Quick Answer
The DPDP Act 2023 FAQ Hub answers the most common questions about India's Digital Personal Data Protection Act — including who must comply, what consent is required, how to handle Data Principal rights requests, and the penalty structure. The Act applies to all organisations processing digital personal data of Indian citizens, whether inside or outside India. Enforcement is expected from May 2027 after the DPDP Rules 2025 are finalised.
Quick AnswerThe DPDP Act 2023 raises many implementation questions. This hub answers the 50 most common questions from compliance teams, legal advisors, and business leaders across sectors.
DPDP Compliance Checklist
- When does DPDP Act 2023 come into force? The Act is passed — enforcement begins as provisions are notified.
- Who is covered by DPDP? Any entity processing personal data of Indian residents.
- What is personal data under DPDP? Any data about an identifiable individual.
- Is consent always required? No — legitimate uses (medical emergency, state functions) may not need consent.
- What are the maximum penalties? ₹250 crore per breach incident for most violations.
- Do startups need DPDP compliance? Yes — no threshold exemption for small companies.
- What is a Significant Data Fiduciary? Government-designated entities with heightened obligations.
- Is Aadhaar covered by DPDP? Yes — Aadhaar data is personal data and often sensitive.
- What are data principal rights? Access, correction, deletion, grievance, and nominating a representative.
- How do we comply with the 72-hour breach notification? Report to the Data Protection Board within 72 hours of discovery.
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Is there a grace period for DPDP compliance?+
The government has not announced a formal grace period. The Data Protection Board will be set up, and enforcement is expected after the Board is constituted — likely late 2025 or 2026.
Do employee data processing obligations apply to all employers?+
Yes. Employers are data fiduciaries for employee personal data. Payroll, HR, and performance data must be handled per DPDP requirements.
What is the Data Protection Board and how does it work?+
The Board is the adjudicatory body for DPDP. Individuals file complaints; the Board investigates and can impose penalties up to ₹250 crore. Decisions are appealable to the Telecom Disputes Settlement Appellate Tribunal.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
