DPDP Act Compliance
India's Digital Personal Data Protection law
The DPDP Act 2023 is India's first comprehensive data protection law, requiring consent-based processing of digital personal data and creating a Data Protection Board for enforcement. It applies to data fiduciaries processing data of individuals in India, with fines up to INR 250 crore per instance.
What is the DPDP Act?
processing of digital personal data in India, with implementing rules
and a Data Protection Board of India responsible for enforcement.
Who needs to comply with the DPDP Act?
(data principals) in India, and entities outside India processing such
data in connection with offering goods or services to individuals in
India.
What are the key requirements
of the DPDP Act?
Obtaining clear, itemised consent, often via a registered Consent Manager
Providing plain-language notices about what data is collected and why
Honouring data principal rights: access, correction, erasure, and grievance redressal
Additional obligations for 'Significant Data Fiduciaries', including DPO appointment, DPIAs, and independent audits
Complying with cross-border transfer restrictions on a government-notified blacklist basis
Reporting personal data breaches to the Data Protection Board and affected individuals
What are the penalties for the DPDP Act non-compliance?
Financial penalties of up to INR 250 crore (roughly USD 30 million) per instance, depending on the nature and severity of the breach.
Contact usINR 250 crore
Fine per instanceHow does GDPRLocal help with the DPDP Act?
GDPRLocal supports you with everything the DPDP Act requires: consent flows, plain-language notices, grievance mechanisms, and full assessment of your obligations as a Significant Data Fiduciary, including DPIAs and independent audits.
Get started free