Does your organisation collect personal information from anyone in Canada? If so, you are likely subject to one of the country’s most important privacy laws. PIPEDA, short for the Personal Information Protection and Electronic Documents Act, sets out clear rules for how private sector organisations must handle personal data.
Failing to meet PIPEDA compliance requirements can result in regulatory action, financial penalties, and a serious loss of customer trust. This guide breaks down every major obligation under PIPEDA. From consent rules and data collection limits to breach reporting and individual access rights, each requirement is covered in a clear, structured format.
Whether you are a compliance officer, a business owner, or part of a legal team, this blog gives you a practical understanding of what the law expects. Read on!
The DPDP Act is India’s first comprehensive legislation dedicated exclusively to protecting personal data in the digital space.
India’s journey toward data protection legislation began in 2017 after the Supreme Court’s landmark ruling in the Puttaswamy case. The court declared privacy a fundamental right under the Indian Constitution. This decision triggered years of policy development, multiple draft bills and extensive public consultation.
The Digital Personal Data Protection Bill was introduced in Parliament in August 2023. Both houses passed it within days. President Droupadi Murmu granted assent on 11 August 2023, and the Act was published in the official Gazette on 12 August 2023. The DPDP Rules, which provide the operational framework, were notified on 14 November 2025.
The DPDP Act applies to the processing of digital personal data within India. It also covers data processed outside India if it relates to offering goods or services to individuals in India. The Act governs both automated and non-automated processing, provided the data is in digital form or has been digitised.
Its primary purpose is to balance the right of individuals to protect their personal data with the legitimate need of organisations to process that data. Unlike sector-specific regulations India had before, this Act creates a unified framework for all industries.
Before this Act, India relied on the Information Technology Act, 2000 and its associated rules for data protection. Those provisions were limited in scope and lacked enforcement teeth. The DPDP Act introduces a purpose-built regulatory body, defines individual rights and imposes significant financial penalties. It draws parallels, but is tailored to India’s digital landscape and governance structure.
Understanding the DPDP Act starts with knowing the roles and terms it defines, as these shape every obligation and right within the framework.
A Data Principal is the individual whose personal data is being collected or processed. This is equivalent to a “data subject” under the GDPR. Every Indian resident whose digital personal data is handled by an organisation is a Data Principal under this Act.
A Data Fiduciary is any entity, whether a company, government body or individual, that determines the purpose and means of processing personal data. The term mirrors “data controller” in European law. Data Fiduciaries carry the primary responsibility for lawful data handling and compliance.
The Central Government can classify certain Data Fiduciaries as Significant Data Fiduciaries (SDFs) based on factors such as the volume and sensitivity of data processed and potential impact on sovereignty, public order or individual rights. SDFs face additional obligations including appointing a Data Protection Officer based in India and conducting periodic Data Protection Impact Assessments.
A Data Processor handles personal data on behalf of the Data Fiduciary. A Consent Manager is a registered entity that provides an accessible, transparent platform through which individuals can give, manage, review and withdraw their consent. Consent Managers must be registered with the Data Protection Board of India.
Consent sits at the heart of the DPDP Act and defines how organisations must approach personal data collection from the outset.
The DPDP Act requires consent to be free, specific, informed, unconditional and unambiguous. It must be given through a clear affirmative action. Pre-ticked boxes, bundled consents or blanket permissions do not qualify. Each purpose of data processing needs separate, identifiable consent from the Data Principal.
Before collecting data, the Data Fiduciary must issue a clear notice to the individual. This notice must specify the personal data being collected, the purpose of processing and the right to withdraw consent at any time. The DPDP Rules require this notice to be available in English and all 22 languages listed in the Eighth Schedule of the Indian Constitution.
Data Principals have the right to withdraw consent at any point. Once consent is withdrawn, the Data Fiduciary must stop processing and delete the data, unless retention is required by another law. The withdrawal process must be as simple as the process used to give consent. A study found that 69% of Indian consumers did not know they could withdraw consent for data usage, highlighting the awareness gap organisations must address.
The Act grants individuals a set of enforceable rights that give them meaningful control over their personal data.
Every Data Principal has the right to obtain a summary of the personal data being processed and the processing activities undertaken by the Data Fiduciary. This right ensures transparency and allows individuals to verify that their data is being used as consented.
Individuals can request correction of inaccurate or misleading data. They can also request complete erasure of their personal data when it is no longer needed for the stated purpose. This closely mirrors the mechanisms used under the GDPR framework.
Data Principals can raise complaints directly with the Data Fiduciary. If unresolved, they can escalate to the Data Protection Board of India. The Act also introduces a unique right of nomination, allowing individuals to appoint someone to exercise their data rights in the event of death or incapacity.
