify both the Data Protection Board and every affected Data Principal. The Rules require notification to be made promptly — and while the exact timeframe is described as “without unreasonable delay,” industry practice and the Board’s expectations are converging around 72 hours as the working standard. Your notification must include the nature of the breach, the types of personal data affected, the likely consequences, and the measures you are taking to address it.

Data Retention and Erasure

Personal data must not be retained longer than necessary to fulfill the purpose for which it was collected. Once the purpose is served or the Data Principal withdraws consent, the data must be erased — unless retention is required by another law. You must establish clear retention schedules and automated deletion mechanisms. Data fiduciaries must also engage Data Processors only through a valid data processing agreement that clearly defines the scope, purpose, and methods of processing.

Grievance Redressal Mechanism

Every Data Fiduciary must establish a grievance redressal mechanism. Data Principals must have a clear channel to raise complaints about how their data is being processed, and you must respond within the timeframe prescribed by the Rules. Failing to maintain an accessible grievance mechanism is itself a compliance violation.

Significant Data Fiduciary: Enhanced Obligations That Apply to Large Processors

The DPDP Act creates a category of enhanced obligations for organisations designated as Significant Data Fiduciaries (SDFs). The Central Government identifies SDFs based on the volume and sensitivity of personal data they process, the risk their processing poses to Data Principals’ rights, and other criteria it may notify. While the formal notification of specific SDFs is pending, the criteria suggest that large technology companies, financial institutions, healthcare networks, telecom operators, and government bodies processing citizen data at scale will likely be included.

Data Protection Officer Appointment

If designated as an SDF, you must appoint a Data Protection Officer (DPO) who is based in India. The DPO serves as the primary point of contact for the Data Protection Board and for Data Principals exercising their rights. This is not a part-time or add-on role — the DPO must have sufficient authority, independence, and resources to oversee compliance effectively. For the specific DPO skills employers are looking for, see our dedicated guide.

Annual Data Protection Impact Assessment (DPIA)

SDFs must conduct a Data Protection Impact Assessment (DPIA) at least once every twelve months. The DPIA must evaluate the risks that your data processing activities pose to Data Principals’ rights and document the measures you have implemented to mitigate those risks. This is not a one-time paperwork exercise — it must be repeated annually and updated whenever you introduce new processing activities.

Independent Data Auditor

Alongside the DPIA, SDFs must engage an independent data auditor to audit compliance with the Act and Rules annually. The auditor must verify that your technical and organisational measures are effective, your consent mechanisms are functioning as required, your breach notification systems are operational, and your data retention and erasure practices are compliant.

Algorithmic Oversight and Data Localisation

SDFs face an additional obligation around algorithmic oversight. If you use algorithmic or automated decision-making systems that process personal data, you must take measures to ensure that these systems do not pose risks to Data Principals’ rights. This includes verifying that your AI and machine learning systems are not making decisions that unfairly disadvantage individuals based on their personal data. Data localisation requirements also apply specifically to SDFs — the Central Government may require certain categories of personal data processed by SDFs to be stored and processed within India, with restrictions on cross-border transfer.

The Consent Manager Framework

The DPDP Act introduces a novel concept: Consent Managers. These are registered intermediaries that enable Data Principals to manage their consent across multiple Data Fiduciaries through a single platform. Think of it as a centralised consent dashboard where an individual can view, grant, modify, and withdraw consent given to various organisations.

The registration requirements are deliberately restrictive. To register as a Consent Manager with the Data Protection Board, an entity must be a company incorporated in India, have a minimum net worth of Rs 2 crore, obtain independent certification for platform interoperability and technical security measures, and ensure that its directors and key personnel have no conflicts of interest with any Data Fiduciary. This means global consent management platforms — including foreign-incorporated companies — cannot register as Consent Managers under the DPDP Act unless they establish qualifying Indian subsidiaries.

