DPDP Act 2023 · India's Digital Personal Data Protection Act

DPDP Act compliance consulting for consent, rights and breach response that stand up to India's Data Protection Board.

Get ready for India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 before the main obligations apply in May 2027: consent you can prove, safeguards with logs kept for a year, breach details with the Board within 72 hours and rights requests answered within 90 days. Sterling's expert and experienced consultants build the programme with your legal, product and technology teams, prepare the evidence and stay with you once it is running, in 60+ countries. We ensure a successful DPDP Act compliance programme for our clients.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced data protection consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is assessed by the Data Protection Board of India and, for Significant Data Fiduciaries, an independent data auditor

DPDP Act at a glance

Purpose: Data protection in India: digital personal data processed for a lawful purpose, on consent or a listed legitimate use, kept secure and erased when no longer needed
Relevant to: Any organisation processing digital personal data in India, and organisations abroad processing it in connection with offering goods or services to people in India
Edition: Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) with the DPDP Rules, 2025 of 13 November 2025; commencement is phased, with the main obligations from May 2027
Certification: None exists under the Act. The Data Protection Board of India inquires and penalises; Significant Data Fiduciaries add an independent data auditor and a yearly DPIA and audit
Sterling's role: Programme design and consulting with your team, Effivity, training, internal audit and review readiness, then Sustain™
Cost and timing: Total investment for a DPDP Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months

8,100+ client engagements in 60+ countries.

DPDP Act client experience

What it is

What is the DPDP Act and what does it require?

The Digital Personal Data Protection Act, 2023 is India's data protection law, enacted on 11 August 2023 as Act No. 22 of 2023. It governs digital personal data processed in India, whether collected online or on paper and digitised later, and reaches processing outside India that is connected with offering goods or services to people in India. Its vocabulary is its own: the Data Fiduciary decides the purpose and means of processing, the Data Processor processes on its behalf, and the Data Principal is the individual the data is about, including the parents or lawful guardian of a child.

Processing needs a lawful purpose and one of two grounds: the Data Principal's consent, or a legitimate use listed in section 7. Data Fiduciaries must give notice, keep reasonable security safeguards, intimate every personal data breach to the Data Protection Board of India and to each affected person, erase data once the purpose is served and run a grievance mechanism. Penalties reach INR 250 crore for failing to take reasonable security safeguards.

No certificate proves DPDP compliance. Section 8(1) makes the Data Fiduciary responsible for complying with the Act, including for processing its Data Processors carry out. A working programme is a set of decisions, notices, consent records, contracts, safeguards and procedures with evidence that they operate, tested whenever a Data Principal complains, a breach occurs or a client runs due diligence.

Current text and commencement. The Act commences in phases under notification G.S.R. 843(E) of 13 November 2025, issued with the DPDP Rules, 2025 (G.S.R. 846(E)). The definitions and the provisions establishing the Data Protection Board of India took effect that day; Consent Manager registration follows one year after publication, in November 2026; the remaining provisions, including the duties of Data Fiduciaries, the rights of Data Principals, the Board's inquiry powers and penalties, take effect eighteen months after publication, in May 2027, when section 43A of the Information Technology Act, 2000 is omitted. These are the dates as notified; check for any later notification before each milestone. DPDP Act and Rules: what applies when

Who it is for

Who needs to comply with the DPDP Act?

Scope turns on where processing happens and whom it serves, not on headcount; section 17(3) lets the Central Government exempt notified classes of Data Fiduciaries, startups among them, from some obligations. Organisations come to Sterling from four starting points:

You collect personal data from customers, patients, students or staff in India. Banks, hospitals, schools, retailers, apps and employers all process digital personal data, and from May 2027 every purpose needs a lawful ground and safeguards. Section 7 names certain employment purposes among the legitimate uses, so not every HR activity runs on consent.
You serve people in India from outside the country. A software provider in Dubai, an online retailer in Singapore or a travel platform in Europe that offers goods or services to people in India falls within section 3 for that processing, wherever its servers sit.
Your Indian clients want contract terms and evidence. A Data Fiduciary may use a Data Processor only under a valid contract and remains responsible for what the processor does, so IT service, cloud and BPO providers are asked for safeguards, log retention, breach notice and erasure commitments in writing.
You may be notified as a Significant Data Fiduciary. The Government designates SDFs on factors including the volume and sensitivity of personal data and the risk to Data Principals. Designation adds a Data Protection Officer based in India, an independent data auditor and, under the Rules, a DPIA and an audit every twelve months, reported to the Board.

