The Digital Personal Data Protection Act 2023 (DPDPA) is India's comprehensive data protection law that governs how organizations collect, process, store, and transfer personal data of Indian citizens. It was notified on August 11, 2023, with the DPDP Rules 2025 published on November 13, 2025, and full enforcement beginning May 13, 2027.

When does DPDPA 2023 come into full force?

DPDPA 2023 comes into full force on May 13, 2027, which is 18 months after the notification of DPDP Rules 2025 on November 13, 2025. Consent Manager registration must be completed within 12 months (by November 2026).

What are the penalties under DPDPA 2023?

DPDPA 2023 prescribes penalties up to ₹250 crore for the most severe violations including failure to implement reasonable security safeguards leading to data breaches. Lesser penalties apply for other violations such as failure to notify breaches (up to ₹200 crore) or non-compliance with data principal rights (up to ₹50 crore).

What is a Significant Data Fiduciary under DPDPA?

A Significant Data Fiduciary (SDF) is a Data Fiduciary notified by the Central Government based on factors like volume and sensitivity of personal data processed, risk to data principal rights, potential impact on sovereignty and integrity of India, and risk to electoral democracy. SDFs have additional obligations including appointing a Data Protection Officer and conducting Data Protection Impact Assessments.

What are Data Principal rights under DPDPA 2023?

Under DPDPA 2023, Data Principals have the right to: access information about their personal data being processed, request correction and erasure of data, grievance redressal, nominate another person to exercise rights in case of death or incapacity, and withdraw consent at any time with the same ease as giving consent.

How does DPDPA handle cross-border data transfers?

DPDPA 2023 adopts a blacklist approach for cross-border data transfers. Personal data can be transferred to any country except those specifically restricted by the Central Government through notification. This is different from GDPR's adequacy-based whitelist approach.

How much is DPDPA penalty?

DPDPA penalties range from ₹10,000 to ₹250 crore depending on the violation. The maximum penalty of ₹250 crore applies to failure to implement reasonable security safeguards resulting in data breaches. Failure to notify breaches can attract up to ₹200 crore, while non-compliance with data principal rights can result in penalties up to ₹50 crore.

What is 72 hour breach notification under DPDPA?

Under DPDPA 2023 and DPDP Rules 2025, Data Fiduciaries must provide a detailed breach report to the Data Protection Board within 72 hours of becoming aware of a personal data breach. The initial intimation must be given without unreasonable delay. The 72-hour report must include breach details, affected data principals, and remedial measures taken.

Is DPDPA applicable to foreign companies?

Yes, DPDPA 2023 has extraterritorial applicability. It applies to processing of personal data outside India if such processing is in connection with offering goods or services to Data Principals in India. Foreign companies processing Indian citizens' data must comply with DPDPA requirements.

How to become a Consent Manager under DPDPA?

To become a registered Consent Manager under DPDPA, you must apply to the Data Protection Board of India. Requirements include: being incorporated in India, having adequate technical and organizational capacity, maintaining an accessible and interoperable platform, and meeting prescribed capital and infrastructure requirements. Registration deadline is 12 months from DPDP Rules notification (by November 2026).

What is verifiable parental consent under DPDPA?

Verifiable parental consent under DPDPA means obtaining consent from a parent or lawful guardian before processing personal data of children (persons below 18 years). The verification mechanism must reasonably ensure that the person giving consent is the child's parent or guardian. Processing children's data without verifiable parental consent is prohibited.

What documents are needed for DPDPA compliance?

Key documents for DPDPA compliance include: Privacy Notice, Consent Records, Data Processing Register, Data Protection Impact Assessments (for SDFs), Breach Response Plan, Data Principal Rights Procedures, Vendor/Data Processor Agreements, Cross-border Transfer Assessments, Training Records, and Audit Reports. SDFs must also maintain DPO appointment documentation.

