10 November 2026
Mono Team
The DPDP Act Explained: What India's Data Protection Law Means for Your Business
Data protection
India's Digital Personal Data Protection Act, 2023 in plain English: who it applies to, what it requires, the dates, the penalties, and what it changes in your systems.
The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India's law on how organisations handle people's digital personal data. It asks for a lawful basis for using that data, usually notice and consent. It also asks for reasonable security, breach reporting, deletion once the purpose is over, and answers when people ask about their data. Most duties start on 13 May 2027. The highest penalty is ₹250 crore.
Most guides to the Act stop at the law. This one also covers what each duty changes in your apps, databases and vendor setups, because that is where the work is.
The DPDP Act in 60 seconds
If you read nothing else, read this:
- What it covers. Personal data in digital form: any data about a person who can be identified from it, wherever it sits in your apps, CRM, HRMS, spreadsheets or backups.
- Who it binds. Any organisation that decides why and how personal data is used. The Act calls this a Data Fiduciary.
- What it asks for. A clear notice, consent you can prove, security safeguards, breach reporting, deletion when the purpose ends, and a working way for people to use their rights.
- When. Most duties start on 13 May 2027.
- What it costs to get wrong. Penalties of up to ₹250 crore, decided by the Data Protection Board of India.
Who it applies to, and who it doesn't
The Act applies to digital personal data processed in India (Section 3). That includes data collected on paper and digitised later. There is no size threshold: a 20-person SaaS company and a bank are both covered if they handle personal data.
It also reaches companies outside India, when they process personal data in connection with offering goods or services to people in India.
It does not apply to:
- personal data an individual uses for a personal or domestic purpose
- personal data the person has made public themselves, or that someone was legally required to make public
- records that stay on paper and are never digitised
B2B companies are covered too. You still hold personal data about employees, job applicants, and the named people at your customers and vendors. And if your product stores your customers' customer data, you are handling personal data on their behalf, which makes you a Data Processor for it.
Section 17 exempts some processing from most of the duties, though not from the security duty. One example matters to outsourcing firms: personal data of people outside India, processed in India under a contract with a foreign company. The Government can also exempt classes of company, including startups, from a few provisions. We know of no such notification so far. Whether an exemption fits you is a question for your lawyers.
The roles: Fiduciary, Processor, Principal, Consent Manager
Four terms decide who has to do what.
- Data Principal. The person the data is about: your customer, user or employee. For a child, it includes the parent or lawful guardian.
- Data Fiduciary. Whoever decides the purpose and means of processing. If you decide why data is collected and how it is used, this is you. Nearly all the Act's duties sit here.
- Data Processor. Whoever processes personal data on behalf of a Data Fiduciary: a cloud host, payroll provider, CRM vendor or support outsourcer.
- Consent Manager. A company registered with the Data Protection Board that lets people manage their consents across many organisations. Most companies will never be one. Our Consent Manager decision guide covers this.
One company is often both a Fiduciary and a Processor. A SaaS firm is a Data Fiduciary for its own employees and sales leads, and a Data Processor for the data its customers load into the product.
The Act keeps the Data Fiduciary responsible for what its processors do (Section 8(1)), and allows a processor to be engaged only under a valid contract (Section 8(2)). So you need to know which vendors receive personal data, and what each contract says.
A fifth term, Significant Data Fiduciary, is a label the Central Government can give an organisation, based on factors such as the volume and sensitivity of the data it handles (Section 10). It brings extra duties: a Data Protection Officer based in India, an independent data auditor, and an impact assessment and audit every twelve months (Rule 13). Other companies do not need a Data Protection Officer, but must publish a contact who can answer questions about their processing.
Your obligations, one by one
These are the duties of a Data Fiduciary, in the order most companies meet them.
Notice: say what you collect and why
When you ask for consent, you must give a notice. It lists the personal data you collect and the purpose, and tells the person how to withdraw consent, how to use their rights and how to complain to the Board (Section 5, Rule 3). The Rules ask for clear and plain language, in a notice that can be understood on its own. For consent you collected before the Act applies, you give the same notice as soon as reasonably practicable, and may keep processing until the person withdraws.
Consent: specific, and provable
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (Section 6). It covers only the personal data needed for the stated purpose.
