Businesses covered by India’s Digital Personal Data Protection Act (DPDP Act) need to know what personal data they handle and why, give clear notices, manage consent where they rely on it, protect data, respond to rights requests and grievances, and set workable retention and breach-response procedures. Extra requirements can apply to children’s data and to businesses notified as Significant Data Fiduciaries. The Act and its Rules use phased commencement, so check the latest official notifications before treating a particular duty as in force.
Does the DPDP Act apply to my business?
The Act covers digital personal data processed in India if it was collected digitally or collected in non-digital form and later digitised. It can also cover processing outside India when connected with offering goods or services to people in India. The Act contains exclusions, so assess the data and processing in question rather than assuming every organisation or dataset is covered. See the Digital Personal Data Protection Act, 2023.
As an Amazon Associate I earn from qualifying purchases.
The organisation that determines the purpose and means of processing is a Data Fiduciary; the person the data relates to is a Data Principal. A Data Fiduciary may use a Data Processor, but remains responsible for meeting its duties for processing it carries out itself or through a processor.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat should a business do to comply?
Start by mapping the business’s actual data flows, then assign owners and processes for notices, consent, security, rights, retention and complaints. These workstreams support one another: for example, a business cannot explain its purposes clearly or decide when to erase data without first understanding what it collects and uses.
#1 Best Overall
1. Map data, purposes, recipients and retention
- Record the personal data collected, the purpose or purposes for processing it, where it comes from, who it is shared with, and which processors handle it.
- Set a retention period or identify the legal requirement that calls for longer retention. Use purpose and legal obligations to guide deletion decisions, rather than adopting one blanket period for every dataset.
- Use the inventory to check whether each use has a lawful basis and whether notices, security controls and rights processes reflect what actually happens.
The Act ties processing to a lawful basis and specified purpose. The Rules require notices to itemise personal data and describe the specified purpose or purposes.
2. Give a clear notice and manage consent
When consent is the basis for processing, provide a notice that is clear, specific, informed and understandable on its own. Under Rule 3(a), it must be understandable independently of other information made available by the Data Fiduciary. The notice should itemise the personal data and describe the purposes and the goods, services or uses enabled by processing. It must also explain how the person can withdraw consent, exercise rights and complain to the Board. The final Digital Personal Data Protection Rules, 2025 set out these notice requirements.
- Make withdrawal of consent as easy as giving it.
- Keep records that can demonstrate the notice given and consent obtained. Where consent is the basis and the question arises in proceedings, the Data Fiduciary bears the burden of proving notice and consent.
- Do not treat consent to one stated purpose as permission for unrelated or indefinite reuse.
The Act also permits specified “legitimate uses.” One example is certain cases where a person voluntarily provides personal data for a specified purpose and has not indicated that they do not consent. This is conditional, not blanket authority to reuse the data; check the Act and Rules against the particular use.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
3. Put security safeguards and breach response in place
Use reasonable security safeguards to prevent personal data breaches, including when a processor handles data on the business’s behalf. The Act requires notification to the Board and affected Data Principals if a breach occurs, in the form and manner prescribed. A practical response plan should identify affected data and people, provide a way to escalate incidents, and enable coordination with processors so the required notifications can be made under the applicable Rules.
The Act and Rules govern the notification requirements; do not assume a universal deadline without checking the applicable final text and circumstances. The Act’s security duty appears in section 8(5) of the DPDP Act.
4. Set retention and erasure rules
Erase personal data when its purpose is no longer served or consent is withdrawn, unless retention is still necessary for the specified purpose or required by another law. The Rules add particular retention requirements and inactivity-based periods, so the schedule must account for both the reason to erase and any applicable reason to retain.
- The Rules generally require preserving personal data and related processing logs for at least one year for specified security and legal purposes. After that, they are to be erased unless another law or government requirement calls for longer retention.
- The Rules prescribe a three-year inactivity-based period for certain large entities: e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh users, and social-media intermediaries with at least two crore users. The relevant categories, thresholds, exceptions and timing in the Rules matter; this is not a universal three-year retention rule for all businesses.
These periods are requirements in the Government of India’s 2025 Rules, not general estimates. Check the Rules for the precise conditions and exceptions before applying them to a particular service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Support rights requests and grievances
Data Principals have rights to access information about processing and sharing, request correction, completion, updating and erasure, seek grievance redressal, and nominate another person. Publish contact information for the Data Protection Officer, if applicable, or another person able to answer questions about processing. Provide a readily available grievance mechanism and a way to track requests and responses. A person generally must first use the organisation’s grievance mechanism before approaching the Board. Section 8(10) of the Act requires an effective mechanism to redress grievances.
6. Apply additional controls to children’s data
Before processing a child’s personal data, or personal data of a person with a disability who has a lawful guardian, obtain verifiable consent from the parent or lawful guardian, as applicable. The Act also restricts processing likely to harm a child’s well-being, tracking or behavioural monitoring of children, and targeted advertising directed at children, subject to prescribed exemptions and government notifications. Check the final Rules and relevant notifications for the service; do not assume an age threshold or exemption.
7. Check whether the business has been notified as an SDF
The Central Government may notify an organisation or class of organisations as a Significant Data Fiduciary (SDF), taking account of factors such as the volume and sensitivity of data, risks to individuals, and effects on national interests and public order. An SDF has additional duties, including an India-based Data Protection Officer responsible to its governing body, an independent data auditor, and periodic data protection impact assessments and audits. Size alone does not establish SDF status; check official notifications.
8. Cover processors and cross-border transfers
Contracts and operational controls should let the Data Fiduciary meet its duties when a processor handles personal data. Identify which processors receive data and ensure incident escalation, security and deletion processes work across those arrangements.
The Act permits transfers outside India subject to restrictions the Central Government may specify, including requirements concerning making data available to a foreign state or its entities. The Act and Rules reviewed here do not establish a blanket localisation rule. Check current government restrictions and any sector-specific requirements for each transfer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When do the DPDP Rules come into force?
The Rules were notified on 13 November 2025 and provide for staged commencement. The schedule below is the one stated in the published Rules; MeitY’s document listing also identifies a corrigendum dated 16 December 2025 and an enforcement timeline. Check those official materials and any later notifications before relying on a date as the complete current schedule.
| Rules | Commencement stated in the published Rules |
|---|---|
| Rules 1, 2 and 17–21 | On publication, 13 November 2025. |
| Rule 4 | One year after publication. |
| Rules 3, 5–16, 22 and 23 | Eighteen months after publication. |
The broad notice, security, breach, retention, rights and transfer duties are in provisions with staged commencement. The MeitY Rules listing identifies the subsequent corrigendum and an enforcement timeline; consult the official listing and documents for the current position.
How should a business organise its implementation?
There is no single compliance product mandated by these sources. A business can use internal processes, outside advisers or a privacy operations platform, but it remains responsible for its obligations. Evaluate any approach against whether it:
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
- fits the organisation’s actual data and stated purposes;
- can evidence consent and make withdrawal accessible where consent is used;
- covers processors and supports security incident coordination;
- handles retention, deletion and legal holds;
- supports rights requests and grievances; and
- can be updated as India-specific requirements and notifications change, at an acceptable integration effort and cost.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
