Measure your organisation’s readiness for the Digital Personal Data Protection Act, before 13 May 2027.
Answer 13 questions on how your organisation handles personal data. Get its score, its risk level and the areas to fix first.
Free · About 5 minutes · No sign-up needed
India’s Digital Personal Data Protection Act 2023
India’s Digital Personal Data Protection Act became law in 2023. The rules that make it work were notified on 13 November 2025, and the obligations it puts on your organisation take effect on 13 May 2027.
It applies to you if you hold personal data about people in India.
Customers, employees, vendors, job applicants and third party outsourcing all count.
Penalties
The penalties sit in the Act itself, and they fall on the organisation:
- Up toRs 250 crore
for failing to take reasonable security safeguards against a data breach
- Up toRs 200 crore
for failing to tell the Data Protection Board and the affected people when a breach happens
- Up toRs 200 crore
for mishandling children’s data
- Up toRs 50 crore
for breaching any other obligation in the Act
Key takeaway
The Board sets the amount by looking at how serious the lapse was, how long it ran, and what you had already done to prevent it. That last point is why the four minutes below are worth spending.