Compliance walkthrough
How to comply with India's DPDP Act 2023: video walkthrough
A walkthrough of building a compliance programme for India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
Key takeaways
- The DPDP Act covers digital personal data processed in India and some processing abroad.
- Processing needs a lawful purpose and either consent or a listed legitimate use.
- Notices must precede consent requests and explain rights and complaints.
- Significant Data Fiduciaries need an independent data auditor.
- Main obligations apply from May 2027 under the phased Rules.
India's data protection law and its vocabulary
The Digital Personal Data Protection Act, 2023 is India's data protection law, enacted on 11 August 2023. It governs digital personal data processed in India, whether collected online or on paper and digitised later, and reaches processing outside India connected with offering goods or services to people in India. Its vocabulary is its own: the Data Fiduciary decides the purpose and means of processing, the Data Processor processes on its behalf, and the Data Principal is the individual the data is about.
Processing needs a lawful purpose and one of two grounds: the Data Principal's consent, or a legitimate use listed in section 7. There is no certificate under the Act; the Data Protection Board of India inquires and penalises. This short film walks through how a programme is built.
Building the programme and keeping the proof
Set the boundaries first: the entities, systems and customer journeys that process digital personal data, the organisation's role in each as Data Fiduciary or Data Processor, and whether the Act reaches it from outside India. A gap analysis then compares current practice with the provisions that shape a programme.
Implementation builds a register of processing that records why each activity happens and on what ground, with the section 7 clause cited wherever consent is not relied on; notices that precede each consent request, telling people what data is collected and why, how they can exercise their rights and how they can complain to the Board; consent that can be withdrawn; reasonable security safeguards; breach handling and notification; erasure when data is no longer needed; and routes for Data Principals to exercise their rights. Significant Data Fiduciaries carry extra duties, such as appointing an independent data auditor and carrying out periodic impact assessments and audits. Commencement of the Act is phased under the DPDP Rules, 2025, with the main obligations applying from May 2027.
Sterling's expert and experienced consultants design and implement the programme with your team under Sterling OS™. Whether it is enough is judged by the Board when a complaint or breach reaches it, by an independent data auditor where one is required, and by clients; legal interpretation stays with your legal advisers.
DPDP Act 2023 (India) at a glance
- Purpose
- Data protection in India: digital personal data processed for a lawful purpose, on consent or a listed legitimate use, kept secure and erased when no longer needed
- Relevant to
- Any organisation processing digital personal data in India, and organisations abroad processing it in connection with offering goods or services to people in India
- Edition
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) with the DPDP Rules, 2025 of 13 November 2025; commencement is phased, with the main obligations from May 2027
- Certification
- None exists under the Act. The Data Protection Board of India inquires and penalises; Significant Data Fiduciaries add an independent data auditor and a yearly DPIA and audit
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for a DPDP Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
DPDP Act 2023 (India): questions people ask
Is there a DPDP Act certification?
No. The Act creates no certification scheme for organisations. Consent Managers register with the Data Protection Board of India and Significant Data Fiduciaries appoint an independent data auditor, but neither produces a certificate. A "DPDP certified" badge is a marketing claim. ISO/IEC 27701 certification from an accredited certification body can evidence a privacy management system, though it is not the same as legal compliance.
When do the DPDP Act's obligations apply?
In three phases under the notification of 13 November 2025: the definitions and the provisions establishing the Board on that date; Consent Manager registration one year later, in November 2026; and the remaining provisions, including notice, consent, safeguards, breach intimation, children's data, rights, transfers and penalties, eighteen months later, in May 2027. Section 43A of the Information Technology Act, 2000 is omitted only from that last date.
Does the Act apply to companies outside India?
Yes, where the processing is connected with offering goods or services to Data Principals in India (section 3). An overseas software, e-commerce or travel business serving people in India needs a lawful ground, safeguards, breach intimation and rights handling for that data.
We are an Indian BPO or IT company processing data for overseas clients. Does the Act apply?
Section 17(1)(d) disapplies most of the Act where a person based in India processes personal data of Data Principals outside India under a contract with a person outside India: Chapter II except sections 8(1) and 8(5), Chapter III and section 16 do not apply. Responsibility for compliance and the duty to take reasonable security safeguards remain, and your clients' own laws, such as the GDPR or HIPAA, still reach you through the contract. Data of people in India that you process is outside this exemption.
Do we need a Data Protection Officer?
Only a Significant Data Fiduciary must appoint one: a DPO based in India who represents it under the Act, is responsible to its board of directors and is the point of contact for grievances. Every Data Fiduciary must still publish the business contact of its DPO, if it has one, or of a person who can answer Data Principals' questions, and run a grievance mechanism.
Keep exploring
Related to this video
The complete guide
Everything on DPDP Act 2023 (India)
Start with the DPDP Act 2023 (India) page, or go straight to the guide you need.
On the DPDP Act 2023 (India) page
More videos: Privacy and data protection
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
- HIPAA requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
Talk to a consultant
Plan your DPDP Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice