DPDP Act 2023
Knowledge Hub

Every data fiduciary — any organization that decides the purpose and means of processing digital personal data of individuals in India. The Act also applies extraterritorially to foreign companies that process personal data in connection with offering goods or services to data principals in India. Obligations scale with risk: high-volume or high-risk processors can be designated Significant Data Fiduciaries with additional duties.

Compliance is phased. The Act received assent in August 2023, and the DPDP Rules 2025 stagger the operative obligations over a runway extending into 2026–27 — consent notices, security safeguards, and breach reporting arrive first, with Consent Manager registration and Significant Data Fiduciary duties following. Because data mapping, consent re-engineering, and vendor contract updates take months, most organizations should start 6–9 months before their obligations bite.

The Data Protection Board can impose monetary penalties of up to ₹250 crore per instance for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children’s-data violations, and lower slabs for other defaults. Penalties apply per instance, so a single incident that touches several obligations can compound quickly.

An SDF is a class of data fiduciary designated by the central government based on factors such as the volume and sensitivity of personal data processed and the risk to data principals, electoral democracy, state security, or public order. SDFs must appoint an India-based Data Protection Officer, engage an independent data auditor, and conduct periodic Data Protection Impact Assessments and audits.

For most SMEs and mid-market companies, an end-to-end DPDP compliance program — gap assessment, data mapping, policies, consent flows, breach playbooks, and training — costs ₹1.5–4 lakhs (indicative). The final figure depends on your data footprint, the number of processing activities, and whether Significant Data Fiduciary obligations apply.

A GDPR program gives you a strong head start but does not equal DPDP compliance. The DPDP Act is consent-centric with no legitimate-interest ground, introduces India-specific concepts like Consent Managers and Significant Data Fiduciaries, and requires breach notification to both the Data Protection Board and affected data principals. The DPDP vs GDPR comparison in this hub details the deltas you still need to close.