What the DPDP Act is
The Digital Personal Data Protection Act, 2023 is India's comprehensive law on digital personal data. The Digital Personal Data Protection Rules, 2025 set out how it operates, with obligations phasing in over a transition period.
It applies to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to people in India.
Key obligations for data fiduciaries
- Process personal data only for a lawful purpose with valid consent or a listed legitimate use
- Give a clear notice describing the data and the purpose
- Make withdrawing consent as easy as giving it
- Keep data accurate, protect it with reasonable security safeguards, and erase it when no longer needed
- Notify the Data Protection Board and affected people of personal data breaches
- Handle requests to access, correct and erase data, and provide grievance redressal
- Obtain verifiable parental consent before processing children's data
Significant Data Fiduciaries
The government can designate some organisations as Significant Data Fiduciaries based on data volume and risk. They carry extra duties: an India-based Data Protection Officer, an independent data auditor, and periodic Data Protection Impact Assessments.
Readiness checklist
- Map what personal data you collect, where it lives and who it is shared with
- Rewrite notices and consent flows in clear language
- Set up a process for rights requests and grievances
- Review processor contracts
- Prepare a breach response plan with notification steps
- Set retention periods and deletion routines
How muVerity helps
We run DPDP gap assessments, map data flows, rework consent and notices, and set up rights-request and breach workflows. ReadyGDPR was designed with these privacy operations in mind.