India's first comprehensive data protection law is in force. If your business collects or processes personal data of Indian citizens — online or offline — the DPDP Act applies to you. Penalties reach Rs. 250 crore per instance of breach.
Quick Summary
India's primary data protection legislation is the Digital Personal Data Protection Act, 2023 (DPDP Act), which received Presidential assent on 11 August 2023. The Act establishes rights for Data Principals (individuals whose data is processed) and obligations for Data Fiduciaries (entities that determine the purpose and means of processing personal data). Key obligations include: processing personal data only for lawful purposes with valid consent or on specified legitimate use grounds; providing a clear and plain-language Privacy Notice; ensuring data accuracy; implementing reasonable security safeguards; erasing personal data when the purpose is fulfilled; and appointing a Data Protection Officer (mandatory for Significant Data Fiduciaries as designated by the Central Government). The Data Protection Board of India will adjudicate complaints and impose penalties.
The DPDP Act imposes significant penalties for breach — up to Rs. 250 crore for failure to notify a data breach, and up to Rs. 200 crore for non-fulfilment of obligations related to children's data. Rules under the Act are yet to be fully notified as of June 2026; however, compliance preparation — privacy notice drafting, consent mechanism implementation, data retention policy, and vendor agreement review — should proceed based on the Act's provisions. Cross-border data transfers are permitted to countries notified by the Central Government as having adequate data protection standards.
Key references: DPDP Act, 2023 · MeitY · Ministry of Law & Justice · MCA · Last reviewed: June 2026
The office is located in Kakkanad, Ernakulam. DPDP Act compliance advisory for technology companies and businesses in Kochi, Kakkanad, Infopark and across Ernakulam district is handled from the office.
The DPDP Act establishes a consent-based framework for processing digital personal data. The two central parties are:
The Act applies to: processing of digital personal data within India; and processing of personal data outside India if it relates to offering goods or services to Data Principals within India. Cross-border applicability is significant for NRI-focused businesses and international companies serving Indian customers.
Consent must be free, specific, informed, unconditional and unambiguous. Pre-ticked boxes, bundled consent, and dark patterns are not valid. A notice must explain what data is collected, why, and how it will be used — in clear, plain language.
Data may only be used for the purpose for which consent was obtained. Using customer data collected for one purpose to market a new product without fresh consent is a violation.
Only data that is necessary for the stated purpose may be collected. Collecting additional data "just in case" it may be useful later violates the minimisation principle.
Personal data must be deleted once the purpose for which it was collected has been fulfilled and there is no legal requirement to retain it. Indefinite retention is prohibited.
Reasonable security safeguards must be implemented to prevent data breaches — encryption, access controls, and security audits. The standard will be specified in Rules.
In the event of a personal data breach, the Data Protection Board of India and all affected Data Principals must be notified — timeline and procedure to be specified in Rules.
| Violation | Maximum Penalty |
|---|---|
| Breach due to failure to implement reasonable security safeguards | Rs. 250 crore |
| Failure to notify Board and Data Principals of a breach | Rs. 200 crore |
| Non-fulfilment of obligations regarding children's data | Rs. 200 crore |
| Non-fulfilment of Significant Data Fiduciary obligations | Rs. 150 crore |
| Breach of any other provision of the Act or Rules | Rs. 50 crore |
The DPDP Act imposes significantly stricter obligations for processing data of children (under 18 years). A Data Fiduciary must obtain verifiable parental consent before processing a child's personal data. Additionally, tracking or behavioural monitoring of children and targeted advertising directed at children is prohibited. Penalties for violation reach Rs. 200 crore — reflecting the legislature's strong policy position on protecting minors' data.
The DPDP Rules, once notified, will activate the full compliance regime. Businesses that begin the compliance audit and documentation process now will be significantly better positioned than those who wait. The office advises on DPDP compliance frameworks, drafts privacy policies and consent mechanisms, and advises on data breach response.
Contact the Office Corporate & Technology Law