A practical checklist for complying with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: whether the Act applies to you, the twelve steps every business must take, the penalties, and whether you need a Data Protection Officer. Written by Regi Tom Antony, FCA, CISA, former Data Privacy Officer at OSRAM and Westcon Group, with each step referenced to the section of the Act or the Rule it comes from.
Led by Regi Tom Antony, FCA, MBA (Australia), ACMA (UK), CGMA (USA), CISA (USA), former Group CFO/COO (OSRAM/Siemens, Westcon Group; Middle East & Africa).
DPDP compliance means meeting the duties that the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 place on any business that handles the digital personal data of people in India. There is no exemption for small businesses. The Rules were notified on 13 November 2025; consent manager provisions apply from 13 November 2026, and the main duties apply from 13 May 2027. To comply, a business maps the personal data it holds, gives an itemised notice and takes valid consent, protects the data with reasonable security safeguards, reports breaches to the Data Protection Board within 72 hours, honours individuals' rights, erases data once its purpose is served, and keeps evidence of all of it. Failure to protect data can attract a penalty of up to ₹250 crore per instance. This checklist was written by Regi Tom Antony, FCA, CISA, of Regi Tom Antony & Associates, Chartered Accountants in Kochi since 1997.
The Act sets the duties; the Rules set out how and when. Most businesses have until 13 May 2027, but the work takes months.
| DATE | WHAT HAPPENED OR APPLIES | WHAT IT MEANS FOR A BUSINESS |
|---|---|---|
| 11 August 2023 | Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) enacted | The law exists, but most duties wait for the Rules |
| 13 November 2025 | DPDP Rules, 2025 notified; Data Protection Board provisions in force | The regulator is set up; the countdown begins |
| 13 November 2026 | Consent manager provisions take effect (Rule 4) | Registered consent managers can start operating |
| 13 May 2027 | Notice, consent, security, breach reporting, rights, retention and penalties apply | Full compliance is expected from this date |
Source: the Act and the Rules as published by the Ministry of Electronics and Information Technology. Law as at 8 November 2026.
If you collect or use any personal data in digital form, it almost certainly applies.
Personal data collected in digital form, or collected on paper and later digitised. Customer lists, employee payroll, CCTV, website forms and WhatsApp contacts all count.
A business outside India is covered when it offers goods or services to people in India, which includes foreign and GCC groups serving Indian customers.
There is no turnover or headcount threshold. Exemptions exist only where the government notifies them under s.17, for specified purposes or classes.
| TERM | WHAT IT MEANS |
|---|---|
| Data Principal | The person the data is about: a customer, employee, patient or student |
| Data Fiduciary | The business that decides why and how the data is processed; almost every business is one |
| Data Processor | A vendor that processes data for the fiduciary: payroll, cloud, CRM, BPO |
| Significant Data Fiduciary | A fiduciary notified under s.10 because of the volume or sensitivity of its data; it has extra duties |
| Consent Manager | A registered platform through which people give, manage and withdraw consent |
| Data Protection Board | The regulator that inquires into breaches and imposes penalties |
Work through them in this order. Steps 1 and 2 decide the scope of everything after them.
List every type of personal data you hold, where it sits (systems, spreadsheets, WhatsApp, paper files later scanned), who can see it, which vendors receive it and how long you keep it.
Each use needs either consent or one of the legitimate uses listed in s.7, such as employment purposes or legal compliance. Write down which applies.
Give an itemised notice in clear language, in English or an Eighth Schedule language, stating the data, the purpose and how to withdraw consent or complain.
Consent must be free, specific, informed and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give.
Obtain verifiable parental consent before processing data of anyone under 18, and do not track, monitor behaviour or target advertising at children.
Every processor (payroll, cloud, CRM, marketing, BPO) needs a written contract covering purpose, security, breach notification and return or deletion of data.
Encryption or masking, access control, logs kept for at least a year, backups, and the same safeguards required of processors.
Inform affected people without delay and file a detailed report with the Data Protection Board within 72 hours, alongside CERT-In's 6-hour reporting direction.
Erase data once its purpose is served unless another law requires it to be kept, reconciling with tax, GST, company and labour law record periods.
Handle access, correction, erasure and nomination requests, and resolve grievances within 90 days, with a log of each request.
Publish the business contact of the person who answers data questions; a Significant Data Fiduciary must appoint a Data Protection Officer based in India.
Index the notices, consents, contracts, security review, breach plan, retention schedule and training records, so you can show compliance to a client, a bank or the Board.
Significant Data Fiduciaries also carry out a data protection impact assessment and a periodic independent data audit (s.10, Rule 13). Want this done for you? See our DPDP Act compliance services.
These are maximum amounts per instance. The Data Protection Board decides the actual penalty.
| FAILURE | PROVISION | MAXIMUM PENALTY |
|---|---|---|
| Failure to take reasonable security safeguards | s.8(5) | ₹250 crore |
| Failure to notify a personal data breach | s.8(6) | ₹200 crore |
| Breach of obligations on children's data | s.9 | ₹200 crore |
| Breach of Significant Data Fiduciary obligations | s.10 | ₹150 crore |
| Breach of any other provision of the Act or Rules | Residual | ₹50 crore |
Under s.33 the Board considers the nature, gravity and duration of the breach, the steps taken to mitigate it and the business's conduct. A documented compliance file is evidence of that conduct.
Most businesses do not need a formal DPO, but every business needs a named person.
Every Data Fiduciary must publish the business contact information of a person who can answer questions about its processing of personal data (s.8(9)).
A business notified as a Significant Data Fiduciary must appoint a Data Protection Officer based in India, responsible to the board, plus an independent data auditor (s.10).
Many SMEs name an internal lead and use an external adviser as a virtual DPO for reviews, breach handling and the annual health check.
GDPR-ready businesses have a head start, but the two laws differ in ways that matter.
| DPDP ACT (INDIA) | GDPR (EU) | |
|---|---|---|
| Data covered | Digital personal data, and paper data once digitised | All personal data, digital or manual |
| Grounds for processing | Consent, or a listed legitimate use (s.7) | Six lawful bases, including legitimate interests |
| Children | Under 18; verifiable parental consent | Under 16 by default (member states may lower to 13) |
| Sensitive data | No separate special category | Special categories with stricter rules |
| Breach reporting | Every breach to the Board; detailed report within 72 hours | To the authority within 72 hours unless unlikely to cause risk |
| Penalties | Fixed maximums, up to ₹250 crore per instance | Up to 4% of worldwide turnover or EUR 20 million |
Tell us what personal data you hold, the systems it sits in and the vendors who touch it. We will tell you where to start and send a written scope.