Withdrawing consent must be about as easy as giving it. When someone withdraws, you stop processing and get your processors to stop, unless a law requires the processing to continue. If consent is questioned in a proceeding, it is on you to prove that the notice was given and the consent was obtained.
Legitimate uses: when you don't need consent
Consent is not the only basis. Section 7 lists "certain legitimate uses" where it is not needed. They include data a person gave you voluntarily for a stated purpose without saying they do not consent, compliance with a law or court order, medical emergencies, and purposes of employment.
The list is short. It has no general "legitimate interests" or "performance of a contract" basis of the kind GDPR has, so uses that rely on those in Europe may need consent in India. Which basis fits each of your uses is a question for your lawyers.
Security: reasonable safeguards
You must protect personal data with reasonable security safeguards, including data your processors hold (Section 8(5)). Rule 6 sets the minimum: measures such as encryption or masking, access control, logs and monitoring that can detect unauthorised access, backups, keeping logs for one year so incidents can be investigated, and security terms in processor contracts.
Breach reporting: the Board and the people affected
After a personal data breach, you tell the Data Protection Board and each affected person (Section 8(6)). Rule 7 sets the timing: tell the affected people and the Board without delay, then send the Board a detailed report within 72 hours. Neither the Act nor the Rule sets a size or risk threshold. Every personal data breach is reportable.
This sits beside the CERT-In rule that cyber incidents are reported within 6 hours. Most companies need one runbook that covers both.
Retention: delete when the purpose is over
You must erase personal data when consent is withdrawn, or once it is reasonable to assume the purpose is no longer being served, unless a law requires you to keep it (Section 8(7)). Your processors must erase it too.
For the largest e-commerce, social media and online gaming companies (two crore registered users in India for the first two, fifty lakh for gaming), Rule 8 sets a fixed period: three years after the person last approached the company, with at least 48 hours' notice before deletion.
There is also a floor. Rule 8(3) has every Data Fiduciary keep personal data, its traffic data and processing logs for at least one year, for purposes listed in the Rules, even if the person deletes their account. So your deletion jobs need a minimum period as well as a maximum.
Rights: access, correction, erasure, grievance
People can ask you for a summary of their personal data and what you do with it, and ask you to correct, complete, update or erase it. These rights apply where your processing rests on their consent, or on data they gave you voluntarily. They can also raise a grievance, and nominate someone to act for them if they die or become incapacitated (Sections 11 to 14).
You must publish how to make these requests, and how long your grievance process takes to respond. That period must be reasonable and no longer than 90 days (Rule 14).
Children's data: under 18 means parental consent
A child is anyone under 18. Before processing a child's personal data you need verifiable consent from a parent or lawful guardian. The same applies to a person with a disability who has a lawful guardian. Tracking, behavioural monitoring and advertising targeted at children are not allowed, and neither is processing likely to harm a child's well-being (Section 9).
The Rules exempt some organisations and purposes from parts of this, subject to conditions. They include healthcare providers, schools and day-care centres (Rule 12).
Transfers abroad: allowed unless restricted
The Act lets the Central Government restrict transfers of personal data to particular countries by notification (Section 16). Otherwise transfers are allowed, subject to any requirements the Government sets under Rule 15 about making data available to foreign governments. Other laws with a stricter rule, such as sector rules on where data is stored, still apply.
What changes in your systems
Each duty becomes a change in a system, and a record that proves the change works. This is the table we work from.
| Obligation | What to build | Evidence you keep |
|---|---|---|
| Notice and consent | What to build: A clear notice wherever personal data is collected. Consent recorded per purpose, with a way to withdraw it. | Evidence you keep: Versioned notices and a consent log |
| Rights requests | What to build: One intake for requests, an identity check, routing to every system that holds the data, and deadline tracking. | Evidence you keep: Request log with each step and its date |
| Retention and erasure | What to build: A retention period for each system, with deletion run as scheduled jobs. | Evidence you keep: Retention schedule and deletion logs |
| Security safeguards | What to build: Access control, encryption, logging and monitoring on systems that hold personal data. | Evidence you keep: Access reviews, logs and a control register |
| Breach notification | What to build: Detection, triage and one runbook that covers CERT-In and the Data Protection Board. | Evidence you keep: Tested runbook and incident records |
| Vendors and processors | What to build: A map of which vendors receive personal data, and controls on what they get. | Evidence you keep: Processor register, with contracts flagged for legal review |
| Children's data | What to build: Verifiable parental consent wherever children use your service. | Evidence you keep: Parental consent records |
The hard part is rarely one system. One person's data sits in the app database, the CRM, the data warehouse, the support tool and several vendors, and each duty has to work across all of them. Our DPDP implementation page shows how the pieces fit.