Business benefits

How DPDP Act compliance supports trust and business control

The programme earns its cost where personal data meets pressure: a sign-up screen in your app, a vendor audit, a phishing incident, an employee asking what the company holds about her. We give each of those moments an owner, a procedure and a record.

Consent that holds upNotices itemised by purpose, consent given by a clear affirmative action, withdrawal as simple as sign-up, and a record of what each person agreed to.
Breaches intimated on timeA procedure that tells affected people without delay and gets the details to the Board within 72 hours, with roles, templates and a rehearsal behind it.
Rights handled inside the limitAccess, correction, erasure and nomination requests, and grievances, logged and closed within the ninety days the Rules allow.
Contracts your clients signProcessor terms covering safeguards, log retention, breach notice and erasure, so due-diligence reviews by Indian clients move quickly.
Lower penalty exposureSafeguards, breach intimation and children's data carry the Schedule's highest maximums; timely, effective mitigation is one of the factors the Board weighs under section 33(2).
One programme for several lawsThe same inventory, notices, contracts and controls extended to the GDPR, the Philippine Data Privacy Act or the UAE's personal data law, with differences recorded by jurisdiction.

Requirements

What are the main DPDP Act requirements?

The Act has 44 sections in nine chapters and a Schedule of penalties; the Rules add the procedure. The table maps the provisions that shape a programme to practice; legal interpretation stays with your legal advisers.

Section	What it requires of you	What it looks like in practice
Sec. 4 and 7 Grounds for processing	Process personal data only for a lawful purpose, on consent or on a legitimate use listed in section 7, such as data voluntarily provided for a specified purpose, legal disclosure obligations, compliance with judgments or orders, medical emergencies and certain employment purposes	A processing register recording the purpose and ground of each activity, citing the section 7 clause wherever consent is not relied on
Sec. 5 and 6 Notice and consent	Precede each consent request with a notice of the personal data, the purpose, how to exercise rights and how to complain to the Board, accessible in English or a language of the Eighth Schedule to the Constitution; obtain consent that is free, specific, informed, unconditional and unambiguous; allow withdrawal with comparable ease, directly or through a Consent Manager registered with the Board; give notice as soon as reasonably practicable for data consented to before commencement	Notices per journey (app, website, branch, HR) with language options, consent captured with wording and timestamp, a working withdrawal route and a plan for legacy consents
Sec. 8 General obligations of Data Fiduciary	Stay responsible for processing by Data Processors, engaged only under a valid contract; keep data complete, accurate and consistent when it drives decisions or is shared; take reasonable security safeguards; intimate breaches; erase data when consent is withdrawn or the purpose is no longer served, unless a law requires retention; publish a contact for questions; run a grievance mechanism	Processor contracts with safeguard, breach and erasure terms, a retention schedule, a published contact point and a logged grievance procedure
Rules 6 to 8 Safeguards, breach intimation and erasure	Apply safeguards including encryption, masking or virtual tokens, logs, monitoring and review, keeping logs for at least one year; inform affected Data Principals without delay and give the Board the details of a breach within 72 hours; large e-commerce, online gaming and social media platforms in the Third Schedule erase data after three years of inactivity, with 48 hours' notice	A safeguards baseline, commonly aligned in practice with ISO/IEC 27001; log-retention settings; a breach procedure with the 72-hour clock, templates and a register; erasure that leaves evidence
Sec. 9 Children and persons with disability	Obtain verifiable consent from the parent of a child (under 18) or the lawful guardian of a person with disability before processing their data; do not track, behaviourally monitor or target advertising at children; Rule 10 sets how consent is verified, with limited exemptions, for example for healthcare and education	Age gating, a parental verification method, analytics and advertising settings reviewed for minors, and any exemption documented
Sec. 10 Significant Data Fiduciaries	If notified, appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic DPIAs and audits; Rule 13 sets a DPIA and an audit every twelve months with a report of material observations to the Board, due diligence on algorithmic software and specified personal data kept within India	A DPO answerable to the board of directors, an annual DPIA and audit calendar, algorithm checks and a register of data that must stay in India
Sec. 11 to 15 Rights and duties of Data Principals	Let people obtain a summary of their personal data and the identities of those it was shared with; correct, complete, update and erase it; use a grievance route, which they must exhaust before approaching the Board; and nominate someone to act on their death or incapacity. The Rules set a response period of no more than 90 days	Published means of making requests, identity checks, one log for requests and grievances with the 90-day clock, and a response template per right
Sec. 16 and 17 Transfers and exemptions	Transfer personal data abroad unless the Government has restricted the destination by notification, subject to stricter sectoral laws and any requirements set under the Rules; rely on an exemption, such as work for overseas clients under section 17(1)(d), only where its conditions are met	A transfer map by country and vendor, sector rules checked, and each exemption recorded with its reasoning

What does useful DPDP Act evidence look like?

