# India's DPDP Act 2023: a practical compliance guide for cloud teams > The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set out how any organisation handling the digital personal data of people in India must collect consent, secure data, report breaches and answer requests. This guide explains which provisions are already in force, what starts on 13 May 2027, how to scope the work, and what the controls look like on AWS, Azure and GCP. - Source: https://support.icompaas.com/compliance/india-dpdp-act-2023 - Reviewed: 2026-10-08 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## At a glance - **Issuing body:** Parliament of India; rules by the Ministry of Electronics and Information Technology (MeitY); enforced by the Data Protection Board of India - **Current edition:** DPDP Act, 2023 (No. 22 of 2023, assent 11 August 2023) and DPDP Rules, 2025 (G.S.R. 846(E), gazetted 13 November 2025) - **Status on 8 October 2026:** Definitions and the Board are in force; Consent Manager registration starts 13 November 2026; all Data Fiduciary duties, rights and penalties start 13 May 2027 - **Applies to:** Processing of digital personal data in India, and processing abroad connected with offering goods or services to people in India (section 3) - **Assessment type:** No certification. Board inquiry on a complaint or breach intimation; Significant Data Fiduciaries must run a DPIA and an independent audit every 12 months - **Typical first-time timeline:** 4 to 6 months for a SaaS team with a GDPR or ISO 27001 base; longer if consent and notice flows must be rebuilt - **Penalties:** Up to ₹250 crore for security-safeguard failures; up to ₹200 crore for breach-notification or children’s-data failures; up to ₹150 crore for SDF duties; up to ₹50 crore for other breaches (Schedule to the Act) ## Who the DPDP Act applies to, and what happens if you ignore it The [Digital Personal Data Protection Act, 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) applies to the processing of digital personal data inside India, including data collected on paper and digitised later, and to processing outside India when it is connected with offering goods or services to people in India (section 3). There is no headcount, revenue or "main establishment" threshold. If you offer goods or services to individuals in India, the Act reaches you. Three groups feel it first: - **Indian product companies and their SaaS vendors.** You are a Data Fiduciary for your users and employees, and a Data Processor for your customers' data. Fiduciaries stay liable for whatever their processors do (section 8(1)), so expect customer DPAs to be rewritten around the Act. See [DP-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/dp-001-data-processing-agreements-dpa-full-compliance). - **Foreign SaaS selling into India.** Extra-territorial reach is explicit. A US or EU company with Indian customers is a Data Fiduciary under this Act, not just under its home law. - **Indian outsourcing and processing shops.** Section 17(1)(d) exempts processing of data of people outside India done under a contract with a person outside India from most of the Act, though the section 8(5) security-safeguard duty still applies. Your own Indian employee and customer data is still in scope. Ignoring it has three costs. The Schedule to the Act sets monetary penalties of up to ₹250 crore. Section 37 lets the Central Government, on a reference from the Board, order your service blocked in India after penalties in two or more instances. And section 13(3) lets any grievance you fail to resolve go to a digital-first Board, so complaints scale with your user base, not your legal team. As of October 2026 none of the Data Fiduciary duties are yet enforceable; they commence on 13 May 2027. That is the date to plan around. ## How the Act and the 2025 Rules fit together The Act is short: 44 sections in nine chapters plus one Schedule of penalties. Chapter II (sections 4 to 10) holds every obligation on a Data Fiduciary. Chapter III (11 to 15) holds Data Principal rights and duties. Chapter IV (16 and 17) covers cross-border transfer and exemptions. Chapters V to VIII create the Data Protection Board, the appeal route to TDSAT and the penalty regime. The vocabulary differs from GDPR. A **Data Fiduciary** decides purpose and means (a controller). A **Data Processor** acts on its behalf. A **Data Principal** is the individual, and for a child includes the parent. A **Consent Manager** is a Board-registered Indian company that lets people give, review and withdraw consent across fiduciaries. A **Significant Data Fiduciary (SDF)** is one the Central Government notifies on volume, sensitivity and risk grounds (section 10) and carries extra duties. There are only two lawful bases. Either the Data Principal consented (section 6: free, specific, informed, unconditional, unambiguous, with a clear affirmative action) or one of the "certain legitimate uses" in section 7 applies: data the person volunteered for a purpose, State benefits and functions, legal disclosure obligations, court orders, medical emergencies, epidemics, disasters, and employment. There is no "legitimate interests" or "contractual necessity" basis. The [lawful processing matrix](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-007-lawful-processing-matrix) is the control that makes this decision per purpose. The [DPDP Rules, 2025](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) (23 rules, seven schedules) supply the detail: rule 3 notice content, rule 4 Consent Manager registration, rule 6 minimum security safeguards, rule 7 breach intimation, rule 8 retention and erasure, rules 10 to 12 children and guardians, rule 13 SDF duties, rule 14 rights and the 90-day grievance ceiling, rule 15 transfers, rule 22 appeals. ### What is in force today Both the Act and the Rules commence in three tranches, set by [G.S.R. 843(E)](https://egazette.gov.in/WriteReadData/2025/267647.pdf) and rule 1. (Both