Back to Compliance Playbook

Procedural Guide

Preparing for a DPDPA Compliance Audit

A comprehensive framework for Data Fiduciaries to maintain audit readiness and prepare for compliance reviews by internal auditors, external assessors, and the Data Protection Board.

Statutory Foundation

Section 10(2)(c) of DPDPA 2023 requires Significant Data Fiduciaries to undertake periodic audits of compliance with the Act and furnish reports to the Data Protection Board.

Section 28 of DPDPA 2023 empowers the Data Protection Board to conduct inquiries and inspections to verify compliance with the provisions of the Act.

Types of Compliance Audits

Internal Audit

Periodic assessment conducted by internal audit function or privacy team to verify ongoing compliance.

Quarterly or as per internal policy

External Audit

Independent assessment by qualified external auditors as required for Significant Data Fiduciaries.

Annually (for SDFs)

Board Inspection

Examination by the Data Protection Board or authorised officers pursuant to inquiry or complaint.

As directed by Board

Audit Preparation Procedure

Establish Audit Schedule

Develop annual audit calendar specifying internal review cycles, external audit periods, and deadlines for submission of reports to the Board. Communicate schedule to all relevant stakeholders.

Assign Audit Liaison

Designate a senior officer to coordinate audit activities, serve as primary contact for auditors, and ensure timely provision of information and access.

Document Inventory

Compile and organise all compliance documentation including policies, procedures, records, and evidence of implementation. Maintain centralised repository with version control.

Gap Assessment

Conduct pre audit gap assessment against DPDPA requirements. Identify deficiencies and develop remediation plan. Document progress on remediation efforts.

Evidence Preparation

Gather evidence of compliance for each DPDPA requirement including training records, consent logs, breach notifications, DPIA reports, and DPO activities.

Staff Briefing

Brief relevant personnel on audit scope, timeline, and their responsibilities. Ensure staff understand the importance of cooperation and accurate information provision.

System Access Preparation

Prepare for auditor access to relevant systems. Ensure audit logs are enabled and accessible. Arrange demonstration of technical controls and processing activities.

Meeting Facilities

Arrange appropriate meeting facilities for auditors. Ensure secure environment for document review and interviews. Prepare schedule of interviews with key personnel.

Audit Documentation Checklist

Governance Documentation

Data protection policy and procedures

Board resolutions on privacy governance

DPO appointment and terms of reference

Organisational chart showing privacy function

Role and responsibility matrix

Compliance reporting structure

Operational Documentation

Data inventory and processing records

Privacy notices and consent forms

Consent management records

Data Principal request logs

Breach notification records

DPIA reports and risk registers

Technical Documentation

Security safeguards documentation

Access control policies and logs

Encryption implementation records

Data flow diagrams

Third party processor agreements

Cross border transfer assessments

Training and Awareness

Training curriculum and materials

Training attendance records

Competency assessment results

Awareness communication records

Staff acknowledgment forms

Periodic refresher training logs

Responding to Board Inspections

Statutory Obligations

• Cooperate fully with authorised officers of the Board
• Provide access to premises, systems, and documents as required
• Furnish information and documents within prescribed timelines
• Make relevant personnel available for interview
• Ensure preservation of relevant records pending inspection
• Refrain from destruction or alteration of evidence

Obstruction of Board proceedings may attract penalties under Section 33 and may constitute contempt under Section 32 of DPDPA 2023.

Compliance Timeline

Audit Requirements

Significant Data Fiduciaries must conduct annual audits and submit reports to the Data Protection Board. The first audit cycle commences upon notification as a Significant Data Fiduciary.

All Data Fiduciaries must be prepared for Board inspections at any time and should maintaincontinuous audit readiness from the full enforcement date of 13th May 2027.

Disclaimer

This guidance is provided for informational purposes and does not constitute legal advice. Audit requirements for Significant Data Fiduciaries may be further specified by the DPDP Rules. Organisations should establish documented audit procedures reviewed by qualified professionals.