Timeline: 13 November 2025 to 13 May 2027
The Act was passed in August 2023. It is being brought into force in three stages, alongside the DPDP Rules, 2025, which were notified on 13 November 2025. Some advisers count from 14 November 2025, which moves each later date by one day.
- 13 November 2025: DPDP Rules notified; Data Protection Board provisions in force.
- 13 November 2026: Consent Manager registration rules (Rule 4) start. Most companies don't need to register.
- 13 May 2027: Core duties start: notices, consent, rights requests, security, breach reporting, retention.
For most companies the date that matters is 13 May 2027.
Penalties
The Data Protection Board of India can impose a penalty when it finds, after an inquiry, that a breach is significant (Section 33). The Schedule to the Act sets the upper limits:
- Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach.
- Up to ₹200 crore for failing to report a breach to the Board or the people affected.
- Up to ₹200 crore for breaching the duties on children's data.
- Up to ₹150 crore for breaching the extra duties of a Significant Data Fiduciary.
- Up to ₹50 crore for other breaches of the Act or the Rules.
These are ceilings, not fixed fines. In setting the amount the Board looks at things like how serious the breach was, how long it lasted, what kind of data was involved, whether it was repeated, and what you did to limit the harm (Section 33). Appeals go to the Telecom Disputes Settlement and Appellate Tribunal. Penalties are paid to the Consolidated Fund of India. The Act does not provide for compensation to the people affected.
DPDP vs GDPR
If you already comply with GDPR, a lot carries over: data maps, security controls, breach response and processor contracts. The two laws are not the same, though.
| Topic | DPDP Act | GDPR |
|---|---|---|
| Data covered | DPDP Act: Digital personal data, including paper records digitised later | GDPR: Digital data, and paper records held in a filing system |
| Sensitive data | DPDP Act: No separate category. All personal data is treated alike. | GDPR: Special categories with stricter rules |
| Legal basis | DPDP Act: Consent, or one of the listed legitimate uses | GDPR: Six bases, including contract and legitimate interests |
| Children | DPDP Act: Under 18, with verifiable parental consent | GDPR: Consent age of 16 for online services, which a country may lower to 13 |
| Breach reporting | DPDP Act: Every breach, with no risk threshold: the Board and each affected person without delay, and a detailed report to the Board in 72 hours | GDPR: The regulator within 72 hours where feasible, unless the breach is unlikely to result in a risk |
| Transfers abroad | DPDP Act: Allowed unless the government restricts a country | GDPR: Restricted unless an approved route applies, such as an adequacy decision |
| Highest penalty | DPDP Act: ₹250 crore | GDPR: €20 million or 4% of worldwide annual turnover, whichever is higher |
GDPR compliance is a head start, not a pass. The gaps we see most often are consent where a company relied on legitimate interests, the under-18 rule, and breach reporting.
Where to start
Start by finding every system that holds personal data. Then compare how each one works against the Act and Rules, and fix the gaps in order of risk.
- Two minutes: the free DPDP self-check tells you roughly where you stand.
- A few weeks: a DPDP gap assessment gives you a data map, a gap register and a costed plan.
- The build: DPDP implementation puts consent logs, rights requests, retention jobs and breach workflows into your systems.
This guide covers the engineering side and is not legal advice. Our partner law firm gives the written legal opinion on how the Act applies to you. See everything we do for DPDP compliance.
Sources: Digital Personal Data Protection Act, 2023, Sections 2 to 17, 33 and 34 and the Schedule. Digital Personal Data Protection Rules, 2025, Rules 1, 3, 6 to 10 and 12 to 15. Last reviewed 10 November 2026.
The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India's law on how organisations handle people's digital personal data. It asks for a lawful basis for using that data, usually notice and consent. It also asks for reasonable security, breach reporting, deletion once the purpose is over, and answers when people ask about their data. Most duties start on 13 May 2027. The highest penalty is ₹250 crore.