notifications are dated 13 November 2025; the Gazette copies were uploaded and the PIB press release issued on 14 November. Plan to the earlier date.) - **Since 13 November 2025:** definitions, establishment and staffing of the Board (sections 18 to 26), consistency with other laws, rule-making powers, and rules 17 to 21 on Board appointments and procedure. - **From 13 November 2026:** section 6(9) and rule 4, Consent Manager registration, plus the Board's matching power over Consent Manager breaches (section 27(1)(d)). - **From 13 May 2027:** everything else: sections 3 to 17 (all fiduciary duties and rights), the Board's inquiry and penalty powers, appeals, and the repeal of section 43A of the IT Act. Everything in Chapter II is mandatory once live. Rule 13 applies only if you are notified as an SDF. Rule 8's Third Schedule erasure clocks apply only to e-commerce and social media platforms with at least two crore registered Indian users and gaming intermediaries with at least fifty lakh. ## Scoping: what is in, what is out, and where teams get it wrong Start from data, not systems. Build a [digital personal data inventory](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-001-digital-personal-data-inventory) that lists each category of personal data, the people it describes (customers, end users of customers, employees, candidates, leads), where it lives, which processors touch it and whether the Data Principal is in India. Then assign a role per flow with [SC-003](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-003-data-fiduciary-role-assignment-ropa): fiduciary, processor, or both. Out of scope by statute: personal or domestic processing, data made public by the person or under a legal duty (section 3(c)), and data of non-Indian principals processed under contract for a foreign client (section 17(1)(d)). Employee data is in scope but usually rests on the employment use in section 7(i), which changes the paperwork (notice, not consent); see [LB-005](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-005-employee-privacy-notice-hr-data-governance). Decide early whether you could be notified as an SDF, using [SC-004](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-004-significant-data-fiduciary-sdf-self-assessment). It changes the budget: a DPO based in India, an independent data auditor, annual DPIA and audit reports to the Board, and localisation of any data the Government later specifies. The scoping mistakes that cost the most: - **Scoping only the Indian entity.** If a parent abroad decides purposes, the parent is the fiduciary. Entity boundaries do not limit the Act. - **Treating B2B contact data as exempt.** A buyer's name, work email and usage telemetry are personal data. Marketing and CRM systems are in. - **Forgetting processors you do not pay for.** Analytics SDKs, support desks, email providers and AI assistants all need a contract under section 8(2) and a line in the [processor register](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-005-data-processor-register-dpa-management). - **Assuming you have no children's data.** Anyone under 18 is a child. If sign-up does not establish age, you cannot show you have none. - **Relying on the start-up exemption.** Section 17(3) only allows the Government to notify exempt classes. No such notification existed when this was written. ## Implementation roadmap: from inventory to 13 May 2027 The plan below assumes a 10 to 500 person SaaS company on one or more public clouds, with some privacy groundwork (a privacy policy, a DPA template, basic access control). Work backwards from 13 May 2027 and leave the last eight weeks for the re-notification campaign. ### Phase 0: weeks 0 to 3. Know what you hold - Complete the data inventory and ROPA (SC-001, SC-003). Tag each flow with its lawful basis from the [matrix](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-007-lawful-processing-matrix). - Run the SDF self-assessment and record the conclusion, even if it is "unlikely". - List every processor, its region and its contract status. Flag any with no written contract. - Name an accountable owner and publish interim contact details for data questions (section 8(9), rule 9). See [GV-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/gv-001-data-protection-officer-dpo-appointment-publication). ### Phase 1: weeks 3 to 10. Build the four engines - **Notice and consent.** Design the standalone notice (rule 3), the consent record schema, and withdrawal that is as easy as giving consent (section 6(4)). Offer the notice in English and the Eighth Schedule languages your users read (section 5(3)); see [TR-002](https://support.icompaas.com/compliance/india-dpdp-act-2023/tr-002-multi-language-consent-interface). - **Rights handling.** One intake path, identity check, and a 90-day clock: rule 14(3) caps grievance response at 90 days, and the Rules set no separate deadline for access, correction, erasure or nomination, so apply the same clock to them. Start with [DS-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-001-data-subject-access-request-dsar-information-rights) and [DS-007](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-007-grievance-redressal-mechanism). - **Security safeguards.** Map rule 6's seven minimums (encryption or masking, access control, access logging, backups, one-year log retention, processor clauses, organisational measures) to cloud settings. The hardest-controls section below is the checklist. - **Breach response.