Consent Managers face strict operational obligations. They cannot sub-contract their consent management functions. They must maintain records of all consents, notices, and data-sharing activities for a minimum of seven years. They must ensure their platforms are interoperable with the systems of Data Fiduciaries. And they must avoid any conflict of interest that could compromise their neutrality in managing consent on behalf of Data Principals.

For businesses, the practical implication is significant. If you currently use a foreign consent management platform, you may need to migrate to a registered Indian Consent Manager after Phase 2 activates in November 2026 — or build internal consent management capabilities that meet the Act’s requirements.

Children’s Data Protection

The DPDP Act sets the age of digital consent at 18 years, which is higher than most comparable international frameworks. Any processing of personal data belonging to a child (under 18) requires verifiable consent from a parent or lawful guardian.

The Act imposes three specific prohibitions on children’s data processing. No Data Fiduciary may engage in behavioural monitoring of children — tracking their online behaviour for profiling purposes. No Data Fiduciary may direct targeted advertising at children based on their personal data. And no Data Fiduciary may process children’s data in any manner that is detrimental to the well-being of the child.

The mechanism for verifiable parental consent has not been fully specified in the Rules. The Rules provide that parents or guardians can give consent through existing information, details they provide, or virtual tokens issued by authorised entities. However, the operational implementation — how a platform actually verifies that the person giving consent is indeed the child’s parent — remains an area where businesses will need to develop solutions as guidance evolves. The Central Government has the power to exempt certain classes of Data Fiduciaries from these children’s data provisions, but no such exemptions have been notified as of March 2026.

Cross-Border Data Transfers

The DPDP Act takes a negative-list approach to cross-border data transfers. Personal data can be transferred to any country except those specifically restricted by the Central Government through notification. As of March 2026, no countries have been placed on the restricted list, which means cross-border data transfer rules under DPDP currently permit transfers to all jurisdictions subject to the conditions of the Act.

However, this permissive default comes with conditions. The Central Government retains the power to restrict transfers to specific countries at any time, and such restrictions could be imposed with relatively short notice. For Significant Data Fiduciaries, additional localisation requirements may apply — certain categories of personal data may need to be stored within India, with traffic data not permitted to leave the country.

The Rules provide for the Central Government to constitute a committee to recommend which categories of personal data should be subject to localisation. This committee has not yet been formed. Businesses should monitor this space closely, as a notification restricting transfers to certain countries or requiring localisation of specific data categories could require rapid architectural changes to data infrastructure.

Penalty Schedule: What Non-Compliance Actually Costs

The DPDP Act’s penalty framework is designed to make non-compliance financially painful. The Data Protection Board determines penalties based on the nature, gravity, and duration of the breach, the type of personal data affected, whether the breach was repeated, and the fiduciary’s efforts to mitigate harm.

For context, the GDPR’s maximum penalty is 4% of global annual turnover or EUR 20 million, whichever is higher. The DPDP Act’s Rs 250 crore cap (approximately USD 30 million) is a fixed ceiling rather than a turnover-based calculation. For smaller companies, the DPDP Act penalties could be proportionally more severe than GDPR fines. These are maximum limits, not automatic fines. The Board conducts an investigation before determining the penalty amount. However, the investigation and penalty mechanism is already active under Phase 1.

Step-by-Step Compliance Checklist for 2026

Compliance with the DPDP Act is not a single action — it is a phased process that should be structured across four stages running from now through 2027.

DPDP Act vs GDPR: Key Differences for Indian Businesses

Indian businesses that already comply with the EU’s General Data Protection Regulation may assume that GDPR compliance automatically satisfies DPDP requirements. This is not the case. While the two frameworks share principles, they differ in several critical ways that affect how you structure compliance.

The GDPR provides six legal bases for processing, including legitimate interest, which allows processing without consent in certain circumstances. The DPDP Act is more restrictive: processing is lawful only with consent or for certain legitimate uses specifically defined in the Act (such as employment, medical emergencies, or compliance with court orders). There is no broad “legitimate interest” basis under Indian law.