Most guides to the Act stop at the law. This one also covers what each duty changes in your apps, databases and vendor setups, because that is where the work is.
The DPDP Act in 60 seconds
If you read nothing else, read this:
- What it covers. Personal data in digital form: any data about a person who can be identified from it, wherever it sits in your apps, CRM, HRMS, spreadsheets or backups.
- Who it binds. Any organisation that decides why and how personal data is used. The Act calls this a Data Fiduciary.
- What it asks for. A clear notice, consent you can prove, security safeguards, breach reporting, deletion when the purpose ends, and a working way for people to use their rights.
- When. Most duties start on 13 May 2027.
- What it costs to get wrong. Penalties of up to ₹250 crore, decided by the Data Protection Board of India.
Who it applies to, and who it doesn't
The Act applies to digital personal data processed in India (Section 3). That includes data collected on paper and digitised later. There is no size threshold: a 20-person SaaS company and a bank are both covered if they handle personal data.
It also reaches companies outside India, when they process personal data in connection with offering goods or services to people in India.
It does not apply to:
- personal data an individual uses for a personal or domestic purpose
- personal data the person has made public themselves, or that someone was legally required to make public
- records that stay on paper and are never digitised
B2B companies are covered too. You still hold personal data about employees, job applicants, and the named people at your customers and vendors. And if your product stores your customers' customer data, you are handling personal data on their behalf, which makes you a Data Processor for it.
Section 17 exempts some processing from most of the duties, though not from the security duty. One example matters to outsourcing firms: personal data of people outside India, processed in India under a contract with a foreign company. The Government can also exempt classes of company, including startups, from a few provisions. We know of no such notification so far. Whether an exemption fits you is a question for your lawyers.
The roles: Fiduciary, Processor, Principal, Consent Manager
Four terms decide who has to do what.
- Data Principal. The person the data is about: your customer, user or employee. For a child, it includes the parent or lawful guardian.
- Data Fiduciary. Whoever decides the purpose and means of processing. If you decide why data is collected and how it is used, this is you. Nearly all the Act's duties sit here.
- Data Processor. Whoever processes personal data on behalf of a Data Fiduciary: a cloud host, payroll provider, CRM vendor or support outsourcer.
- Consent Manager. A company registered with the Data Protection Board that lets people manage their consents across many organisations. Most companies will never be one. Our Consent Manager decision guide covers this.
One company is often both a Fiduciary and a Processor. A SaaS firm is a Data Fiduciary for its own employees and sales leads, and a Data Processor for the data its customers load into the product.
The Act keeps the Data Fiduciary responsible for what its processors do (Section 8(1)), and allows a processor to be engaged only under a valid contract (Section 8(2)). So you need to know which vendors receive personal data, and what each contract says.
A fifth term, Significant Data Fiduciary, is a label the Central Government can give an organisation, based on factors such as the volume and sensitivity of the data it handles (Section 10). It brings extra duties: a Data Protection Officer based in India, an independent data auditor, and an impact assessment and audit every twelve months (Rule 13). Other companies do not need a Data Protection Officer, but must publish a contact who can answer questions about their processing.
Your obligations, one by one
These are the duties of a Data Fiduciary, in the order most companies meet them.
Notice: say what you collect and why
When you ask for consent, you must give a notice. It lists the personal data you collect and the purpose, and tells the person how to withdraw consent, how to use their rights and how to complain to the Board (Section 5, Rule 3). The Rules ask for clear and plain language, in a notice that can be understood on its own. For consent you collected before the Act applies, you give the same notice as soon as reasonably practicable, and may keep processing until the person withdraws.
Consent: specific, and provable
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (Section 6). It covers only the personal data needed for the stated purpose.
Withdrawing consent must be about as easy as giving it. When someone withdraws, you stop processing and get your processors to stop, unless a law requires the processing to continue. If consent is questioned in a proceeding, it is on you to prove that the notice was given and the consent was obtained.
Legitimate uses: when you don't need consent
Consent is not the only basis. Section 7 lists "certain legitimate uses" where it is not needed. They include data a person gave you voluntarily for a stated purpose without saying they do not consent, compliance with a law or court order, medical emergencies, and purposes of employment.