The Act places the responsibility for compliant data handling squarely on Data Fiduciaries, with specific duties they must fulfil.
Every Data Fiduciary must implement reasonable security safeguards to protect personal data. In the event of a data breach, notification to the Data Protection Board and affected individuals is mandatory. The average cost of a data breach in India reached INR 19.5 crore in 2024, a 39% increase since 2020, making breach prevention a financial imperative as well.
Personal data may only be processed for the specific purpose communicated to the Data Principal. Once that purpose is fulfilled or consent is withdrawn, the data must be erased. Data Fiduciaries cannot retain data indefinitely. Retention periods must align with legal requirements and stated purposes.
Significant Data Fiduciaries carry heightened responsibilities. These include appointing an India-based Data Protection Officer, conducting annual Data Protection Impact Assessments and engaging independent data auditors. These measures ensure that entities processing large volumes maintain the highest compliance standards.
The Act introduces specific safeguards for children’s personal data, recognising their vulnerability in the digital environment.
Before processing any personal data of a child (anyone below 18 years), the Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. The Act does not permit behavioural monitoring or targeted advertising directed at children. The PwC survey revealed that 72% of consumers were unaware that parental consent was required for processing minors’ data.
Data Fiduciaries are prohibited from tracking, profiling or targeting children through their personal data. Any processing that could cause harm to a child is strictly barred. The penalty for violating children’s data protection provisions can reach up to INR 200 crore.
The Central Government may exempt certain classes of Data Fiduciaries, such as healthcare or educational institutions, from the requirement of verifiable parental consent. These exemptions apply only when the processing is demonstrably in the child’s best interest and is carried out with adequate safeguards.
The DPDP Act takes a flexible approach to international data transfers, departing from earlier restrictive proposals.
Unlike earlier drafts that proposed strict data localisation, the DPDP Act permits Data Fiduciaries to transfer personal data to any country or territory outside India for processing. However, the Central Government reserves the right to restrict transfers to specific countries through official notifications.
The Act follows a “blacklist” model rather than a “whitelist” model. All countries are permitted unless specifically restricted. This approach provides operational flexibility for multinational businesses operating in India while ensuring the government retains control over data flows to jurisdictions with weak privacy protections.
For businesses operating across multiple jurisdictions, the DPDP Act’s transfer provisions must be read alongside other regulations such as the GDPR and other regional laws. Cross-border data governance strategies must account for each jurisdiction’s requirements to avoid compliance gaps.
Even well-intentioned training programmes fall short when organisations repeat these common errors.
The Act prescribes graduated penalties based on the nature of the violation:
The DPBI is the independent regulatory body established under the Act. It adjudicates complaints, determines non-compliance and imposes penalties. The Board operates as a digital office, conducting proceedings electronically. Appeals against DPBI decisions are heard by the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
The maximum penalty of INR 250 crore (approximately USD 30 million) is lower than the GDPR’s 4% of global turnover cap. However, for most Indian businesses, these fines represent significant financial exposure. The Act focuses on per-incident penalties rather than revenue-based calculations, which means even mid-sized companies face serious consequences for violations.
While the Act establishes broad compliance obligations, it carves out specific exemptions for particular scenarios and entities.
Processing is exempt when carried out in the interest of national security, sovereignty or public order, as directed by the Central Government. Law enforcement agencies and judicial bodies are also exempt when processing data for investigation, prosecution or legal proceedings.
Personal data processed for research, archiving or statistical purposes is exempt, provided it is not used to make decisions affecting specific individuals. This exemption supports academic research and government statistical activities without compromising individual privacy.
Data made voluntarily public by the individual, processing required under any Indian law or court order and processing related to approved corporate mergers or restructuring are all exempt from certain consent requirements. These exemptions ensure the Act does not obstruct established legal and business processes.
The operational framework of the Act took shape with the notification of the DPDP Rules, which set specific compliance milestones businesses must meet.
Organisations must revalidate consent for personal data collected before the Act came into force. This legacy data revalidation must be completed by November 2026. Businesses that fail to obtain fresh consent must stop processing and delete the affected data.
With 80% of organisations in the PwC survey expecting compliance challenges, early preparation is essential. Businesses should conduct data mapping exercises, update privacy notices, and implement and train their teams on the Act’s requirements. Waiting until enforcement deadlines approach will make compliance far more costly and disruptive.
The Act’s impact varies across industries depending on the volume and type of personal data each sector handles.
Banks and financial institutions process vast amounts of personal and financial data daily. They face significant compliance requirements around user consent, data retention and breach notification. Many large financial entities are likely to be classified as Significant Data Fiduciaries, triggering additional audit and reporting obligations.
These sectors handle highly sensitive personal information, including medical records and student data. The Act’s provisions on children’s data are particularly relevant for educational institutions. Healthcare providers must balance data protection with the need for accessible patient records and research.
