India DPDPA compliance, ready for 13 May 2027
The DPDP Rules, 2025 give Data Fiduciaries until 13 May 2027 for most obligations. Start mapping now.
India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 govern digital personal data processed in India, or processed abroad to offer goods and services there. The Rules were published on 13 November 2025 and phase in: Consent Managers from 13 November 2026, and most Data Fiduciary duties from 13 May 2027.
TL;DR
- Covers processing in India, and processing abroad that offers goods or services in India.
- Most obligations apply from 13 May 2027, eighteen months after the Rules were published.
- Breaches go to the Data Protection Board within 72 hours of becoming aware.
- Penalties reach INR 250 crore for failing to protect personal data.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
Sources: PIB, Government notifies DPDP Rules (14 November 2025)MeitY, Digital Personal Data Protection Rules, 2025
What does India's DPDP Act require?
The requirements below define India's DPDP Act. ComplyEasyAI maps your environment to each one.
Scope & roles
Confirm applicability (s.3), classify each activity as Data Fiduciary or Data Processor, and track the factors behind Significant Data Fiduciary designation (s.10).
Notice & consent
Free, specific, informed and unambiguous consent, preceded by a standalone plain-language notice and withdrawable as easily as it was given (ss.5–7).
Data Fiduciary duties
Reasonable security safeguards, accuracy, processor contracts, erasure once the purpose is served and grievance redressal (s.8, Rule 6).
Breach notification
Intimate affected Data Principals without delay and the Data Protection Board within 72 hours of becoming aware of a breach (s.8(6), Rule 7).
Children & Significant Data Fiduciaries
Verifiable parental consent and no tracking or targeted ads at children (s.9); an India-based DPO, independent audits and DPIAs for SDFs (s.10).
Data Principal rights & transfers
Access, correction, erasure, nomination and grievance rights (ss.11–14), and transfers only to territories the government has not restricted (s.16).
When do India DPDPA obligations apply?
- The Digital Personal Data Protection Act, 2023 is enacted.
- DPDP Rules, 2025 published; the Data Protection Board provisions (Rules 1, 2 and 17–21) apply immediately.
- Consent Manager registration and obligations apply (Rule 4).
- Remaining Rules apply: notice, security safeguards, breach intimation, erasure, children's data, Significant Data Fiduciary duties and Data Principal rights.
How do you prepare for India's DPDP Act?
Scope
Define the systems, boundaries and requirements your program will cover.
Connect your stack
Link cloud, identity, code and ticketing systems, read-only for evidence collection; controls are discovered and mapped.
Collect evidence
AI agents gather configuration and activity evidence on a schedule, building a versioned trail.
Monitor & remediate
Continuous monitoring flags drift the moment it happens and routes it to an owner.
Track effectiveness
Operating effectiveness is recorded over time, ready for your observation window.
Report & hand off
Organized, current evidence is packaged for auditors and stakeholders.
How does ComplyEasyAI automate India DPDPA compliance?
Control mapping
Your environment is mapped to each requirement, so you see exactly which control satisfies what.
Automated evidence
Integrations build a versioned, timestamped evidence trail instead of manual screenshots.
Continuous monitoring
Drift surfaces as soon as it happens, not during fieldwork.
Readiness dashboards
Real-time views highlight failing or unmapped controls with owners attached.
Multi-framework reuse
Shared controls are mapped once and reused across every framework you run.
Audit-ready reporting
Export organized, current evidence packages on demand.
Which frameworks are related to India's DPDP Act?
India DPDPA FAQ
When does the DPDP Act take effect?
In phases. The Data Protection Board provisions took effect when the Rules were published on 13 November 2025, Consent Manager rules apply from 13 November 2026, and the remaining obligations, including notice, security safeguards, breach intimation and Data Principal rights, apply from 13 May 2027. Check MeitY for any later amendment to these dates.
Does the DPDP Act apply to companies outside India?
Yes. It covers processing outside India that is connected with offering goods or services to Data Principals in India (s.3), so businesses serving Indian users are in scope wherever they are based.
How does it differ from GDPR?
Both rest on lawful grounds, notice, individual rights and breach notification, so much of the operational work overlaps. The DPDP Act is consent-centric with a short list of 'certain legitimate uses' (s.7) rather than a legitimate-interest ground, and it bans tracking and targeted advertising directed at children outright.
What is a Significant Data Fiduciary?
A Data Fiduciary the Central Government notifies based on the volume and sensitivity of data processed, risk to Data Principals and similar factors (s.10). SDFs must appoint an India-based Data Protection Officer and an independent data auditor and run a DPIA at least every twelve months.
How do you help?
The platform maps your processing to 44 controls citing the Act's sections and the 2025 Rules, tracks consent records, rights requests and breach timelines, and keeps the evidence continuously current.
Start your India DPDPA program.
Map the requirements, automate the evidence, stay audit-ready.