The list is short. It has no general "legitimate interests" or "performance of a contract" basis of the kind GDPR has, so uses that rely on those in Europe may need consent in India. Which basis fits each of your uses is a question for your lawyers.
Security: reasonable safeguards
You must protect personal data with reasonable security safeguards, including data your processors hold (Section 8(5)). Rule 6 sets the minimum: measures such as encryption or masking, access control, logs and monitoring that can detect unauthorised access, backups, keeping logs for one year so incidents can be investigated, and security terms in processor contracts.
Breach reporting: the Board and the people affected
After a personal data breach, you tell the Data Protection Board and each affected person (Section 8(6)). Rule 7 sets the timing: tell the affected people and the Board without delay, then send the Board a detailed report within 72 hours. Neither the Act nor the Rule sets a size or risk threshold. Every personal data breach is reportable.
This sits beside the CERT-In rule that cyber incidents are reported within 6 hours. Most companies need one runbook that covers both.
Retention: delete when the purpose is over
You must erase personal data when consent is withdrawn, or once it is reasonable to assume the purpose is no longer being served, unless a law requires you to keep it (Section 8(7)). Your processors must erase it too.
For the largest e-commerce, social media and online gaming companies (two crore registered users in India for the first two, fifty lakh for gaming), Rule 8 sets a fixed period: three years after the person last approached the company, with at least 48 hours' notice before deletion.
There is also a floor. Rule 8(3) has every Data Fiduciary keep personal data, its traffic data and processing logs for at least one year, for purposes listed in the Rules, even if the person deletes their account. So your deletion jobs need a minimum period as well as a maximum.
Rights: access, correction, erasure, grievance
People can ask you for a summary of their personal data and what you do with it, and ask you to correct, complete, update or erase it. These rights apply where your processing rests on their consent, or on data they gave you voluntarily. They can also raise a grievance, and nominate someone to act for them if they die or become incapacitated (Sections 11 to 14).
You must publish how to make these requests, and how long your grievance process takes to respond. That period must be reasonable and no longer than 90 days (Rule 14).
Children's data: under 18 means parental consent
A child is anyone under 18. Before processing a child's personal data you need verifiable consent from a parent or lawful guardian. The same applies to a person with a disability who has a lawful guardian. Tracking, behavioural monitoring and advertising targeted at children are not allowed, and neither is processing likely to harm a child's well-being (Section 9).
The Rules exempt some organisations and purposes from parts of this, subject to conditions. They include healthcare providers, schools and day-care centres (Rule 12).
Transfers abroad: allowed unless restricted
The Act lets the Central Government restrict transfers of personal data to particular countries by notification (Section 16). Otherwise transfers are allowed, subject to any requirements the Government sets under Rule 15 about making data available to foreign governments. Other laws with a stricter rule, such as sector rules on where data is stored, still apply.
What changes in your systems
Each duty becomes a change in a system, and a record that proves the change works. This is the table we work from.
| Obligation | What to build | Evidence you keep |
|---|---|---|
| Notice and consent | What to build: A clear notice wherever personal data is collected. Consent recorded per purpose, with a way to withdraw it. | Evidence you keep: Versioned notices and a consent log |
| Rights requests | What to build: One intake for requests, an identity check, routing to every system that holds the data, and deadline tracking. | Evidence you keep: Request log with each step and its date |
| Retention and erasure | What to build: A retention period for each system, with deletion run as scheduled jobs. | Evidence you keep: Retention schedule and deletion logs |
| Security safeguards | What to build: Access control, encryption, logging and monitoring on systems that hold personal data. | Evidence you keep: Access reviews, logs and a control register |
| Breach notification | What to build: Detection, triage and one runbook that covers CERT-In and the Data Protection Board. | Evidence you keep: Tested runbook and incident records |
| Vendors and processors | What to build: A map of which vendors receive personal data, and controls on what they get. | Evidence you keep: Processor register, with contracts flagged for legal review |
| Children's data | What to build: Verifiable parental consent wherever children use your service. | Evidence you keep: Parental consent records |
The hard part is rarely one system. One person's data sits in the app database, the CRM, the data warehouse, the support tool and several vendors, and each duty has to work across all of them. Our DPDP implementation page shows how the pieces fit.
Timeline: 13 November 2025 to 13 May 2027
The Act was passed in August 2023. It is being brought into force in three stages, alongside the DPDP Rules, 2025, which were notified on 13 November 2025. Some advisers count from 14 November 2025, which moves each later date by one day.
