DPDP Act compliance software: meet every requirement, and prove it

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's data protection law for how digital personal data may be collected, used, stored and shared. It received the President's assent on 11 August 2023 (Act No. 22 of 2023). It protects individuals' right to their personal data while allowing processing for lawful purposes. In practice, any organisation handling such data needs to know its duties.

Source: DPDP Act, 2023, sections 1 and 3

The Digital Personal Data Protection Rules, 2025 (DPDP Rules) are the rules that explain how the DPDP Act works in practice. Notified on 13 November 2025 (G.S.R. 846(E)), they cover notice contents, Consent Manager registration, security safeguards, breach reporting, children's data, individuals' rights and the Data Protection Board. People often search for them as the DPDP Act 2025, but the Act itself dates from 2023. Different rules start on different dates.

Source: DPDP Rules, 2025, Rule 1

The DPDP Act applies to processing of digital personal data inside India, including paper data digitised later. It also covers processing outside India when linked to offering goods or services to people in India. It does not apply to personal or domestic use, or to data the individual or a legally required person has made public. A foreign business serving Indian customers is covered.

Source: DPDP Act, 2023, section 3

Yes. The DPDP Act has no blanket exemption for startups or small businesses. Section 17(3) only allows the Government to exempt notified organisations, such as startups, from a few duties: notice, accuracy, erasure, Significant Data Fiduciary duties and the right to information. The DPDP Rules contain no such exemption (as of October 2026), so all duties apply.

Source: DPDP Act, 2023, section 17(3)

Most DPDP Act duties, including notice, consent, security safeguards and breach reporting, apply from 13 May 2027 (as of October 2026), eighteen months after the DPDP Rules, 2025 were notified on 13 November 2025. Data Protection Board provisions took effect on notification, and Consent Manager registration starts on 13 November 2026. In practice, organisations have until May 2027 to prepare.

Source: DPDP Rules, 2025, Rule 1(2) to 1(4)

Check where you stand: take the free DPDP readiness assessment

The DPDP Act lets the Data Protection Board impose penalties of up to Rs 250 crore for failing to keep reasonable security safeguards. Failing to report a personal data breach, or breaching children's data duties, can cost up to Rs 200 crore. Significant Data Fiduciary (a large or high-risk organisation) duties are capped at Rs 150 crore, and most other breaches at Rs 50 crore.

Source: DPDP Act, 2023, section 33 and Schedule

Under the DPDP Act, a Data Fiduciary decides why and how personal data is processed, a Data Principal is the individual the data relates to, and a Data Processor handles data on a Data Fiduciary's behalf. For a child or a person with disability, the Data Principal includes the parent or lawful guardian. The Data Fiduciary stays responsible even when a Processor does the work.

Source: DPDP Act, 2023, section 2

A Significant Data Fiduciary under the DPDP Act is a Data Fiduciary, or class of them, that the Central Government notifies, based on factors such as data volume, sensitivity and risk. It must appoint an India-based Data Protection Officer and an independent data auditor, and under Rule 13 do a yearly impact assessment and audit.

Source: DPDP Act, 2023, section 10; DPDP Rules, 2025, Rule 13

The Data Protection Board of India is the body set up under the DPDP Act to enforce it. It inquires into personal data breaches and complaints, can direct urgent remedial steps, and imposes penalties after a hearing. It functions as a digital office, and its orders can be appealed to the Appellate Tribunal within sixty days.

Source: DPDP Act, 2023, sections 18 to 29

Under the DPDP Act, valid consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to data needed for the stated purpose. It must follow a plain-language notice in English or an Eighth Schedule language (the 22 languages listed in the Constitution). Withdrawing consent must be comparably easy to giving it, and the organisation must be able to prove consent was given.

Source: DPDP Act, 2023, sections 5 and 6; DPDP Rules, 2025, Rule 3

The DPDP Act treats anyone under 18 as a child and requires a Data Fiduciary to get verifiable parental consent before processing a child's data. It bans processing likely to harm a child's well-being, tracking, behavioural monitoring and targeted advertising aimed at children. Rule 12 and the Fourth Schedule allow limited exceptions, for example for healthcare providers and educational institutions, but never for harmful processing.

