Is your organisation prepared to meet every obligation under India’s data protection framework before the enforcement deadline hits? With the Digital Personal Data Protection Act now active and the DPDP Rules 2025 setting clear timelines, businesses across India face a defining moment. DPDP Act compliance requirements are not optional guidelines. They are legally binding mandates that carry penalties of up to INR 250 crore for non-compliance.
This blog covers the full scope of DPDP Act compliance requirements that every organisation processing personal data of Indian residents must follow. Whether you operate as a data fiduciary, a significant data fiduciary, or a data processor, these obligations apply to you. The compliance deadline of May 2027 may seem distant, but the operational changes required are substantial.
From consent management and breach reporting to children’s data protection and cross-border transfer rules, this guide breaks down each requirement clearly. By the end, you will have a practical understanding of what your organisation needs to do, and when it needs to be done.
The scope of DPDP Act compliance requirements extends far beyond Indian registered companies. Every entity that processes personal data of individuals in India must meet these obligations.
Any business, startup, government body, or non-profit that collects, stores, or processes personal data of Indian residents falls under this Act. This includes data collected through websites, mobile applications, physical forms that are later digitised, and third-party integrations. The Act classifies these organisations as data fiduciaries, meaning they determine the purpose and method of data processing. Building a proper consent-based marketing framework is an essential first step for any organisation starting its compliance journey.
The DPDP Act applies extraterritorially. If a company based outside India offers goods or services to Indian residents and processes their personal data, the Act applies to that entity as well. This means global SaaS platforms, e-commerce businesses, and cloud service providers with Indian users must comply with the same standards as domestic organisations.
Government agencies are not exempt. They must comply with data processing standards, particularly around transparency and purpose limitation. However, certain exemptions apply for national security, law enforcement, and public interest functions. These exemptions are narrowly defined and do not waive accountability for data protection standards entirely.
Consent sits at the core of DPDP Act compliance requirements. Organisations must establish a clear, verifiable, and transparent consent framework before processing any personal data.
Under the Act, consent must be freely given, specific, informed, unconditional, and unambiguous. Pre-ticked boxes, bundled consent, or implied agreement through continued use of a service do not qualify. Each user consent request must clearly state what data is being collected, why it is being collected, and how it will be used. The language must be plain and easy to understand.
Every consent request must be accompanied by a standalone privacy notice. This notice must be itemised, listing the specific categories of personal data being collected and the precise processing purposes. These notices must be available in English and any applicable scheduled language. Generic or bundled privacy policies do not satisfy this requirement.
Data principals must be able to withdraw their consent at any time, through a process that is as simple as granting it. Organisations cannot impose friction or penalties on consent withdrawal. Once consent is withdrawn, the data fiduciary must cease processing and delete the associated personal data unless retention is required by another law.
The DPDP Rules introduce a new role called the Consent Manager. This is an independent, India-based entity registered with the Data Protection Board. Consent Managers provide an interoperable platform where data principals can grant, review, and withdraw consent across multiple data fiduciaries from a single interface. The registration framework for Consent Managers becomes active by November 2026. Organisations should prepare their systems for integration with these platforms.
DPDP Act compliance requirements place significant operational responsibilities on data fiduciaries. These obligations cover everything from data minimisation to grievance handling.
Organisations must collect only the personal data that is strictly necessary for the stated purpose. Processing data beyond the defined scope is a direct violation. For instance, collecting a user’s location data when the service only requires an email address would breach this requirement. Every data point collected must have a documented, legitimate reason.
Personal data must be retained only as long as the collection purpose is served. Once the purpose is fulfilled, the data must be securely erased. The Rules require organisations to notify data principals at least 48 hours before automatic deletion due to account inactivity. System logs and traffic data must be retained for a minimum of one year for security detection and investigation purposes.
Organisations must implement reasonable security safeguards to protect personal data from breaches, unauthorised access, and misuse. These safeguards include encryption, data masking, obfuscation, and role-based access controls. A documented incident response plan is mandatory. The Act does not prescribe specific technologies, but the safeguards must be proportionate to the sensitivity of the data being processed. Deploying a reliable cookie consent solution for enterprise organisations can help standardise security and consent practices across multiple digital touchpoints.
Every data fiduciary must publish clear and accessible grievance redressal contact points. Data principals must be able to raise complaints about data processing practices, and the organisation must respond within a defined timeframe. The maximum response window is 90 days. If the organisation fails to address the grievance satisfactorily, the data principal can escalate the matter to the Data Protection Board.
Organisations that the Central Government designates as Significant Data Fiduciaries face a higher standard of DPDP Act compliance requirements. These additional obligations reflect the scale and sensitivity of their data processing activities.
The government classifies an organisation as a Significant Data Fiduciary based on the volume of personal data processed, the sensitivity of that data, and the potential risk to national security or public order. Large technology companies, financial institutions, healthcare platforms, and government bodies handling citizen data are likely candidates for this classification.
Every Significant Data Fiduciary must appoint a Data Protection Officer (DPO) who is based in India. The DPO serves as the primary point of contact for data principals, the Data Protection Board, and internal teams. This is not a part-time role. The DPO must have sufficient authority, resources, and independence to oversee compliance across the organisation.
Significant Data Fiduciaries must conduct Data Protection Impact Assessments (DPIAs) regularly. These assessments evaluate how data processing activities affect the privacy and rights of data principals. DPIAs must cover all major processing operations, identify risks, and propose mitigation measures. The results must be documented and available for regulatory review.
Annual compliance audits conducted by an independent data auditor are mandatory for Significant Data Fiduciaries. These audits verify that the organisation’s data processing practices align with the Act’s requirements. The audit findings must be submitted to the Data Protection Board, and any gaps identified must be addressed within a specified period.
A critical component of DPDP Act compliance requirements is the set of enforceable rights granted to data principals. Organisations must build systems that support these rights operationally.
Data principals have the right to obtain a summary of their personal data held by a data fiduciary, along with details of all processing activities performed on that data. Organisations must be able to generate and deliver this information within 90 days of receiving the request.
If a data principal identifies inaccurate, incomplete, or misleading personal data, they have the right to request correction. The data fiduciary must process these corrections promptly, particularly when the data is used to make decisions that affect the individual.
Data principals can request the deletion of their personal data when the processing purpose has been fulfilled. The fiduciary must comply unless retention is required under a separate legal obligation. Understanding how sensitive personal information intersects with erasure requests is crucial, as certain categories of data may have additional retention or processing rules.
The Act introduces a nomination right, allowing data principals to designate a representative who can exercise their data rights in the event of their death or incapacity. Organisations must build mechanisms to accept and honour these nominations.
The DPDP Act sets strict standards for processing personal data of children, defined as individuals under 18 years of age. These requirements affect EdTech platforms, gaming companies, social media services, and any business with minor users.
Before processing a child’s personal data, the data fiduciary must obtain verifiable consent from the child’s parent or legal guardian. Standard consent mechanisms are not sufficient. The verification process must be robust enough to confirm the identity and authority of the consenting adult.
Organisations cannot engage in behavioural monitoring, tracking, or targeted advertising directed at children. This is a blanket prohibition with no exceptions unless the Central Government grants specific permission. Platforms that serve mixed-age audiences must implement age verification systems to separate child users from adults.
Data fiduciaries cannot process children’s data in any manner that is likely to cause a detrimental effect on the child’s wellbeing. This broad standard requires organisations to evaluate their data practices through the lens of child safety, not just data protection.
DPDP Act compliance requirements impose a strict, time-bound breach notification protocol that demands operational readiness from every data fiduciary.
When a personal data breach occurs, the data fiduciary must report it to the Data Protection Board of India within 72 hours of discovery. The report must include details about the nature of the breach, the categories and approximate number of data principals affected, the likely consequences, and the measures taken or proposed to address the breach.
Alongside the Board notification, the data fiduciary must inform affected data principals without delay. The notification must be clear, accessible, and delivered through appropriate channels. Organisations that have invested in best consent management platforms will find it easier to identify affected individuals and communicate breach details efficiently, as these platforms maintain structured records of data processing activities.
Organisations must maintain automated breach detection systems, documented escalation procedures, and trained incident response teams. Regular tabletop exercises and drills are recommended to test the effectiveness of these systems. The ability to detect, contain, and report a breach within the 72-hour window is not achievable without prior investment in detection infrastructure.