- 13 November 2025: DPDP Rules notified; Data Protection Board provisions in force.
- 13 November 2026: Consent Manager registration rules (Rule 4) start. Most companies don't need to register.
- 13 May 2027: Core duties start: notices, consent, rights requests, security, breach reporting, retention.
For most companies the date that matters is 13 May 2027.
Penalties
The Data Protection Board of India can impose a penalty when it finds, after an inquiry, that a breach is significant (Section 33). The Schedule to the Act sets the upper limits:
- Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach.
- Up to ₹200 crore for failing to report a breach to the Board or the people affected.
- Up to ₹200 crore for breaching the duties on children's data.
- Up to ₹150 crore for breaching the extra duties of a Significant Data Fiduciary.
- Up to ₹50 crore for other breaches of the Act or the Rules.
These are ceilings, not fixed fines. In setting the amount the Board looks at things like how serious the breach was, how long it lasted, what kind of data was involved, whether it was repeated, and what you did to limit the harm (Section 33). Appeals go to the Telecom Disputes Settlement and Appellate Tribunal. Penalties are paid to the Consolidated Fund of India. The Act does not provide for compensation to the people affected.
DPDP vs GDPR
If you already comply with GDPR, a lot carries over: data maps, security controls, breach response and processor contracts. The two laws are not the same, though.
| Topic | DPDP Act | GDPR |
|---|---|---|
| Data covered | DPDP Act: Digital personal data, including paper records digitised later | GDPR: Digital data, and paper records held in a filing system |
| Sensitive data | DPDP Act: No separate category. All personal data is treated alike. | GDPR: Special categories with stricter rules |
| Legal basis | DPDP Act: Consent, or one of the listed legitimate uses | GDPR: Six bases, including contract and legitimate interests |
| Children | DPDP Act: Under 18, with verifiable parental consent | GDPR: Consent age of 16 for online services, which a country may lower to 13 |
| Breach reporting | DPDP Act: Every breach, with no risk threshold: the Board and each affected person without delay, and a detailed report to the Board in 72 hours | GDPR: The regulator within 72 hours where feasible, unless the breach is unlikely to result in a risk |
| Transfers abroad | DPDP Act: Allowed unless the government restricts a country | GDPR: Restricted unless an approved route applies, such as an adequacy decision |
| Highest penalty | DPDP Act: ₹250 crore | GDPR: €20 million or 4% of worldwide annual turnover, whichever is higher |
GDPR compliance is a head start, not a pass. The gaps we see most often are consent where a company relied on legitimate interests, the under-18 rule, and breach reporting.
Where to start
Start by finding every system that holds personal data. Then compare how each one works against the Act and Rules, and fix the gaps in order of risk.
- Two minutes: the free DPDP self-check tells you roughly where you stand.
- A few weeks: a DPDP gap assessment gives you a data map, a gap register and a costed plan.
- The build: DPDP implementation puts consent logs, rights requests, retention jobs and breach workflows into your systems.
This guide covers the engineering side and is not legal advice. Our partner law firm gives the written legal opinion on how the Act applies to you. See everything we do for DPDP compliance.
Sources: Digital Personal Data Protection Act, 2023, Sections 2 to 17, 33 and 34 and the Schedule. Digital Personal Data Protection Rules, 2025, Rules 1, 3, 6 to 10 and 12 to 15. Last reviewed 10 November 2026.
FAQ
Questions and answers
Yes. A B2B company still holds personal data about employees, job applicants, and the named people at its customers and vendors. If its product stores its customers' customer data, it is a Data Processor for that data.
Yes, when they process personal data in connection with offering goods or services to people in India.
Most duties start on 13 May 2027, 18 months after the DPDP Rules were notified on 13 November 2025. The rules for registering Consent Managers start earlier, on 13 November 2026.
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Up to ₹200 crore for failing to report a breach or for breaching the duties on children's data. Other failures carry lower limits set out in the Act's Schedule.
The DPDP Act covers only digital personal data, has no separate category of sensitive data, and relies on consent or a short list of legitimate uses rather than GDPR's six legal bases. It treats anyone under 18 as a child, and its penalties are fixed rupee ceilings rather than a share of turnover.