Source: DPDP Act, 2023, section 9; DPDP Rules, 2025, Rules 10 to 12

Under section 5(2) of the DPDP Act, an organisation may keep processing data collected with consent before the Act, until the person withdraws consent. It must, as soon as practicable, send a notice covering the data, the purpose, how to exercise rights and how to complain to the Board. The erasure duty still applies once the purpose is no longer served.

Source: DPDP Act, 2023, section 5(2)

Yes. Section 16 of the DPDP Act lets the Central Government restrict transfers only to countries it notifies, and Rule 15 allows transfers subject to any requirements it specifies for making data available to foreign States and their agencies. Stricter Indian laws still apply, and Significant Data Fiduciaries may be required to keep specified data in India. In practice, check notified countries and sector rules first.

Source: DPDP Act, 2023, section 16; DPDP Rules, 2025, Rule 15

Under section 8(7) of the DPDP Act, a Data Fiduciary must erase personal data once consent is withdrawn or the purpose is no longer served, unless a law requires retention. Rule 8 and the Third Schedule set a three-year inactivity period for large e-commerce, online gaming and social media platforms, with 48 hours' warning before erasure. Personal data, traffic data and processing logs must be kept for at least one year.

Source: DPDP Act, 2023, section 8(7); DPDP Rules, 2025, Rule 8

Under the DPDP Act, a Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for individuals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform, accountable to the individual. Among other conditions, applicants must be companies incorporated in India with a net worth of at least Rs 2 crore.

Source: DPDP Act, 2023, sections 2(g) and 6; DPDP Rules, 2025, Rule 4

The DPDP Act gives individuals the right to access a summary of their personal data and who it was shared with, to correct, complete, update or erase it, and to have grievance redressal. They can also withdraw consent at any time and nominate someone to act for them on death or incapacity. Use the grievance process before complaining to the Board.

Source: DPDP Act, 2023, sections 11 to 14

Under the DPDP Act and Rules, an organisation must tell the Data Protection Board about a personal data breach without delay, then send detailed information within 72 hours of becoming aware, or a longer period the Board allows on written request. It must also tell each affected individual without delay. These duties apply from 13 May 2027 (as of October 2026).

Source: DPDP Act, 2023, section 8(6); DPDP Rules, 2025, Rule 7

The DPDP Act differs from the EU's GDPR in several ways. It covers only digital data. It allows processing on consent or listed legitimate uses, while GDPR Article 6 lists six lawful bases including legitimate interests. DPDP penalties are fixed rupee caps up to Rs 250 crore, while GDPR fines reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Source: DPDP Act, 2023; GDPR Articles 6 and 83

Organisations can start complying with the DPDP Act by mapping the personal data they hold and why. Then they should issue clear notices and record consent, sign contracts with processors, apply security safeguards, prepare a breach response, set up a grievance process with published contact details, and plan erasure of data no longer needed. Extra care applies to children's data.

Source: DPDP Act, 2023, sections 5 to 9

VControl helps organisations prepare for the DPDP Act: it can map the Act's sections, rules and obligations to requirements, tests, evidence, risks, findings, owners and corrective actions. Its registers, workflows, dashboards, reminders and audit trail help you assess readiness and keep the evidence. The proposed DPDP scope includes Data Processing, Processor, Notice, Retention, Data Principal Request and Breach registers. The exact ready-to-use fields, workflows and reports must be confirmed for the proposed release.

See VControl compliance management software

VControl governs DPDP Act privacy notices and consent records: notice versions, purposes, data categories, owners, approvals and supporting consent records. Capturing consent for each transaction, enforcing withdrawal, or operating as a registered Consent Manager requires specific product scope or integration with your applications and consent systems.

Yes. VControl can be deployed in your own private cloud or on-premise environment, or used as a managed cloud service. Customer-controlled deployment can address stricter data residency needs, and data location, retention and deletion are agreed in the contract and deployment design. Integration and AI options may differ by deployment model.

No. VControl does not provide a government certification or a guarantee of DPDP Act compliance. It supports continuous readiness assessment, evidence, monitoring, rights workflows and remediation, while your organisation remains accountable for compliance and should get legal or privacy advice on interpretation.