A processing register that matches the systems and journeys in use, with the ground for each purpose; notices in the languages you offer; consent and withdrawal records; signed processor contracts; erasure records; logs kept for a year; an incident register showing how each event was assessed against the Act's definition of a personal data breach, and the intimations made; a request and grievance log; and training records. We build them from your real processing and keep them in Effivity from the first workshop.

DPDP Act requirements explained, section by section

Compliance process

How do you become DPDP Act compliant?

Build the programme, run it and keep the proof, in that order. Sterling designs and builds it with your team; whether it is enough is judged by the Data Protection Board of India when a complaint or breach reaches it, by an independent data auditor for a Significant Data Fiduciary, and by your clients.

01
Set the boundaries of the programme.Confirm the entities, systems and journeys that process digital personal data, your role in each (Data Fiduciary or Data Processor), whether section 3 reaches you from abroad, whether an exemption such as section 17(1)(d) applies and whether SDF designation is likely.
02
Gap analysis: review the current position against the Act and the Rules.The gap analysis maps processing, data flows and vendors, tests notices, consent capture, contracts, safeguards and procedures against each obligation, keeps what works and agrees actions, owners and dates that finish before May 2027.
03
Put the controls into use and record them.Record the ground for each purpose, rewrite notices, rebuild consent and withdrawal journeys, sign processor contracts, set retention and log periods, put safeguards and the breach procedure in place and train the people who handle data.
04
Audit, review and address the findings.An internal audit against the Act and the Rules and a management review with the DPO or privacy lead show what operates; findings are raised by us first and closed with evidence.
05
Complete the regulator or customer review.Answer a client's due diligence, a vendor audit or the independent data audit from an evidence package that already exists; if a certificate is also wanted, take the programme to ISO/IEC 27701 with an accredited certification body.
06
Keep the programme current after May 2027.New products and vendors trigger notice and contract reviews, requests and breaches are logged, notifications and Board orders are tracked, and the annual internal audit and management review keep the programme on track.

Compare offers by what stays with you afterwards. Ask who maps the data, who decides the ground for each purpose, whether consent flows are built for your journeys and languages, and where the evidence will live. A "DPDP certificate" delivered in days is nothing the Act recognises. How to choose a credible DPDP Act provider · The certification buyer's checklist

Cost

How much does DPDP Act compliance cost?

The fee follows the number of processing activities and customer journeys, the systems and vendors behind them, whether children's data or very large volumes are involved and how much groundwork exists. In a Sterling proposal every component is visible and nothing is added later.

Cost component	What affects it
Consulting and implementation	Activities and journeys to map, notices and consent flows to rebuild, vendors to contract, entities and languages in scope, and how much of the work your team carries (Design™ or Drive™)
Independent review	The independent data auditor's fees if you are a Significant Data Fiduciary, and any ISO/IEC 27701 certification body you choose, shown separately; client audits cost time, not fees
Internal resources and legal	Process-owner time for mapping, DPO or privacy-lead capacity, product and IT effort for consent, logging, retention and erasure, training hours and any legal review
Software and learning	Included in the Sterling engagement: Effivity to run the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Internal audits, DPIA and audit support for Significant Data Fiduciaries, a watch on notifications and Board orders, refresher learning and updates when the Rules change, under Sustain™

What moves the price

Processing activities, journeys and vendors, and whether data flows are mapped
Apps and websites whose consent screens need rebuilding, and the languages offered
Children's data, persons with disability or likely SDF designation
Laws in scope: India only, or the GDPR and others as well
The time left before May 2027 and how much your team can carry

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
Data auditor, certification and legal fees identified separately, so the whole programme cost can be compared
Effivity, training and Academy access itemised at no additional cost
Payment milestones tied to deliverables, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does DPDP Act compliance take?