The DPDP Act takes a controlled but flexible approach to international data transfers. These rules are a key part of DPDP Act compliance requirements for organisations with global operations.
Unlike some global frameworks that require adequacy assessments for every transfer, the DPDP Act uses a negative list model. Personal data can be transferred to any country unless the Central Government specifically restricts transfers to that country. The restricted list has not yet been fully published, so organisations must monitor government notifications closely.
Regardless of destination, data fiduciaries must document all cross-border data movements. This includes recording which data was transferred, to whom, for what purpose, and under what safeguards. These records must be maintained as part of the organisation’s compliance documentation and made available for audit if required.
When personal data is processed by a third party outside India, the data fiduciary must ensure appropriate contractual safeguards are in place. These contracts must obligate the processor to maintain the same level of data protection as required under the DPDP Act. Reviewing how GDPR vs CCPA approaches compare with the DPDP Act’s framework can help multinational organisations align their cross-border policies across jurisdictions.
While consent is the primary ground for processing, DPDP Act compliance requirements recognise several situations where personal data can be processed without explicit consent.
Personal data can be processed without consent when it is necessary for the State to provide benefits, subsidies, services, certificates, licences, or permits. This exemption ensures that public service delivery is not hindered by consent requirements, provided the processing remains proportionate and purpose-limited.
In situations involving a threat to the life or health of the data principal, processing can occur without consent. This applies to emergency medical treatment, epidemic response, and disaster management scenarios where obtaining consent is practically impossible.
Employers can process employee personal data without separate consent for purposes such as payroll, attendance, and regulatory reporting, provided the data principal has been given a privacy notice and the processing is limited to the employment relationship.
Processing personal data is permitted without consent when it is required for compliance with a court order, legal proceeding, or statutory obligation. This includes regulatory filings, tax compliance, and law enforcement cooperation.
Failing to meet DPDP Act compliance requirements carries significant financial consequences. The penalty framework is designed to be proportionate but substantial enough to deter negligence.
The Act allows the Data Protection Board to impose penalties of up to INR 250 crore (approximately USD 30 million) for the most severe violations. This includes failures in data security, unauthorised data processing, and non-compliance with breach notification obligations. Lesser violations carry penalties of up to INR 50 crore, INR 15 crore, or INR 10 crore, depending on the nature and severity of the breach.
All penalties are deposited into India’s Consolidated Fund. The Data Protection Board determines the final amount after a thorough investigation, giving organisations the opportunity to present their case.
DPDP Act compliance requirements follow a phased enforcement model. Organisations must track these milestones and align their implementation plans accordingly.
Organisations that delay preparation until the final deadline risk operational disruption and regulatory exposure. The scope of changes required across technology, processes, and governance structures demands early action.
Meeting DPDP Act compliance requirements is a structured process. This checklist provides a practical roadmap for organisations at any stage of readiness.
Conduct a comprehensive audit of all data flows, systems, and vendors processing personal data linked to Indian residents. Document every collection point, storage location, processing purpose, and data sharing arrangement. This mapping exercise forms the foundation of every subsequent compliance action.
Redesign all consent interfaces to require affirmative action. Draft standalone, plain language privacy notices that itemise data categories and processing purposes. Build easy withdrawal mechanisms into every digital touchpoint. Test these interfaces for accessibility and clarity across all user segments.
Implement encryption, access controls, data masking, and continuous monitoring systems. Design automated breach detection workflows with clear escalation paths. Create templated 72-hour notification reports for both the Board and affected individuals. Train incident response teams and conduct regular exercises.
Appoint a Data Protection Officer if designated as a Significant Data Fiduciary. Publish grievance redressal contact information prominently across all platforms. Establish data retention schedules with automated deletion protocols. Maintain auditable records of all processing activities, consent logs, and breach incidents.
The Data Protection Board is the enforcement body overseeing DPDP Act compliance requirements. Understanding its role helps organisations prepare for regulatory interactions.
The Board operates as a fully digital office. Complaints are filed online, hearings are conducted virtually, and decisions are published electronically. This makes it accessible to data principals across the country, reducing barriers to enforcement.