Technology companies and e-commerce platforms that rely heavily on user data for personalisation, analytics and advertising face the most sweeping changes. The Act’s consent requirements, restrictions on behavioural tracking and cross-border transfer rules will require fundamental changes to how these businesses collect and use data.
Comparing the two frameworks helps multinational businesses understand where compliance overlaps and where separate strategies are needed.
Both laws require explicit consent for data processing, grant individuals rights over their data and impose significant penalties for violations. Both establish independent regulatory bodies. Concepts like data minimisation, purpose limitation and breach notification are common to both frameworks.
The GDPR calculates fines as a percentage of global turnover, while the DPDP Act uses fixed maximum amounts per incident. The GDPR has a “whitelist” approach for cross-border transfers through adequacy decisions, while the DPDP Act uses a “blacklist” approach. The DPDP Act currently does not include a formal right to data portability, which the GDPR does. Consent remains a useful reference point, but it cannot simply be replicated for DPDP compliance.
Businesses operating in both India and the EU must build compliance programmes that satisfy both frameworks. Shared principles around consent and data security provide a foundation, but specific requirements around transfer mechanisms, regulatory filings and data subject rights differ enough to require tailored approaches for each jurisdiction.
The Digital Personal Data Protection (DPDP) Act marks a defining shift in how India governs personal data. With enforcement timelines now set and penalties reaching INR 250 crore, the cost of inaction far outweighs the effort of compliance. Organisations that invest in consent frameworks, data governance structures and privacy-aware operations today will be better positioned for regulatory readiness and long-term trust with their users.
The Digital Personal Data Protection (DPDP) Act demands clear consent, transparent notices and robust data governance. Seers.ai provides the tools businesses need to manage consent, maintain compliance records and meet regulatory deadlines. Start building your compliance framework before enforcement begins.
Start Free TodayThe DPDP Act applies to every organisation that processes digital personal data within India. It also covers entities outside India if they offer goods or services to individuals in India. Both private companies and government bodies fall under its scope. The Act does not distinguish by industry or size, making compliance a universal requirement for data-handling entities.
A Data Fiduciary decides why and how personal data is collected and processed. A Data Processor carries out data processing activities on behalf of the Data Fiduciary. The key distinction lies in decision-making authority. The Data Fiduciary holds primary legal responsibility for compliance, while the Data Processor must follow the Fiduciary’s instructions and maintain adequate security measures.
Full enforcement is expected by May 2027, when the Data Protection Board of India gains complete adjudicatory and penalty powers. The DPDP Rules were notified in November 2025, triggering an 18-month transition period. Active regulatory supervision begins from November 2026. Businesses should treat 2026 as their primary compliance preparation year.
The Act permits data transfers to any country unless the Central Government specifically restricts a jurisdiction through official notification. This “blacklist” approach differs from the GDPR’s adequacy-based “whitelist” model. Businesses can transfer data internationally by default, but must monitor government notifications for any newly restricted destinations.
The highest penalty under the Act is INR 250 crore (approximately USD 30 million) for failure to implement reasonable security safeguards. Breach notification failures can attract penalties up to INR 200 crore. Penalties are calculated per incident, meaning multiple violations can result in cumulative fines that substantially exceed these individual limits.
The Data Protection Board of India (DPBI) serves as the independent regulatory body under the Act. It receives and adjudicates complaints from Data Principals, determines non-compliance, imposes penalties and issues directions. The Board operates digitally, and its decisions can be appealed before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Organisations must revalidate consent for all personal data collected before the Act’s enforcement. This legacy data revalidation is expected to be completed by November 2026. If fresh consent cannot be obtained, the organisation must cease processing and delete the affected data. Ignoring this requirement exposes businesses to regulatory action.
Only Significant Data Fiduciaries (SDFs) are required to appoint a Data Protection Officer based in India. SDFs are classified by the Central Government based on data volume, sensitivity and potential impact. Regular Data Fiduciaries are not mandated to appoint a DPO, but must still designate a contact person for Data Principal grievances.
Preparation should begin with a comprehensive data mapping exercise to identify all personal data processing activities. Organisations must update their privacy notices, implement robust consent mechanisms and train staff on compliance requirements. Building a formal data governance framework, establishing breach response protocols and engaging with registered Consent Managers are all critical steps.
The Act requires verifiable parental or guardian consent before processing any personal data of individuals below 18 years. Behavioural monitoring, tracking and targeted advertising directed at children are prohibited. Certain entities such as healthcare or educational institutions may receive exemptions if processing is demonstrably in the child’s best interest.
Take our Free Cookie Audit and find out
Join 50,000+ websites using Seers.Ai to turn compliance into trust, insights, & measurable business growth.