Three to nine months is the realistic range: shorter where an ISO/IEC 27001 system, a data inventory and processor contracts already exist, longer where consent journeys in apps and websites must be redesigned and many vendors contracted. Engineering changes for consent, logging and erasure often set the pace more than documents do. Plan backwards from May 2027 and leave time for controls to run before anyone checks them.

Phase	What determines the pace
Scope and gap analysis	Access to system and product owners, vendor lists and existing notices, and how quickly processing can be mapped
Build and implementation	Decisions on grounds and retention, rewritten notices, engineering changes to consent and erasure, processor contracts and training
Evidence and review	Controls and logs running long enough to produce records, a breach rehearsal, then internal audit and management review
Regulator or customer review	Client audits and due diligence as they arrive, the independent data audit for Significant Data Fiduciaries and, if a certificate is wanted, the certification body's schedule

If a client audit, a launch or the May 2027 date drives your plan, tell us at the start; we will say what can be operating by then and which decisions come first. A promise of full compliance in a week, made before anyone has seen your consent journeys, is a warning sign.

Challenges

Common DPDP Act implementation challenges

DPDP programmes tend to stall on five problems. Each one has a practical answer.

Consent is bundled into the terms and conditions.

Section 6 asks for consent that is specific, limited to the data the purpose needs, given by a clear affirmative action and easy to withdraw. We separate the purposes, rewrite notice and consent screens with your product team and record what each person agreed to.

Most of your data was collected before the Act, on old consents.

Section 5(2) requires a notice, as soon as reasonably practicable, for data processed on consent given before commencement; processing may continue until the person withdraws. We plan that campaign channel by channel and track responses and withdrawals.

Every breach has to be intimated, and nobody owns the clock.

The Act sets no risk threshold for intimation, so the first question is whether a personal data breach occurred. We set up triage, decision owners, templates for Data Principals and the Board and a 72-hour tracker, then rehearse it.

Vendors process data without contracts that reflect the Act.

A processor register, a clause set covering safeguards, logs, breach notice and erasure, and a contracting plan that starts with the highest-risk vendors.

Several privacy laws apply and each team follows a different one.

One core programme (inventory, notices, contracts, safeguards, breach and request procedures) with a jurisdiction layer recording where the DPDP Act differs, such as its grounds for processing and its breach rule.

Your engagement

What your DPDP Act engagement includes

One team and one all-inclusive proposal cover what an operating programme and a prepared team need: mapping, decisions, notices and contracts, software, training and the review that shows it works.

Scope, gap analysis and implementation plan
Roles, entities, journeys and vendors confirmed; each obligation of the Act and the Rules tested; actions, owners and dates agreed before work starts.
Data mapping, notices, consent and contracts
The processing register, ground and retention decisions, notices, consent and withdrawal design, processor contracts, and breach, request and grievance procedures, on Sterling's template sets adapted to your processing.
Effivity ISO & GRC software
Your DPDP programme runs in Effivity from the first day, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before a client, a data auditor or the Board looks.
Review readiness and support
Preparation for client audits, due diligence and any Board inquiry, and support through the independent data audit or ISO/IEC 27701 certification where either applies.

Compliance is assessed by the Data Protection Board of India and, for Significant Data Fiduciaries, an independent data auditor. Sterling consults; legal advice remains with your legal advisers.

How we deliver

How Sterling supports your DPDP Act implementation

Every DPDP Act engagement runs on Sterling OS™, our delivery operating system: five phases, each with deliverables, decision owners and evidence. Your team takes on as much of the work as it can; method, software and accountability stay fixed.

01
Design™Guided implementation: your privacy lead, product owners and process owners build the programme with Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants carry the mapping, drafting and procedure work with your teams and legal advisers.
03
Sustain™Operation after May 2027: request, grievance and breach reviews, the annual internal audit, refreshers and new-hire training.
04
Automate™The programme in Effivity: register, notices, consent, vendors, requests, breaches, audits and management review in one workspace.
05
Revise™Changes to the Rules, notifications on transfers or Significant Data Fiduciaries, Board orders, and changes in your journeys, systems or countries.

At kick-off we fix the engagement team, a weekly working session, the deliverables and each decision owner, then review progress against them, so a slipping consent redesign shows up months before the deadline.

How Sterling OS™ works

Often combined with

Standards organisations pair with DPDP Act 2023 (India)

Effivity · DPDP Act programme software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of the DPDP Act, 2023.

