Two-minute brief
India's DPDP Act 2023 requirements explained: video brief
A two-minute brief on the provisions of India's Digital Personal Data Protection Act, 2023 that shape a compliance programme.
Key takeaways
- Processing needs a lawful purpose and consent or a section 7 legitimate use.
- Every consent request is preceded by a notice.
- Data Fiduciaries must secure data, notify breaches and erase data when its purpose is served.
- Data Principals have rights including correction, erasure and grievance redressal.
- The Data Protection Board of India enforces the Act.
Grounds, notice and consent
The Digital Personal Data Protection Act, 2023 has 44 sections in nine chapters and a Schedule of penalties; the DPDP Rules, 2025, published on 13 November 2025, add the procedure. This short film maps the provisions that shape a programme.
Sections 4 and 7 set the grounds for processing: personal data may be processed only for a lawful purpose, on consent or on a legitimate use listed in section 7, such as data voluntarily provided for a specified purpose, legal disclosure obligations, compliance with judgments or orders, medical emergencies and certain employment purposes. In practice that means a processing register recording the purpose and ground of each activity. Sections 5 and 6 cover notice and consent: each consent request is preceded by a notice of the personal data, the purpose, how to exercise rights and how to complain to the Board, available in English or a language of the Eighth Schedule, and consent must be free, specific, informed and capable of withdrawal.
Duties, rights and enforcement
Data Fiduciaries must ensure accuracy where data is used for decisions, protect personal data with reasonable security safeguards, notify personal data breaches, erase data when the purpose is served unless retention is required by law, and publish contact details for questions. Processing of children's data carries additional conditions involving parents or lawful guardians. Data Principals have rights to information, correction and erasure, grievance redressal and nomination. Significant Data Fiduciaries add an independent data auditor and a periodic data protection impact assessment and audit.
The Data Protection Board of India inquires into complaints and breaches and can impose penalties set out in the Schedule. Commencement is phased, with the main obligations applying from May 2027. The Act applies to organisations processing digital personal data in India and to organisations abroad processing it in connection with offering goods or services to people in India. There is no certification under the Act, and legal interpretation stays with your legal advisers.
DPDP Act 2023 (India) at a glance
- Purpose
- Data protection in India: digital personal data processed for a lawful purpose, on consent or a listed legitimate use, kept secure and erased when no longer needed
- Relevant to
- Any organisation processing digital personal data in India, and organisations abroad processing it in connection with offering goods or services to people in India
- Edition
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) with the DPDP Rules, 2025 of 13 November 2025; commencement is phased, with the main obligations from May 2027
- Certification
- None exists under the Act. The Data Protection Board of India inquires and penalises; Significant Data Fiduciaries add an independent data auditor and a yearly DPIA and audit
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for a DPDP Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
DPDP Act 2023 (India): questions people ask
Is there a DPDP Act certification?
No. The Act creates no certification scheme for organisations. Consent Managers register with the Data Protection Board of India and Significant Data Fiduciaries appoint an independent data auditor, but neither produces a certificate. A "DPDP certified" badge is a marketing claim. ISO/IEC 27701 certification from an accredited certification body can evidence a privacy management system, though it is not the same as legal compliance.
When do the DPDP Act's obligations apply?
In three phases under the notification of 13 November 2025: the definitions and the provisions establishing the Board on that date; Consent Manager registration one year later, in November 2026; and the remaining provisions, including notice, consent, safeguards, breach intimation, children's data, rights, transfers and penalties, eighteen months later, in May 2027. Section 43A of the Information Technology Act, 2000 is omitted only from that last date.
Does the Act apply to companies outside India?
Yes, where the processing is connected with offering goods or services to Data Principals in India (section 3). An overseas software, e-commerce or travel business serving people in India needs a lawful ground, safeguards, breach intimation and rights handling for that data.
We are an Indian BPO or IT company processing data for overseas clients. Does the Act apply?
Section 17(1)(d) disapplies most of the Act where a person based in India processes personal data of Data Principals outside India under a contract with a person outside India: Chapter II except sections 8(1) and 8(5), Chapter III and section 16 do not apply. Responsibility for compliance and the duty to take reasonable security safeguards remain, and your clients' own laws, such as the GDPR or HIPAA, still reach you through the contract. Data of people in India that you process is outside this exemption.
Do we need a Data Protection Officer?
Only a Significant Data Fiduciary must appoint one: a DPO based in India who represents it under the Act, is responsible to its board of directors and is the point of contact for grievances. Every Data Fiduciary must still publish the business contact of its DPO, if it has one, or of a person who can answer Data Principals' questions, and run a grievance mechanism.
Keep exploring
Related to this video
The complete guide
Everything on DPDP Act 2023 (India)
Start with the DPDP Act 2023 (India) page, or go straight to the guide you need.
On the DPDP Act 2023 (India) page
More videos: Privacy and data protection
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
- HIPAA requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
Talk to a consultant
Plan your DPDP Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice