Loading...
Digital Personal Data Protection Act
India’s comprehensive data protection law with extraterritorial reach affecting foreign companies processing data of Indian individuals. Consent-based regime requiring 72-hour breach notification, mandatory encryption and masking, verifiable parental consent for children’s data, and a registered Consent Manager framework. Penalties up to INR 250 crore (~EUR 28M).
₹250Cr
Max Penalty
72h
Breach Notice
18
Age of Consent
Extra-
Territorial Reach
11 August 2023
DPDP Act receives Presidential assent
November 2025
DPDP Rules notified; Data Protection Board instituted
November 2026
Consent Manager registration deadline
May 2027
All provisions fully in force
Lawful processing requires free, specific, informed, and unambiguous consent. Consent must be as easy to withdraw as to give. A limited ‘legitimate uses’ basis is available for certain processing activities.
Mandatory notification to the Data Protection Board and affected data principals within 72 hours of becoming aware of a personal data breach.
Mandatory encryption, masking, and de-identification of personal data. Reasonable security safeguards proportionate to data sensitivity must be implemented.
Verifiable parental consent required for processing children’s data (under 18). Prohibition on behavioural monitoring and targeted advertising directed at children.
Right to access, correction, erasure, and nomination of a representative. Right to grievance redressal within 7 days of filing a complaint.
Registered Consent Managers must have INR 20 crore (~EUR 2.2M) net worth. They act as intermediaries for managing consent on behalf of data principals.
INR 250 crore (~EUR 28M)
Maximum penalty for failure to implement adequate safeguards to protect personal data or failure to notify breaches within the required timeframe.
INR 200 crore (~EUR 22M)
Enhanced penalties for violations involving processing of children’s personal data without proper consent or safeguards.
INR 150 crore (~EUR 17M)
General penalties for failure to comply with other provisions of the Act, including data principal rights and processing obligations.
We provide structured preparation and compliance support for India DPDP Act.
Schedule a consultation with our regulatory experts to assess your India DPDP Act compliance posture and build a practical roadmap.