// FAQ
DPDP Act Common Questions
Straight answers to the questions Indian businesses ask most about the Digital Personal Data Protection Act, 2023.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (DPDPA) is India's primary law governing how organizations collect, process, and store the personal data of individuals in India. It sets out obligations for "Data Fiduciaries" (organizations that determine why and how personal data is processed) and rights for "Data Principals" (the individuals the data belongs to), including consent requirements, data-breach notification duties, and rules for cross-border data transfer.
What is the DPDP compliance deadline?
The DPDPA 2023 was enacted in August 2023, but its provisions come into force in phases as the Digital Personal Data Protection Rules are notified by the Indian government. Organizations should not wait for the final compliance deadline to act — building consent management, breach-notification processes, and a compliant privacy notice takes time, and enforcement can begin as soon as the relevant rules are notified. Check the Ministry of Electronics and Information Technology (MeitY) for the current notification status of specific provisions.
What is the DPDP penalty for non-compliance?
The DPDPA 2023 provides for financial penalties of up to ₹250 crore (2.5 billion INR) for a single instance of a data breach caused by a failure to implement reasonable security safeguards, with a schedule of lower penalty tiers for other violations such as failing to notify the Data Protection Board of a breach, or non-compliance with obligations specific to children's data. Penalties are assessed by the Data Protection Board of India based on the nature, gravity, and duration of the breach.
Who is a data fiduciary under DPDP?
A Data Fiduciary is any person or organization — alone or jointly with others — that determines the purpose and means of processing personal data. In practice, this is any business, app, or platform that decides why it is collecting personal data and how it is used, as opposed to a "Data Processor," which processes data only on the Fiduciary's instructions. Most businesses operating in India that collect customer, employee, or user data are Data Fiduciaries under the Act.
This is a general informational summary, not legal advice. For a compliance assessment specific to your organization, run a free scan or get in touch.