Topic Hub
DPDPA Compliance
India's Digital Personal Data Protection Act explained — obligations, deadlines, and practical compliance guidance for international technology companies.
Overview
India's DPDPA 2023 is the country's first comprehensive data protection law, governing how digital personal data is collected, processed, and transferred. For the $283 billion Indian IT industry and international businesses operating in the Indian market, the DPDPA introduces new obligations around consent, data principal rights, and breach notification — with penalties of up to ₹250 crore ($30 million).
With full enforcement expected by May 2027, this hub brings together our analysis, practical guides, and free resources to help technology companies understand their DPDPA obligations and build compliance programmes that work alongside existing GDPR and global privacy frameworks.
What You'll Find Here
Complete guide to DPDPA obligations for Data Fiduciaries
DPDPA vs GDPR comparison and interoperability guidance
Consent management requirements and best practices
Cross-border data transfer rules explained
Impact analysis for Indian tech exports and international businesses
Downloadable privacy compliance checklists and playbooks
Key Dates
Enforcement timeline and deadlines.
11 Aug 2023
DPDPA received presidential assent and was published in the Official Gazette.
2025
Draft rules published for public consultation. Subordinate rules expected to be finalised.
13 May 2027
Full compliance deadline — all substantive provisions become enforceable with penalties.
Guides & Articles
In-depth resources on this topic.
How DPDPA Affects Indian Tech Exports: What Technology Companies Must Know
India's DPDPA represents a watershed moment for the $283 billion IT industry. With full compliance mandatory by May 2027, technology companies face a rapidly closing window.
Cross-Border Data Transfers in 2026: Navigating the Global Patchwork
With the DPDPA's transfer restrictions taking effect and new frameworks emerging across Asia, cross-border data transfers have never been more complex.
DPDPA vs GDPR: Key Differences Every Technology Company Should Understand
A detailed comparison of India's DPDPA and the EU's GDPR — covering scope, legal bases, data subject rights, cross-border transfers, penalties, and what dual-jurisdiction compliance requires.
Coming soon
DPDPA: Complete Guide for International Businesses
DPDPA Consent Management Requirements
DPDPA Cross-Border Data Transfer Rules
DPDPA Data Fiduciary Obligations
Frequently Asked Questions
What is the DPDPA?
The Digital Personal Data Protection Act (DPDPA) 2023 is India's first comprehensive data protection law. It governs the processing of digital personal data within India and the processing of personal data outside India where it relates to offering goods or services to individuals in India.
Who does the DPDPA apply to?
The DPDPA applies to any entity (Data Fiduciary) processing digital personal data in India, as well as entities outside India that process personal data in connection with offering goods or services to individuals in India. This gives the DPDPA extraterritorial reach similar to the GDPR.
How does the DPDPA differ from the GDPR?
While both are comprehensive data protection laws, key differences include: the DPDPA uses a consent-and-legitimate-use model rather than GDPR's six legal bases; the DPDPA applies only to digital personal data; cross-border transfers use a government blacklist approach rather than adequacy decisions; and the DPDPA does not include a right to data portability or a right to object to processing.
What are the penalties for non-compliance?
The DPDPA prescribes penalties of up to ₹250 crore (approximately $30 million) for the most serious violations, including failure to take reasonable security measures leading to a data breach. The Data Protection Board of India will adjudicate complaints and impose penalties.
What is a Significant Data Fiduciary?
The Central Government may designate certain Data Fiduciaries as Significant Data Fiduciaries based on the volume and sensitivity of data processed, risk to data principals, and potential impact on sovereignty and security. Significant Data Fiduciaries face additional obligations including appointing a Data Protection Officer, conducting Data Protection Impact Assessments, and periodic audits.
How does the DPDPA handle cross-border data transfers?
The DPDPA takes a blacklist approach — personal data may be transferred to any country except those specifically restricted by the Central Government. This is simpler than the GDPR's adequacy and safeguard mechanisms, but the restricted country list has not yet been published, creating uncertainty for international businesses.
Need help with dpdpa compliance?
30 minutes. No preparation. No obligation.
Free 30-Min Consultation