Work through what the Digital Personal Data Protection Act, 2023 says about consent, data fiduciary obligations and data principal rights, and record what applies to your organisation.
DPDP is now adoptable in ReadyGDPR. The DPDP catalogue carries 31 controls quoted verbatim from the Gazette of India: the Digital Personal Data Protection Act, 2023 together with the Digital Personal Data Protection Rules, 2025 notified vide G.S.R. 846(E) on 13 November 2025. Each control shows the provision it comes from, links to the notified instrument, and records your own determination of whether it applies to you. ReadyGDPR does not certify compliance and nothing here is legal advice.
The Digital Personal Data Protection Act (DPDP Act) 2023 is India's comprehensive data protection law that received Presidential assent on August 11, 2023. It establishes a framework for processing digital personal data while balancing the rights of individuals ("Data Principals") with the responsibilities of entities processing data ("Data Fiduciaries").
The Act applies to processing of digital personal data within India, and also to processing outside India if it's in connection with offering goods or services to Data Principals in India. It introduces significant obligations for organizations and establishes the Data Protection Board of India as the enforcement authority.
Key Features: Consent-based framework, simplified individual rights, cross-border data transfer provisions, exemptions for government processing, and substantial penalties for non-compliance. Compare with GDPR's 99 articles, CCPA's opt-out model, and Saudi Arabia's PDPL.
Core principles that data fiduciaries must follow
Process data only on valid lawful grounds including consent
Process data only for specified and lawful purposes
Collect only necessary data for the stated purpose
Ensure data is complete, accurate, and consistent
Retain data only as long as necessary
Implement reasonable security measures
Rights that individuals can exercise under DPDP Act
Know what personal data is being processed and how
Request correction of inaccurate or incomplete data
Request deletion of personal data (with conditions)
Lodge complaints with Data Protection Board
Nominate someone to exercise rights in case of death/incapacity
Essential compliance requirements for organizations
Provide clear notice about data processing at the time of collection
Obtain free, specific, informed, and unambiguous consent
Obtain verifiable parental consent for processing children's data
Establish processes to handle erasure, correction, and grievance
Significant Data Fiduciaries must appoint a Data Protection Officer
Notify Board and affected individuals of data breaches
Section 33 and the Schedule set a ceiling for each type of breach
Highest amount in the Schedule to the Act
Under section 33(2) the Board considers the nature, gravity and duration of the breach, the type of personal data affected, whether it is repetitive, any gain or loss involved, and whether the fiduciary took timely steps to mitigate it.
The Rules were notified on 13 November 2025 (G.S.R. 846(E)) and commence in stages under Rule 1
Rule 7 sets the breach process once in force: intimate the Board and each affected data principal without delay, then give the Board a detailed report within 72 hours of becoming aware, or a longer period the Board allows. Check the dates against the Gazette notification before relying on them, and consult legal counsel on how they apply to you.
Additional obligations for large-scale data processors
Organizations notified as Significant Data Fiduciaries must comply with additional requirements:
These capabilities are live in ReadyGDPR today for GDPR and CERT-In. They will cover DPDP once the DPDP control set completes verification; DPDP cannot be selected in the product yet.
Get instant guidance on DPDP Act requirements. Our AI-powered Virtual DPO provides section-specific advice, consent templates, and compliance checklists—tailored for Indian data protection law.
Collect, record, and manage consent in compliance with DPDP requirements. Free, specific, informed, and unambiguous consent tracking with easy withdrawal mechanisms.
Handle information, correction, and erasure requests automatically. Public portal with identity verification and deadline tracking for data principal rights.
Generate DPDP-compliant privacy notices with all required disclosures. Include purpose specification, data categories, retention periods, and data principal rights information.
Quick reference guide to understand key differences across regulations
Understand how different data protection laws compare and overlap
EU General Data Protection Regulation - 99 articles, strictest global standard
Key Focus: Learn about Article 30 ROPA & 72-hour breach notification
California Consumer Privacy Act - Focus on data sales & consumer opt-out rights
Key Focus: Master do not sell requirements & 45-day response deadlines
Saudi Arabia Personal Data Protection Law - SDAIA requirements
Key Focus: Navigate SDAIA registration & cross-border transfers
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.
ReadyGDPR is a guided compliance tool, not a certifying authority, and is not a law firm. The regulatory text quoted here is provided for reference; whether it applies to your organisation is your determination. Nothing here is legal advice.