Quick Answer
The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules) will co-exist with the DPDP Act 2023 until formally repealed. The DPDP Act supersedes SPDI Rules for digital personal data processing but does not address non-digital data. Organisations must currently comply with both frameworks — this comparison clarifies which obligations apply under each law.
Quick AnswerDPDP Act 2023 supersedes SPDI Rules for personal data matters. Key upgrades: individual rights, consent framework, grievance mechanisms, and substantial financial penalties replace the limited SPDI enforcement framework.
DPDP Compliance Checklist
- Understand that DPDP Act 2023 largely supersedes SPDI Rules for personal data — update your compliance framework
- Note that DPDP penalties (up to ₹250 crore) are far stronger than SPDI's limited liability
- Review SPDI's sensitive data categories and map to DPDP — DPDP removes the explicit sensitive category
- Update your security policy from 'reasonable security practices' (SPDI) to DPDP's security obligation standard
- Implement DPDP-mandated grievance mechanism — upgrade from SPDI's privacy officer requirement
- Review consent language — DPDP requires affirmative, specific consent; SPDI was less prescriptive
- Implement data subject rights (access, correction, deletion) — SPDI had limited individual rights
- Update privacy policies from SPDI compliance language to DPDP-compliant language
- Note that SPDI's IS/ISO 27001 reference remains relevant as a security baseline under DPDP
- Conduct transition assessment: map existing SPDI compliance to DPDP gaps
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Is SPDI Rules 2011 still in force after DPDP Act 2023?+
The government has indicated DPDP Act will supersede SPDI Rules. However, SPDI Rules have not been formally repealed as of 2026 — follow official MeitY notifications for confirmation.
What were the key limitations of SPDI Rules 2011?+
SPDI Rules had limited scope (only sensitive data), weak penalties, no data subject rights framework, and covered only companies under the IT Act. DPDP Act comprehensively addresses all these gaps.
Do organisations need to redo contracts written to comply with SPDI?+
Yes. Contracts with SPDI-compliance language should be updated to reference DPDP obligations. SPDI DPA language is insufficient for DPDP.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
