Make privacy a business strength. Get DPDP-ready.

India's Digital Personal Data Protection Act changes how organisations collect, use, store and protect digital personal data. CyberNerds helps turn the legal requirements into practical policies, processes and security controls.

Book a Free Consultation Explore the 6 phases

What is the
DPDP Act?

The Digital Personal Data Protection Act, 2023 is India's framework for processing digital personal data. It recognises individuals' rights over their personal data and sets obligations for organisations that decide why and how that data is processed.

What does it cover?

It generally applies to digital personal data processed in India, including data collected offline and later digitised, and certain processing outside India connected with offering goods or services to individuals in India.

The Act includes defined exclusions and exemptions. Applicability should be assessed against your organisation's activities, role and data flows.

What does an organisation need to do?

Where the organisation is a Data Fiduciary, it must establish a lawful and accountable way to process personal data and support the rights and protections provided by the Act.

  • Clear privacy notices
  • Consent & permitted processing
  • Reasonable security safeguards
  • Rights requests, grievances & breaches
  • Processors & data retention

DPDP commencement
is phased

Different provisions take effect on different dates. The milestones below are based on the commencement notification and the DPDP Rules, 2025 published in the Official Gazette.

The main DPDP obligations start on 13 May 2027. Use the time now to assess gaps and prepare.

13 November 2025 · Initial provisions

Definitions, establishment and governance provisions for the Data Protection Board, and certain institutional and enabling provisions commenced.

  • Commenced

13 November 2026 · One-year milestone

Section 6(9), the specified Board function under section 27(1)(d), and Rule 4 on Consent Manager registration and obligations take effect.

  • Commenced

13 May 2027 · Main compliance milestone

Core Data Fiduciary obligations, notice and consent, security safeguards, breach response, Data Principal rights and the statutory penalty framework are scheduled to commence.

  • Upcoming

These are phased commencement dates, not one blanket date for every provision. Confirm applicability and any later Government notifications before making compliance decisions. Last reviewed: 14 November 2026.

Penalties can be
significant

The Act's Schedule sets maximum monetary penalties for specified breaches. The Data Protection Board determines the amount in accordance with the Act.

₹250 Cr
Failure to take reasonable security safeguards to prevent personal data breaches
₹200 Cr
Failure to give required breach notice to the Board or affected Data Principals
₹200 Cr
Failure to observe the additional obligations relating to children
₹150 Cr
Failure to observe the additional obligations of a Significant Data Fiduciary

These are statutory maximums, not automatic or fixed fines. The Board considers the nature, gravity and duration of the breach, the type of data affected, repetition, mitigation and proportionality. Other breaches may attract a penalty of up to ₹50 crore.

DPDP implementation
in 6 phases

Our framework follows 18 defined activities, from setting up ownership and mapping personal data to embedding privacy into daily operations and sustaining compliance.

01 · Mobilise

Owners and legal role clear.

  • Form the DPDP committee
  • Define roles & Data Principals

02 · Discover

One inventory of all personal data.

  • List departments
  • List sub-departments
  • Name SPOCs
  • List applications & sources
  • Prepare the data mapping register

03 · Analyse

Every gap known.

  • Review purpose & lawful basis
  • Audit safeguards

04 · Remediate

Riskiest gaps closed.

  • Perform gap analysis
  • Prepare remediation roadmap
  • Rationalise data retention

05 · Operationalise

Privacy in daily work.

  • Privacy-by-design gates
  • Review vendors & contracts
  • Privacy notices & consent
  • Rights & grievance handling
  • Breach response playbook

06 · Sustain

Provable, continuing compliance.

  • Privacy calendar & audits

Not just
documentation.

A DPDP programme must work in practice. We connect governance requirements with the security and operational controls that support them.

  • Data mapping & gap assessment
  • Privacy policies & notices
  • Consent & rights workflows
  • DPIA & risk assessment support
  • Vendor & processor review
  • Security & breach readiness
  • Employee awareness & training
  • Ongoing privacy support

DPDP Act
questions

The Digital Personal Data Protection Act, 2023 is India's law on processing digital personal data. It gives individuals (Data Principals) rights over their personal data and places obligations on organisations (Data Fiduciaries) that decide why and how that data is processed.
Commencement is phased. Initial provisions, including those establishing the Data Protection Board, commenced on 13 November 2025. Consent Manager registration provisions took effect on 13 November 2026. The main obligations, including notice and consent, security safeguards, breach notification, Data Principal rights and the penalty framework, are scheduled to commence on 13 May 2027.
The Act's Schedule sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a personal data breach or to meet the obligations for children's data, up to ₹150 crore for breaching Significant Data Fiduciary obligations, and up to ₹50 crore for other breaches. These are maximums: the Data Protection Board decides the amount based on factors such as the nature, gravity and duration of the breach.
It generally applies to digital personal data processed in India, including data collected offline and later digitised, and to certain processing outside India connected with offering goods or services to individuals in India. The Act has defined exclusions and exemptions, so applicability should be assessed against your organisation's activities and data flows.
CyberNerds follows six phases and 18 activities: Mobilise (ownership and roles), Discover (a personal data mapping register), Analyse (purpose, lawful basis and safeguards), Remediate (gap analysis, roadmap and retention), Operationalise (privacy by design, vendor contracts, notices and consent, rights and grievance handling, breach response) and Sustain (a privacy calendar and audits).
Request a free consultation using the form on this page or email [email protected]. We discuss your business model, systems and personal data touchpoints, identify priority actions and propose a phased scope.

Not sure where
you stand?

Talk to CyberNerds about your current data practices, compliance priorities and a practical route to DPDP readiness.

Understand your starting point

Discuss your business model, systems and personal data touchpoints.

Identify priority actions

Get an initial view of the areas that may need attention.

Explore a phased approach

Prefer email? [email protected]

Please do not submit sensitive personal data, credentials or confidential client information in this form.

This page is for general awareness and business discussion only; it is not legal advice, a legal opinion or a certification of compliance. Applicability depends on the facts, processing activities, exemptions and notifications relevant to each organisation. Primary references: Digital Personal Data Protection Act, 2023 · Commencement notification G.S.R. 843(E) · Digital Personal Data Protection Rules, 2025. See also DPDP Act compliance and ISO 27701.