India's data-protection law,made practical.
India's Digital Personal Data Protection Act, made practical. Understand your obligations, measure your readiness, and put compliant consent and signing workflows in place — all in one place.
- ₹0cr
- Max penalty per instance
- 0
- Data Principal rights
- 2023
- Year enacted
- 2027
- 14 May 2027Enforcement deadline
Are you DPDP-ready?
Answer five quick questions and get an instant, scored read on your compliance posture — across consent, notice, Data Principal rights, grievance redressal, and breach reporting.
- Instant score across 5 core DPDP obligations
- 100% private — nothing leaves your browser
- Links straight to the full section-by-section assessment
Do you capture free, specific, informed consent before processing personal data?
DPDP §6 — consent must be unambiguous and revocable.
Learn it, assess it, then act on it
Most DPDP resources stop at explanation. This hub takes you from understanding the law to measuring your gaps to operationalising compliance.
Plain-English guides
Cut through the legalese. Clear explainers on consent, notices, Data Principal rights, breach reporting, and timelines — written for operators, not lawyers.
Browse guidesAssessInteractive tools
A full readiness assessment and a penalty calculator that turn the Act into a concrete, scored picture of where you stand and what to fix first.
Run the assessmentActCompliance-ready signing
Consent capture, audit trails, and tamper-evident records — operationalise DPDP obligations with Certinal's enterprise eSignature and e-consent platform.
See how it worksEvery DPDP obligation, mapped
Trace personal data through its full journey — and see exactly which capabilities keep you compliant at each step, from first collection to final erasure. Tap any stage to explore it.
From a privacy ruling to full enforcement
India's data-protection regime has been a decade in the making. Here's how it unfolded — and the deadlines now on the horizon.
Act & Rules notified; Board established
On 14 November 2025 the Act and the DPDP Rules, 2025 are brought into force on a staggered timeline, and the Data Protection Board of India is set up.
Timeline current as of mid-2026. Enforcement dates are set by MeitY and the Data Protection Board and may evolve.
DPDP, answered
The questions teams ask most when they start their DPDP journey.
What is the DPDP Act, 2023?
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data-protection law. It governs how organisations (Data Fiduciaries) collect, process, and protect the personal data of individuals (Data Principals), and sets out consent requirements, individual rights, and penalties for non-compliance.
Who needs to comply with the DPDP Act?
Any organisation that processes the digital personal data of individuals in India — whether collected online or digitised offline — must comply. This applies to companies inside India and, in many cases, to foreign companies offering goods or services to people in India.
What are the penalties under the DPDP Act?
Penalties are set by the Data Protection Board and can reach ₹250 crore per instance for failure to take reasonable security safeguards, with other breaches carrying penalties up to ₹200 crore. Use our penalty calculator to estimate your exposure.
How is consent handled under the DPDP Act?
Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. Data Principals can withdraw consent as easily as they gave it, and organisations must honour withdrawal promptly.
Turn DPDP obligations into working consent and signing flows
See how Certinal helps enterprises capture compliant consent, maintain tamper-evident audit trails, and stay DPDP-ready at scale.