Every Sterling DPDP Act engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the processing register, notices and consent records, processor contracts, breach intimations, rights requests, grievances, training, audits and management review sit together and a client auditor or the Board sees a live system. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Grounds for processing personal data

Purposes, grounds and legitimate uses

Each activity carries its purpose, data categories, ground (consent or the section 7 use relied on), retention period and safeguards, recorded per activity rather than asserted in a policy.

Notice

Notices by journey and language

Every notice with its version, purposes, languages and placement, plus the notice campaign for consents collected before commencement, tracked to completion.

Consent

Consent and withdrawal records

Consent captured with wording, timestamp and channel; withdrawals processed and passed to the processors concerned; records from registered Consent Managers reconciled once registration opens.

General obligations of Data Fiduciary

Processors, safeguards and retention

A processor register with contract status, the safeguards baseline per system, log-retention settings and a retention schedule with erasure evidence when a purpose ends.

Processing of personal data of children

Verifiable parental consent

Where children's data is processed: the age-gating decision, the verification method, any exemption relied on, and a recorded check that tracking and targeted advertising are off for children.

Additional obligations of Significant Data Fiduciary

DPIA, audit and DPO

For designated SDFs: the yearly DPIA and audit schedule, the data auditor's observations and actions, the report to the Board, algorithmic due diligence and the register of data kept in India.

Rights and duties of Data Principal

Requests and grievances within 90 days

One log for access, correction, erasure and nomination requests and grievances, with identity checks, the ninety-day limit on screen and each response kept as evidence.

Across the programme

Breaches, audits, transfers and review

An incident workflow with the breach assessment, Data Principal notices and the 72-hour Board report; the audit programme; the transfer map; and a management review recording decisions, adapted to your work without code.

What this means at the audit

A client's auditor asks for the processing register, consent records for a sample of users, processor contracts, the breach register and training records; the Board, in an inquiry, asks for much the same. In Effivity each is a screen with dates, owners and evidence, and Sustain™ keeps it current after go-live.

Effivity for the DPDP Act: the guide Effivity ISMS on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your registers, notices and records migrated, not retyped
Admin and user training for your team
Modules for ISMS, PIMS, QMS, BCMS and more when you integrate other standards

DPDP Act client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for the DPDP Act are available on request. The client feedback wall lists every letter by standard.

Programmes with the DPDP Act in scope

Where India's data protection law meets security and service delivery.

All case studies

01
IT services and BPO in India: security, privacy and client contracts as one programme
How a programme of this kind runs: ISO/IEC 27001 provides the risk method and a control set commonly aligned in practice with the Rules' safeguards; DPDP obligations for data of people in India sit on the same inventory; work for overseas clients is assessed against the section 17(1)(d) exemption, which keeps sections 8(1) and 8(5) in force; and GDPR, HIPAA or PCI DSS requirements share one evidence base and one audit calendar.
Integrated management systems

Sterling Academy · DPDP Act e-learning

Every employee who touches personal data, trained on the DPDP Act.

Sterling Academy teaches frontline staff, product teams and the people who run the programme through short video lessons with checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their consultant, including complimentary awareness training for their people as part of the engagement.

DPDP Act awareness for every employee who collects, uses or shares personal data
Practitioner courses for the DPO or privacy lead, product owners and the people handling requests, grievances and incidents
Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
Learner progress by department and a training report for a client's auditor or a data auditor
New joiners trained in their first weeks, so records stay current
A Sterling consultant reachable when a learner needs one

Where we work

Where Sterling delivers DPDP Act 2023 (India)

Digital Personal Data Protection Act 2023 in India

Keep exploring

Explore more about DPDP Act 2023 (India)

Watch a video on how to comply with India DPDP Act here.
Watch a video on India DPDP Act requirements here.

DPDP Act resources

Services for DPDP Act 2023 (India)

Why Sterling

Want successful DPDP Act compliance? Come to Sterling.

Whether you are an Indian company preparing for May 2027 or a business abroad serving customers in India, Sterling builds one programme with clear ownership in each entity, working through Data Fiduciary and Data Processor roles, the section 17 exemptions and what each client contract demands.

Management systems in 60+ countries since 2003

Privacy and security programmes implemented for BPOs, IT service providers, banks, hospitals and manufacturers, with one engagement team accountable in every country you operate in.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with data auditor, certification and legal fees identified separately. No surprises, ever.

A programme your people can run

Less paperwork and more control: notices, consent records, procedures, training and software connected to the way data actually moves through your products and teams.

