The Digital Personal Data Protection Act 2023 (DPDPA) is India's comprehensive data protection law that governs how organizations collect, process, store, and transfer personal data of Indian citizens. It was notified on August 11, 2023, with the DPDP Rules 2025 published on November 13, 2025, and full enforcement beginning May 13, 2027.

When does DPDPA 2023 come into full force?

DPDPA 2023 comes into full force on May 13, 2027, which is 18 months after the notification of DPDP Rules 2025 on November 13, 2025. Consent Manager registration must be completed within 12 months (by November 2026).

What are the penalties under DPDPA 2023?

DPDPA 2023 prescribes penalties up to ₹250 crore for the most severe violations including failure to implement reasonable security safeguards leading to data breaches. Lesser penalties apply for other violations such as failure to notify breaches (up to ₹200 crore) or non-compliance with data principal rights (up to ₹50 crore).

What is a Significant Data Fiduciary under DPDPA?

A Significant Data Fiduciary (SDF) is a Data Fiduciary notified by the Central Government based on factors like volume and sensitivity of personal data processed, risk to data principal rights, potential impact on sovereignty and integrity of India, and risk to electoral democracy. SDFs have additional obligations including appointing a Data Protection Officer and conducting Data Protection Impact Assessments.

What are Data Principal rights under DPDPA 2023?

Under DPDPA 2023, Data Principals have the right to: access information about their personal data being processed, request correction and erasure of data, grievance redressal, nominate another person to exercise rights in case of death or incapacity, and withdraw consent at any time with the same ease as giving consent.

How does DPDPA handle cross-border data transfers?

DPDPA 2023 adopts a blacklist approach for cross-border data transfers. Personal data can be transferred to any country except those specifically restricted by the Central Government through notification. This is different from GDPR's adequacy-based whitelist approach.

How much is DPDPA penalty?

DPDPA penalties range from ₹10,000 to ₹250 crore depending on the violation. The maximum penalty of ₹250 crore applies to failure to implement reasonable security safeguards resulting in data breaches. Failure to notify breaches can attract up to ₹200 crore, while non-compliance with data principal rights can result in penalties up to ₹50 crore.

What is 72 hour breach notification under DPDPA?

Under DPDPA 2023 and DPDP Rules 2025, Data Fiduciaries must provide a detailed breach report to the Data Protection Board within 72 hours of becoming aware of a personal data breach. The initial intimation must be given without unreasonable delay. The 72-hour report must include breach details, affected data principals, and remedial measures taken.

Is DPDPA applicable to foreign companies?

Yes, DPDPA 2023 has extraterritorial applicability. It applies to processing of personal data outside India if such processing is in connection with offering goods or services to Data Principals in India. Foreign companies processing Indian citizens' data must comply with DPDPA requirements.

How to become a Consent Manager under DPDPA?

To become a registered Consent Manager under DPDPA, you must apply to the Data Protection Board of India. Requirements include: being incorporated in India, having adequate technical and organizational capacity, maintaining an accessible and interoperable platform, and meeting prescribed capital and infrastructure requirements. Registration deadline is 12 months from DPDP Rules notification (by November 2026).

What is verifiable parental consent under DPDPA?

Verifiable parental consent under DPDPA means obtaining consent from a parent or lawful guardian before processing personal data of children (persons below 18 years). The verification mechanism must reasonably ensure that the person giving consent is the child's parent or guardian. Processing children's data without verifiable parental consent is prohibited.

What documents are needed for DPDPA compliance?

Key documents for DPDPA compliance include: Privacy Notice, Consent Records, Data Processing Register, Data Protection Impact Assessments (for SDFs), Breach Response Plan, Data Principal Rights Procedures, Vendor/Data Processor Agreements, Cross-border Transfer Assessments, Training Records, and Audit Reports. SDFs must also maintain DPO appointment documentation.

Professional Certification Program

Earn Your DPDPA Certification

Learn and take the self test of your knowledge of the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 through our comprehensive three-phase assessment program.

Knowledge-Based Assessment

LinkedIn-Optimized Certificates

Self-Assessment Tool

Instant Certificate Generation

Assessment Information

Self-Assessment Tool

This is a free self-assessment tool designed to help you test and enhance your understanding of DPDPA 2023 and DPDP Rules 2025. No fees are charged for taking assessments or receiving certificates.

Assessment Content

All questions are based exclusively on the content available on this platform, derived from the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025. We recommend reviewing all materials before attempting the assessments.

Open the Essential Study Guide →

Three-Phase Journey

Progress through comprehensive assessments designed to validate your DPDPA expertise

Certificate Eligibility Requirement

A minimum score of 75 out of 100 is required to receive a certificate for each phase. This benchmark ensures that candidates demonstrate comprehensive knowledge and understanding of the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.

