DPDP Act: What It Is and How Purplecop Helps

What is the DPDP Act, 2023?

The DPDP Act is Act No. 22 of 2023, dated 11 August 2023. Its long title says it provides "for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes". It concerns personal data in digital form (section 2(n)). The DPDP Rules, 2025 were published as G.S.R. 846(E) on 13 November 2025 and add detail on notice, security safeguards and breach intimation.

A Data Fiduciary decides the purpose and means of processing, a Data Principal is the individual the data relates to, and a Data Processor processes data on a Data Fiduciary's behalf (section 2). "Person" includes companies and the State (section 2(s)). This page is general information, not legal advice.

Which parts of the DPDP Act are in force, and when do the rest start?

Under section 1(2), notification G.S.R. 843(E) of 13 November 2025 set three commencement dates:

• 13 November 2025 (in force): sections 1(2) and 2 (definitions), sections 18 to 26 (the Data Protection Board of India), and sections 35, 38 to 43, 44(1) and 44(3).
• One year later (derived: about 13 November 2026): section 6(9) (registration of Consent Managers) and section 27(1)(d).
• Eighteen months later (derived: about 13 May 2027): sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37 and 44(2). These include application, notice, consent, Data Fiduciary duties, Data Principal rights and penalties.

Who will the DPDP Act apply to?

Once section 3 starts, the Act will apply to digital personal data processed within India, whether collected in digital form or collected in non-digital form and digitised later (section 3(a)). It will also apply outside India where the processing is connected with offering goods or services to Data Principals in India (section 3(b)).

It will not apply to personal data processed by an individual for personal or domestic purposes, or made publicly available by the Data Principal or by a person legally required to publish it (section 3(c)). Section 17 will provide further exemptions. The GDPR is a separate law with its own scope rules; see the GDPR page if you also serve people in the EU.

What will Data Fiduciaries have to do?

From the eighteen-month date, a Data Fiduciary will have to:

• Process lawfully: with consent or for "certain legitimate uses" under section 7 (section 4). Every consent request will have to be accompanied or preceded by a notice (section 5); Rule 3 will require clear, plain language and an itemised description of the data and purposes.
• Obtain valid consent: free, specific, informed, unconditional and unambiguous, and with withdrawal comparably easy to giving consent (section 6(1), (4)), and be able to prove notice and consent (section 6(10)).
• Secure the data with reasonable safeguards (section 8(5)). Rule 6 will set minimums, including encryption, masking or similar measures, access controls, logs and monitoring, backups, and one-year retention of logs and personal data unless another law requires otherwise.
• Report breaches to the Board and each affected Data Principal (section 8(6)). Under Rule 7, that will mean telling them without delay and giving the Board detailed information within 72 hours of becoming aware, or within a longer period the Board allows on a written request.
• Erase data when consent is withdrawn or the purpose is served, unless law requires retention (section 8(7)), and run a grievance mechanism (section 8(10); Rule 14(3) will refer to a response time of up to ninety days).

What rights will Data Principals have?

Data Principals will be able to withdraw consent at any time (section 6(4)); get a summary of the data processed and the Data Fiduciaries and Data Processors it has been shared with (section 11); seek correction, completion, updating and erasure (section 12); use readily available grievance redressal before approaching the Board (section 13); and nominate someone to act for them on death or incapacity (section 14). The Act will also set duties for Data Principals, such as not registering a false or frivolous grievance or complaint (section 15).

Who enforces the DPDP Act, and what are the penalties?

The Data Protection Board of India, established by the Central Government under section 18, will inquire into breaches and impose penalties. A MeitY circular of 6 May 2026 says the Board has been established; this page does not say who has been appointed. Most of the Board's section 27 powers start eighteen months after 13 November 2025, so penalties cannot yet be imposed.

When they start, the Board will be able to impose a penalty under section 33 if, after an inquiry and a hearing, it finds a breach significant. The Schedule's maximums ("may extend to"):

• Rs 250 crore for breach of the duty to take reasonable security safeguards (section 8(5));
• Rs 200 crore for failing to notify the Board or affected Data Principals of a breach (section 8(6)), or breaching the additional obligations for children (section 9);
• Rs 150 crore for breaching the additional obligations of Significant Data Fiduciaries (section 10);
• Rs 50 crore for any other provision, and Rs 10,000 for breach of a Data Principal's duties (section 15).

Does Purplecop help with the DPDP Act?

Purplecop Security's GRC & Compliance Advisory service lists DPDPA under "Framework adoption", alongside ISO/IEC 27001, SOC 2, NIST CSF 2.0, PCI DSS, HIPAA and GDPR. Its page also describes a "Gap assessment against your target framework, with a prioritised remediation plan".

The Purplecop Privacy page says its India engine is "built natively for the DPDPA 2023", with "consent, notice, data-principal rights, DPIA and breach workflow mapped to the Act".

Neither the service nor the product makes an organisation compliant with the Act. Its obligations will fall on Data Fiduciaries, and enforcement will be by the Board.

Is the DPDP Act in force?

Partly. Section 2 and the provisions on the Data Protection Board came into force on 13 November 2025. Most duties and the penalty provisions start eighteen months after that date (derived: about 13 May 2027), under notification G.S.R. 843(E).

Does the DPDP Act cover paper records?

Once section 3 starts, it will apply to digital personal data: data collected in digital form, or collected in non-digital form and digitised later (section 3(a)). Paper records that are never digitised will be outside that provision.

What is the maximum penalty under the DPDP Act?

The highest ceiling in the Schedule is Rs 250 crore, for breach of the duty to take reasonable security safeguards (section 8(5)). The Board cannot impose it until the penalty provisions start.

Does every organisation need a Data Protection Officer?

No. Only a Significant Data Fiduciary will have to appoint one, based in India (section 10(2)(a)). Others will have to publish contact details for a Data Protection Officer, if applicable, or for a person who can answer questions (section 8(9)).

Can Purplecop make my organisation compliant with the DPDP Act?

No. Compliance will be the legal responsibility of the Data Fiduciary. Purplecop Security's GRC & Compliance Advisory service lists DPDPA in its framework adoption work.