Expert and experienced consultants

Consultants who have advised on security and privacy management systems across sectors and countries since 2003, and who build the programme properly the first time, so a client audit or a Board inquiry finds controls that already work.

Sterling vs the rest: the full comparison Explore DPDP Act client experience

The Sterling Promise

What our DPDP Act compliance success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until the agreed DPDP Act programme outcome is achieved: processing mapped, grounds decided, consent journeys live, contracts signed, the breach procedure operating and your team able to handle a request, a client audit or a Board inquiry without us in the room. Included software and employee learning turn the investment into lasting capability, not a folder of policies.

Your engagement letter sets out the entities, roles, scope, outcome and who is responsible for what. Your organisation supplies accurate information about its processing, gives access to the systems, journeys and contracts in scope and operates the agreed controls. Compliance is assessed by the Data Protection Board of India and, for Significant Data Fiduciaries, an independent data auditor; legal interpretation remains with your legal advisers. The commitment is to the agreed programme support, not a legal opinion or a guarantee that no breach, complaint or penalty will arise.

After the programme is in place

What happens after DPDP Act compliance?

Compliance keeps moving after May 2027. Products, vendors and people change, requests and incidents keep arriving, and the framework develops: the Government may designate Significant Data Fiduciaries, restrict transfers to particular countries under section 16 or exempt classes of Data Fiduciaries, and the Board's orders will show how it reads the Act. The programme absorbs each change through the register, contracts and the yearly audit.

Under Sterling OS™ Sustain™ we run that cycle with you: reviews of requests, grievances and breaches, DPIA and audit support for Significant Data Fiduciaries, a watch on notifications and Board orders, refresher training and the internal audit.

FAQs

Frequently asked questions about the DPDP Act

Is there a DPDP Act certification?

No. The Act creates no certification scheme for organisations. Consent Managers register with the Data Protection Board of India and Significant Data Fiduciaries appoint an independent data auditor, but neither produces a certificate. A "DPDP certified" badge is a marketing claim. ISO/IEC 27701 certification from an accredited certification body can evidence a privacy management system, though it is not the same as legal compliance.

When do the DPDP Act's obligations apply?

In three phases under the notification of 13 November 2025: the definitions and the provisions establishing the Board on that date; Consent Manager registration one year later, in November 2026; and the remaining provisions, including notice, consent, safeguards, breach intimation, children's data, rights, transfers and penalties, eighteen months later, in May 2027. Section 43A of the Information Technology Act, 2000 is omitted only from that last date.

Does the Act apply to companies outside India?

Yes, where the processing is connected with offering goods or services to Data Principals in India (section 3). An overseas software, e-commerce or travel business serving people in India needs a lawful ground, safeguards, breach intimation and rights handling for that data.

We are an Indian BPO or IT company processing data for overseas clients. Does the Act apply?

Section 17(1)(d) disapplies most of the Act where a person based in India processes personal data of Data Principals outside India under a contract with a person outside India: Chapter II except sections 8(1) and 8(5), Chapter III and section 16 do not apply. Responsibility for compliance and the duty to take reasonable security safeguards remain, and your clients' own laws, such as the GDPR or HIPAA, still reach you through the contract. Data of people in India that you process is outside this exemption.

Do we need a Data Protection Officer?

Only a Significant Data Fiduciary must appoint one: a DPO based in India who represents it under the Act, is responsible to its board of directors and is the point of contact for grievances. Every Data Fiduciary must still publish the business contact of its DPO, if it has one, or of a person who can answer Data Principals' questions, and run a grievance mechanism.

What must we do when a personal data breach happens?

Section 8(6) requires intimation to the Board and to each affected Data Principal, without the risk threshold the GDPR uses. Under Rule 7, affected people are informed without delay through their user account or registered contact details, and the Board receives the details, including the circumstances and remedial measures, within 72 hours. Failing to intimate a breach can attract a penalty of up to INR 200 crore.

Can we transfer personal data outside India?

Yes, as a rule. The Central Government may, by notification, restrict transfers to particular countries or territories (section 16(1)), and sectoral laws with stricter rules continue to apply (section 16(2)). Rule 15 makes transfers subject to any requirements the Government specifies, and a Significant Data Fiduciary must keep personal data the Government specifies on a committee's recommendation within India. Check for any notification before relying on a destination.

What are the penalties under the DPDP Act?