Phase 1

DPDPA Foundation Certified Professional

Comprehensive understanding of DPDPA 2023 fundamentals, consent framework, individual rights, and basic compliance requirements.

Questions

100

Duration

52 min

Pass Mark

75%

Phase 2

DPDPA Compliance Practitioner

Advanced knowledge of Significant Data Fiduciary classification, DPO obligations, international transfers, breach management, and DPDP Rules 2025.

Questions

100

Duration

75 min

Pass Mark

75%

Complete Phase 1 to unlock

Phase 3

DPDPA Compliance Expert

Expert-level mastery of penalty calculations, strategic compliance, complex governance frameworks, and advanced audit methodologies.

Questions

100

Duration

90 min

Pass Mark

75%

Complete Phase 2 to unlock

How It Works

Choose Phase

Select your certification level

Complete Exam

Answer 100 MCQs within time limit

Achieve 75%

Score 75 or higher to pass

Get Certificate

Download instantly & share

Specimen Certificate

Professional Certificate Preview

Upon successful completion, you will receive a professionally designed certificate that you can share on LinkedIn and other professional platforms.

Instant Download

Download your certificate immediately upon passing the assessment

LinkedIn Ready

Optimized format perfect for sharing on professional networks

Unique ID

Every certificate includes a unique verification ID

Frequently Asked Questions

Essential information about the DPDPA Certification Program

Who can take this certification?

Anyone interested in DPDPA compliance can take the assessments. This program is ideal for privacy professionals, data protection officers, legal counsel, compliance officers, business owners, entrepreneurs, students, and career professionals seeking to demonstrate their knowledge of the Digital Personal Data Protection Act, 2023.

How are questions sourced?

All questions are based exclusively on content from this platform, derived from the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025. We strongly recommend reviewing the diagnostic tool, best practices guide, implementation playbook, FAQ section, technical codex, and white papers before attempting the assessments.

Is the certificate recognized?

Certificates are issued jointly by AMLEGALS and DPDPA Compliance Analyser. While not a government certification, they demonstrate knowledge and understanding of law as it is aimed at making one learn about the objective, operational, and mandatory provisions of the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.

Can I retake if I fail?

Yes, you can retake any phase immediately. There is no waiting period or limit on attempts. Take your time to review the materials and attempt the assessment again when ready.

Is my data stored?

No. We follow a strict zero data retention policy compliant with DPDPA 2023. Your name is used only to generate the certificate PDF and is immediately cleared from memory after download. Only certificate metadata (ID, score, date) is stored locally in your browser. We do not use tracking, cookies, or engage in third-party data sharing.

An Academic Initiative by AMLEGALS

Certification Study Resources

Every examination question is drawn exclusively from the material below — a free, openly-accessible syllabus on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Work through these resources before attempting the three-phase assessment.

Essential Study Guide

The high-yield syllabus mapped to every exam phase — timelines, definitions, consent architecture, rights, penalties.

Open the Study Guide

DPDPA Statutory Codex

Section-by-section reference to the Digital Personal Data Protection Act, 2023 — the primary source for all questions.

Read the Codex

DPDP Rules, 2025

The operative rules notified 13 November 2025 — consent managers, breach timelines, verifiable parental consent, SDF duties.

Study the Rules

Insights & Analysis

Decision-grade briefings on the penalty framework, significant data fiduciaries, cross-border transfers and the 2025 Rules.

Insights Library Penalty Framework Significant Data Fiduciaries Cross-Border Transfers

Compliance Playbook & White Papers

Operational frameworks and long-form research on building a defensible DPDPA compliance programme.

Compliance Playbook White Papers

How-To Operational Guides

Step-by-step guidance on the duties tested in Phases 2 and 3 — DPO, DPIA, notices, consent, breach reporting, audits.

Appoint a Data Protection Officer Conduct a DPIA Draft a Privacy Notice Implement Consent Management Handle Data Principal Requests Report a Data Breach Register a Consent Manager Prepare for a DPDPA Audit

Sector Compliance Guides

How DPDPA obligations apply across regulated industries — useful for scenario-based exam questions.

Healthcare Fintech EdTech E-Commerce

Comparative Frameworks

DPDPA benchmarked against global and prior Indian regimes — sharpens the distinctions examiners test.

DPDPA vs GDPR DPDPA vs CCPA DPDPA vs IT Act, 2000

DPDPA in India — Context

The constitutional and policy backdrop — Puttaswamy, the road to enactment, and the enforcement timeline to 13 May 2027.

DPDPA in India Frequently Asked Questions

These materials are provided for educational purposes as part of AMLEGALS' data-protection knowledge initiative. They constitute general information on the law, not legal advice, and create no attorney-client relationship.