Data principals who exhaust internal grievance mechanisms with a data fiduciary can escalate their complaint to the Board. The Board investigates the complaint, hears both parties, and determines whether a violation occurred. Penalties are imposed only after a thorough examination of the facts and circumstances.
Decisions of the Data Protection Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). This provides a judicial review mechanism that ensures fairness in enforcement outcomes.
DPDP Act compliance requirements represent a fundamental shift in how Indian businesses handle personal data. From consent management and breach reporting to children’s data protection and cross-border transfers, every obligation demands deliberate planning and execution. Organisations that act now will not only avoid penalties but also build stronger trust with their users and partners. The May 2027 deadline is firm, and the time to prepare is today.
Meeting DPDP Act compliance requirements does not have to be overwhelming. Seers.ai provides a comprehensive compliance platform that helps organisations manage consent, automate privacy notices, and maintain audit-ready records. From consent management to breach response readiness, Seers simplifies every step of your compliance journey.
Start Free TodayDPDP Act compliance requirements are the legal obligations that organisations processing personal data of Indian residents must meet. These include obtaining valid consent, implementing security safeguards, maintaining data retention schedules, enabling data principal rights, reporting breaches within 72 hours, and appointing a Data Protection Officer for Significant Data Fiduciaries. Each requirement ensures personal data is handled responsibly and transparently.
The full compliance deadline is May 2027. However, the Data Protection Board became operational in November 2025, and the Consent Manager registration framework activates by November 2026. Organisations should not wait until the final deadline, as the operational and technical changes required are extensive and time-consuming to implement properly.
The Central Government designates Significant Data Fiduciaries based on the volume of personal data processed, the sensitivity of that data, and the potential risk to national security or public order. Large technology platforms, financial institutions, healthcare providers, and government bodies handling citizen data are the most likely candidates. These entities face additional obligations including mandatory DPIAs and annual compliance audits.
The Act requires verifiable parental or guardian consent before processing any personal data of children under 18. It also prohibits behavioural monitoring, tracking, and targeted advertising directed at minors. Platforms serving mixed-age audiences must implement age verification mechanisms. Processing children’s data in a manner likely to cause detrimental effects on their wellbeing is strictly forbidden.
The DPDP Act allows cross-border data transfers to any country unless the Central Government specifically restricts transfers to that destination through a negative list notification. Organisations must document all international data movements and ensure contractual safeguards with overseas processors. The restricted country list is expected to be published progressively, so businesses must monitor government notifications regularly.
Penalties range up to INR 250 crore (approximately USD 30 million) for the most severe violations, such as inadequate security leading to breaches or unauthorised data processing. The Data Protection Board determines the final penalty after investigating the violation, considering factors like severity, duration, number of affected individuals, and whether the organisation attempted to mitigate the harm. Lesser violations carry penalties of INR 10 crore to INR 50 crore.
A Consent Manager is an independent, India-based entity registered with the Data Protection Board. It provides an interoperable platform where data principals can grant, review, and withdraw consent across multiple data fiduciaries from a single interface. The registration framework becomes active by November 2026. Organisations should prepare their systems for integration with Consent Manager platforms ahead of this deadline.
A Data Protection Officer is mandatory only for organisations classified as Significant Data Fiduciaries by the Central Government. However, all data fiduciaries must publish grievance redressal contact points and designate a responsible person for handling data principal requests. Even if not required to appoint a formal DPO, organisations benefit from having a dedicated privacy lead to manage compliance activities.
The Act mandates reasonable security safeguards proportionate to the sensitivity of the data being processed. This includes encryption, data masking, obfuscation, role-based access controls, and continuous monitoring systems. Organisations must also maintain documented incident response procedures, breach detection mechanisms, and ensure system logs are retained for at least one year for security investigation purposes.
Data principals must first raise their complaint with the data fiduciary through its published grievance channels. The organisation has up to 90 days to respond. If the response is unsatisfactory or absent, the data principal can escalate the complaint to the Data Protection Board of India through its online portal. The Board then investigates and may impose penalties if a violation is confirmed.
Take our Free Cookie Audit and find out
Join 50,000+ websites using Seers.Ai to turn compliance into trust, insights, & measurable business growth.