The Schedule sets maximums: up to INR 250 crore for failing to take reasonable security safeguards; up to INR 200 crore each for failing to intimate a breach and for breaching the obligations on children; up to INR 150 crore for breaching the additional obligations of a Significant Data Fiduciary; up to INR 50 crore for breaching any other provision; and up to INR 10,000 for a Data Principal who breaches her duties. The Board sets the amount after an inquiry, weighing gravity, duration, the data affected and the mitigation taken. Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal within 60 days.

How does the DPDP Act differ from the GDPR?

The principles overlap; the mechanics differ. The Act recognises two grounds, consent and the legitimate uses in section 7, with no general legitimate-interests basis; it covers digital personal data, including data digitised later; every personal data breach is intimated to the Board and to affected people; Data Principals can nominate someone to act for them on death or incapacity; transfers abroad are allowed unless the Government restricts a destination; and penalties are fixed maximums in rupees, not a share of turnover. A GDPR programme is a strong starting point, not a finished DPDP one.

Before the first call

Prepare a useful DPDP Act readiness brief

You do not need a data map before the first discussion. Bring a short account of the personal data the business handles and who is asking about it. Seven questions are enough:

Who is asking, and what do they want to see: a client questionnaire, a contract clause, a board question about May 2027, or your own concern?
Are you a Data Fiduciary, a Data Processor or both, and for which activities? Do you serve people in India from inside or outside the country?
Which apps, websites, branches and systems collect personal data, and which vendors process it for you?
Do you process children's data, data of persons with disability, or volumes large enough to make SDF designation plausible?
What exists today: notices, consent records, processor contracts, a breach procedure, an ISO/IEC 27001 system?
Who can decide and give time: a privacy lead or DPO, legal counsel, product and IT owners, HR?
Besides May 2027, is there a client audit, a launch or another date to plan around?

Those answers are enough to set a realistic scope and an all-inclusive proposal. They are preparation for a conversation, not a scored assessment and not legal advice.

Don’t be fooled by certification scams

If it takes ten days, it is not DPDP Act compliance.

No DPDP certificate exists, so the market sells substitutes: "DPDP certified" badges, policy packs with another company's name still in them, a consent pop-up presented as compliance and personal training certificates passed off as company credentials. They are cheaper than a programme until a Data Principal complains or a client's auditor asks for consent records.

How to choose a credible DPDP Act provider

Ask what will exist at the end: a processing register, recorded grounds, notices, consent records, processor contracts, a breach procedure, a request and grievance process and trained people, and who produces each.
Ask what any offered "certificate" actually is. The Act creates no certification for organisations; the registration it provides for is that of Consent Managers with the Data Protection Board of India. A badge is not evidence of compliance.
Ask how notices and consent will be built for your real journeys, in your languages and with your product team, not copied from a template pack.
Identify who carries each task, which legal, data auditor or certification costs are separate, and what support exists when a breach or an inquiry tests the programme.
Ask what your people will learn and where the evidence will sit. A programme that lives on a consultant's laptop leaves with the consultant.
Walk away from "DPDP compliant in a week", "DPDP certified" seals and a consent banner sold as compliance. Section 8(1) keeps responsibility with the Data Fiduciary, whatever a badge says.

All ten warning signs of shortcut compliance

What a credible DPDP Act programme always involves

Processing mapped with the people who run the systems and products, over weeks, not hours
A recorded ground for every purpose: consent or a named section 7 use
Notices with language options and consent journeys that allow easy withdrawal
Processor contracts, safeguards and log retention set up to meet the Rules
A rehearsed breach procedure that gets the details to the Board within 72 hours
Your people trained, with records to show it
An internal audit and a management review before anyone external looks

Sterling's position. Sterling issues no certificates and no compliance opinions. We consult, design, train and prepare; the Data Protection Board of India, independent data auditors and your clients judge the result. We sell no seals, and if an offer you hold is one, we will say so. Where a certificate genuinely helps, we say which and what it covers: ISO/IEC 27701 from an accredited certification body, limits stated.

Offered a "DPDP certificate" and unsure what it is worth? Send it to us; we will tell you, free of charge, what it covers and what it does not.

Keep exploring

More on DPDP Act 2023 (India) and related standards

Plan your DPDP Act compliance with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Build a DPDP Act compliance programme for the first timeUnderstand cost, scope and timingCheck our readiness for the May 2027 obligationsIntegrate the DPDP Act with the GDPR or ISO/IEC 27701

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice