The Digital Personal Data Protection Act 2023 (DPDPA) is India's comprehensive data protection law that governs how organizations collect, process, store, and transfer personal data of Indian citizens. It was notified on August 11, 2023, with the DPDP Rules 2025 published on November 13, 2025, and full enforcement beginning May 13, 2027.

When does DPDPA 2023 come into full force?

DPDPA 2023 comes into full force on May 13, 2027, which is 18 months after the notification of DPDP Rules 2025 on November 13, 2025. Consent Manager registration must be completed within 12 months (by November 2026).

What are the penalties under DPDPA 2023?

DPDPA 2023 prescribes penalties up to ₹250 crore for the most severe violations including failure to implement reasonable security safeguards leading to data breaches. Lesser penalties apply for other violations such as failure to notify breaches (up to ₹200 crore) or non-compliance with data principal rights (up to ₹50 crore).

What is a Significant Data Fiduciary under DPDPA?

A Significant Data Fiduciary (SDF) is a Data Fiduciary notified by the Central Government based on factors like volume and sensitivity of personal data processed, risk to data principal rights, potential impact on sovereignty and integrity of India, and risk to electoral democracy. SDFs have additional obligations including appointing a Data Protection Officer and conducting Data Protection Impact Assessments.

What are Data Principal rights under DPDPA 2023?

Under DPDPA 2023, Data Principals have the right to: access information about their personal data being processed, request correction and erasure of data, grievance redressal, nominate another person to exercise rights in case of death or incapacity, and withdraw consent at any time with the same ease as giving consent.

How does DPDPA handle cross-border data transfers?

DPDPA 2023 adopts a blacklist approach for cross-border data transfers. Personal data can be transferred to any country except those specifically restricted by the Central Government through notification. This is different from GDPR's adequacy-based whitelist approach.

How much is DPDPA penalty?

DPDPA penalties range from ₹10,000 to ₹250 crore depending on the violation. The maximum penalty of ₹250 crore applies to failure to implement reasonable security safeguards resulting in data breaches. Failure to notify breaches can attract up to ₹200 crore, while non-compliance with data principal rights can result in penalties up to ₹50 crore.

What is 72 hour breach notification under DPDPA?

Under DPDPA 2023 and DPDP Rules 2025, Data Fiduciaries must provide a detailed breach report to the Data Protection Board within 72 hours of becoming aware of a personal data breach. The initial intimation must be given without unreasonable delay. The 72-hour report must include breach details, affected data principals, and remedial measures taken.

Is DPDPA applicable to foreign companies?

Yes, DPDPA 2023 has extraterritorial applicability. It applies to processing of personal data outside India if such processing is in connection with offering goods or services to Data Principals in India. Foreign companies processing Indian citizens' data must comply with DPDPA requirements.

How to become a Consent Manager under DPDPA?

To become a registered Consent Manager under DPDPA, you must apply to the Data Protection Board of India. Requirements include: being incorporated in India, having adequate technical and organizational capacity, maintaining an accessible and interoperable platform, and meeting prescribed capital and infrastructure requirements. Registration deadline is 12 months from DPDP Rules notification (by November 2026).

What is verifiable parental consent under DPDPA?

Verifiable parental consent under DPDPA means obtaining consent from a parent or lawful guardian before processing personal data of children (persons below 18 years). The verification mechanism must reasonably ensure that the person giving consent is the child's parent or guardian. Processing children's data without verifiable parental consent is prohibited.

What documents are needed for DPDPA compliance?

Key documents for DPDPA compliance include: Privacy Notice, Consent Records, Data Processing Register, Data Protection Impact Assessments (for SDFs), Breach Response Plan, Data Principal Rights Procedures, Vendor/Data Processor Agreements, Cross-border Transfer Assessments, Training Records, and Audit Reports. SDFs must also maintain DPO appointment documentation.

Industry Guide

DPDPA Compliance for EdTech

Protecting student and children data under DPDPA 2023. Guidance for online learning platforms, schools, coaching institutes, and educational technology providers.

Critical: Children Data Processing

Section 9 of DPDPA 2023 imposes special obligations for processing children data (persons below 18 years). EdTech platforms targeting students must obtain verifiable parental consent before any processing. Violations attract penalties up to Rs 200 crore.

Who This Applies To

Online Learning Platforms

MOOCs, skill platforms, K-12 online schools

Coaching Institutes

Test prep, competitive exam coaching, tutoring

Schools & Universities

K-12 schools, colleges, universities with digital systems

Early Learning Apps

Preschool apps, children educational content

EdTech Specific Compliance Requirements

1. Verifiable Parental Consent (Section 9)

For students below 18 years, DPDPA requires verifiable parental consent. Implementation requirements:

Age Verification: Implement mechanism to identify users below 18 years at registration
Parental Contact: Collect verified parent/guardian contact details
Verification Method: Email/SMS verification, video KYC, or government ID based verification
Consent Record: Maintain auditable record of parental consent with timestamp

Note: DPDP Rules 2025 may prescribe specific methods for verifiable parental consent. Monitor MeitY notifications.

2. Prohibition on Behavioural Monitoring (Section 9(3))

Section 9(3) prohibits tracking, behavioural monitoring, or targeted advertising directed at children. For EdTech:

No personalised advertising based on child learning behaviour
No cross platform tracking of child user activity
No sale of child data to third parties for marketing
Permitted: Learning analytics for educational improvement (with parental consent)

3. Student Learning Data

EdTech platforms collect extensive learning data. DPDPA requirements:

Performance Data

Test scores, assignment grades; legitimate for educational purpose

Engagement Data

Time spent, videos watched; disclose in privacy notice

Proctoring Data

Webcam feeds, screen recordings; specific consent required

Biometric Data

Face recognition for attendance; enhanced consent and security

4. Third Party Sharing

Common EdTech data sharing scenarios:

Schools/Institutions: Sharing progress data with enrolled institution; disclose in notice
Parents: Access to child learning data is a Data Principal right
Cloud Providers: Data Processor relationship; ensure Section 8(2) contracts
Advertisers: Prohibited for children data under Section 9(3)

Distinguishing Adult and Child Users

Platforms serving both adults and minors must implement differentiated consent flows:

Adult Users (18+)

• Standard Section 6 consent
• Behavioural tracking permitted with consent
• Personalised advertising permitted with consent

Child Users (Below 18)

• Verifiable parental consent required
• No behavioural tracking or monitoring
• No targeted advertising
• Parent is Data Principal

EdTech DPDPA Compliance Checklist

Implement age verification at user registration

Build verifiable parental consent workflow for users below 18

Disable behavioural tracking and targeted ads for child accounts

Update privacy policy with clear children data disclosures

Create parent dashboard for accessing child learning data

Review proctoring solutions for DPDPA compliance

Map all student data flows including third party sharing

Establish data retention schedules for student records

Implement grievance redressal mechanism

Train content and product teams on children data restrictions

Compliance Deadline

All EdTech platforms must achieve full DPDPA compliance by 13th May 2027. Given the complexity of children data requirements, platforms should prioritise parental consent mechanisms.

Assess your compliance readiness →