India's DPDP Act, explained properly

Every guide we have written on the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, grouped by what you are trying to work out. All of it written from the official gazette text rather than from other people's summaries.

14 Nov 2025 · done

Board constituted, definitions and rule-making powers in force

14 Nov 2026

Rule 4, section 6(9) and section 27(1)(d) commence

14 May 2027

Obligations, rights, Board powers and penalties commence

Commencement runs from publication in the Gazette on 14 November 2025, under G.S.R. 846(E) for the Rules and G.S.R. 843(E) for the Act.

Start here

Whether the Act applies to you, and by when.

Does DPDP Apply to My Company? Section 3, Answered Directly 6 min read Is the DPDP Act Already in Force? What Applies Today 6 min read DPDP Compliance Deadlines: What Changes on 14 November 2026 and 14 May 2027 7 min read The DPDP Act vs the DPDP Rules: Why You Need Both 5 min read Data Fiduciary, Data Processor, Data Principal: Which Are You? 6 min read Who Is a Significant Data Fiduciary Under DPDP? 7 min read

Consent and notices

Rule 3 and Rule 4, and what they require of your product.

Why Your Privacy Policy Is Not a Valid DPDP Notice 6 min read What Makes Consent Valid Under the DPDP Act 6 min read Do You Need to Re-Collect Consent From Existing Users? 6 min read Consent Withdrawal Under DPDP: A Product Requirement 5 min read What Is a Consent Manager Under DPDP? Rule 4 Explained 7 min read Children's Data Under DPDP and Verifiable Parental Consent 7 min read

Security and breach

Rule 6 and Rule 7, where the largest penalties sit.

Reasonable Security Safeguards Under Rule 6: The Minimum List 7 min read DPDP Breach Notification: The Two-Stage Rule Most Companies Miss 8 min read What Counts as a Personal Data Breach Under DPDP? 5 min read DPDP vs CERT-In: Which Applies When You Are Breached? 6 min read DPDP Penalties Explained: What Each Breach Actually Costs 7 min read

Doing the work

The processes and records the Rules assume you have.

A Practical DPDP Implementation Roadmap, Rule by Rule 9 min read How to Build a Record of Processing for DPDP 6 min read Data Retention and Erasure Under Rule 8 6 min read Handling Data Principal Rights Requests Under Rule 14 6 min read DPDP Processor Contracts: The Clause Rule 6 Requires 6 min read Do You Need a Data Protection Officer Under DPDP? 5 min read DPDP Audits: Who Gets Audited and What Is Checked 5 min read Cross-Border Data Transfer Under DPDP 5 min read

By sector

What DPDP looks like in your industry.

DPDP for Fintechs and NBFCs: Where the Obligations Stack 7 min read DPDP for SaaS Companies: You Are Probably Both Roles 6 min read DPDP for Stock Brokers and SEBI-Regulated Entities 6 min read DPDP for Healthcare and Health-Tech in India 6 min read DPDP for Edtech: The Strictest Rules in the Act Apply to You 6 min read DPDP for E-commerce and D2C: The Three Year Erasure Clock 6 min read DPDP for HR: Employee Data Has No Carve-Out 6 min read Does DPDP Apply to B2B Companies With No Consumer Users? 6 min read DPDP for Startups: Is There Really an Exemption? 6 min read Does DPDP Apply to Foreign Companies Serving Indian Users? 6 min read DPDP Act 2023: What Fintechs and SaaS Companies Must Do Now 9 min read

Compared with other frameworks

How DPDP relates to what you may already do.

DPDP vs GDPR: What Actually Differs for Indian Companies 7 min read DPDP vs the IT Rules 2011: What Replaced What 5 min read

Not sure where you stand?

Infosek handles the whole of DPDP: data mapping, consent and notices, security controls, vendor contracts, breach readiness and the audit itself. We do the work, not just the gap report.

Book Free 30-Min Assessment