The Digital Personal Data Protection Act 2023 (DPDPA) is India's comprehensive data protection law that governs how organizations collect, process, store, and transfer personal data of Indian citizens. It was notified on August 11, 2023, with the DPDP Rules 2025 published on November 13, 2025, and full enforcement beginning May 13, 2027.

When does DPDPA 2023 come into full force?

DPDPA 2023 comes into full force on May 13, 2027, which is 18 months after the notification of DPDP Rules 2025 on November 13, 2025. Consent Manager registration must be completed within 12 months (by November 2026).

What are the penalties under DPDPA 2023?

DPDPA 2023 prescribes penalties up to ₹250 crore for the most severe violations including failure to implement reasonable security safeguards leading to data breaches. Lesser penalties apply for other violations such as failure to notify breaches (up to ₹200 crore) or non-compliance with data principal rights (up to ₹50 crore).

What is a Significant Data Fiduciary under DPDPA?

A Significant Data Fiduciary (SDF) is a Data Fiduciary notified by the Central Government based on factors like volume and sensitivity of personal data processed, risk to data principal rights, potential impact on sovereignty and integrity of India, and risk to electoral democracy. SDFs have additional obligations including appointing a Data Protection Officer and conducting Data Protection Impact Assessments.

What are Data Principal rights under DPDPA 2023?

Under DPDPA 2023, Data Principals have the right to: access information about their personal data being processed, request correction and erasure of data, grievance redressal, nominate another person to exercise rights in case of death or incapacity, and withdraw consent at any time with the same ease as giving consent.

How does DPDPA handle cross-border data transfers?

DPDPA 2023 adopts a blacklist approach for cross-border data transfers. Personal data can be transferred to any country except those specifically restricted by the Central Government through notification. This is different from GDPR's adequacy-based whitelist approach.

DPDPA Compliance Playbook | 12-Step Implementation Roadmap

Strategic Implementation Manual

Operational Playbook

An exhaustive structural realignment manual for the post-May 13, 2027 environment. Engineered for technical and regulatory finality.

Active Implementation Phases

Technical RiskTIER I

Threshold & Entity Classification

Establishing the precise statutory scope for the fiduciary in the active DPDPA era.

Operational Directives

Calculate 'Active Principal' count (>5M threshold analysis)
Evaluate 'High-Risk' processing (Predictive Profiling, Tracking)
Map Fiduciary-Processor-Principal relationships

Detailed Sub-Steps

Principal Volume Discovery

Query production databases and cold storage archives to identify unique 'Data Principals' using hashed identifiers to avoid double-counting across siloed systems.

SDF Notification Triage

Review processing activities against the 'Public Order' and 'State Security' benchmarks established in Section 10(1) to anticipate government notification.

Jurisdictional Nexus Check

Verify Section 3(b) applicability for data processed outside India in connection with profiling or offering goods/services to principals within India.

Structural Logic

Determination of 'Significant Data Fiduciary' (SDF) status is the foundational compliance step. Under Section 10(1), the Central Government evaluates volume of data principals, sensitivity of personal data, risk to electoral democracy, and public order. Classification dictates the appointment of a resident DPO and independent audit mandates.

Technical Specifications

$ Principal Volume Assessment
$ SDF Threshold Analysis
$ Entity Relationship Mapping

Begin Classification

Operational Playbook

Threshold & Entity Classification

Itemized Notice & Multi-Lingual Delivery

Consent Manager Integration

Duty of Structural Data Accuracy

Security Safeguards Implementation

Breach Notification & Board Reporting

Data Principal Rights (DPR) Automation

Active Grievance Redressal Architecture

Child Data Protection & VPC Flow

SDF Mandate: DPIA & Independent Audit

Transborder Transfer & Geofencing

Strategic Enforcement & Undertakings

Threshold & Entity Classification

Operational Directives

Detailed Sub-Steps

Structural Logic

Technical Specifications