** Write the runbook with the three clocks: CERT-In 6 hours, Board and Data Principals without delay, detailed Board report within 72 hours (rule 7). Pre-draft both templates. ### Phase 2: weeks 10 to 18. Prove it works - Table-top the breach runbook with engineering, support and leadership. Time it. - Send test DSARs and erasure requests through the real path, including the processor cascade (section 8(7)(b)). - Sign or amend processor contracts and the cross-border register ([IT-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/it-001-international-data-transfer-register-restriction-screening)). - Implement age assurance and the child-account feature flags if any users could be under 18. - Plan the section 5(2) campaign: every user who consented before commencement must receive the new notice "as soon as it is reasonably practicable". Schedule it for the weeks either side of 13 May 2027. ### Phase 3: ongoing from May 2027 - Monthly: grievance and request ageing against the 90-day ceiling; consent withdrawal reconciliation across processors. - Quarterly: access reviews, log retention checks, processor register refresh. - Annually: policy review, training ([SE-005](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-005-information-security-governance-training-audit)), and for SDFs the DPIA and independent audit with a report to the Board (rule 13). - Watch MeitY and the Board's site for SDF notifications, section 16 country restrictions and rule 15 orders. ## The seven hardest controls, with AWS, Azure and GCP notes ### 1\. Provable notice and consent (sections 5, 6; rule 3) Section 6(10) puts the burden of proof on you: in any proceeding you must show the notice was given and consent obtained. That means an append-only consent record keyed to user, purpose, notice version and language, with withdrawal events in the same store. **AWS:** DynamoDB with point-in-time recovery for the live record, mirrored to S3 with Object Lock in compliance mode for the immutable trail. **Azure:** Cosmos DB with continuous backup, mirrored to Blob Storage with a time-based immutability policy. **GCP:** Firestore or Spanner, mirrored to a Cloud Storage bucket with a locked retention policy. Done looks like: any user ID returns the exact notice text they saw, when, in which language, and every later withdrawal. Controls: [LB-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-001-consent-quality-management), [TR-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/tr-001-standalone-privacy-notice), [DS-005](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-005-consent-withdrawal-mechanism). ### 2\. Breach detection and two-track notification (section 8(6); rule 7) Rule 7 is not a 72-hour rule. Affected Data Principals and the Board must be told _without delay_; the 72 hours (extendable on written request) is for the detailed Board report. Separately, the [CERT-In directions of 28 April 2022](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) require reporting listed incidents, including data breaches and leaks, within 6 hours of noticing them. Detection has to be automated. **AWS:** GuardDuty, Security Hub and CloudTrail data events on personal-data buckets and tables, routed through EventBridge to the incident queue. **Azure:** Microsoft Defender for Cloud with Sentinel analytics rules on the personal-data workspaces. **GCP:** Security Command Center Premium with Event Threat Detection. Done looks like: a drill from alert to CERT-In email, Board intimation and user notice completed inside the clocks, with timestamps in the ticket. Controls: [IR-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/ir-001-personal-data-breach-dpb-notification), [IR-002](https://support.icompaas.com/compliance/india-dpdp-act-2023/ir-002-personal-data-breach-data-subject-notification). ### 3\. Visibility of access to personal data, kept for one year (rule 6(1)(c) and (e)) Rule 6 requires logs, monitoring and review that let you detect and investigate unauthorised access, and retention of those logs and the personal data for one year. CERT-In separately requires 180 days of ICT logs held within India. **AWS:** enable CloudTrail data events for S3 and DynamoDB (off by default), set CloudWatch Logs retention to at least 365 days, write the trail to an Object-Locked bucket in ap-south-1 or ap-south-2. **Azure:** diagnostic settings on every data store to a Log Analytics workspace in Central India with retention of at least 365 days. **GCP:** turn on Data Access audit logs (disabled by default except BigQuery), route to a log bucket in asia-south1 with a 365-day locked retention. Control: [SE-003](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-003-personal-data-access-logging-siem-monitoring). ### 4\. Erasure with processor cascade, against a one-year floor (section 8(7); rule 8) On withdrawal or when the purpose ends you must erase and cause processors to erase, unless law requires retention. Rule 8(3) then requires personal data, traffic data and processing logs to be kept for at least one year from processing for the Seventh Schedule purposes. The resolution is a retention schedule per data class: delete from live systems on request, keep the minimal processing record for a year, then purge. **AWS:** DynamoDB TTL, S3 lifecycle expiration, AWS Backup vault retention aligned to the schedule. **Azure:** Blob lifecycle management, Azure Backup retention, Purview to find stragglers. **GCP:** Cloud Storage lifecycle rules, BigQuery partition expiration, Sensitive Data Protection discovery scans. Done looks like: an erasure job that emits a certificate and collects processor confirmations within the SLA. Controls: [DS-004](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-004-right-to-erasure-technical-deletion-processor-cascade), [SC-005](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-005-data-processor-register-dpa-management). ### 5\. Encryption, masking and tokenisation (rule 6(1)(a)) Rule 6 names encryption, obfuscation, masking or virtual tokens as the minimum. **AWS:** KMS customer-managed keys, SSE-KMS as the bucket default, RDS and EBS encryption checked by AWS Config rules, tokenise identifiers at write time. **Azure:** Key Vault customer-managed keys, Always Encrypted or Dynamic Data Masking on Azure SQL. **GCP:** CMEK on Cloud Storage, BigQuery and Cloud SQL, policy tags with dynamic data masking in BigQuery. Control: [SE-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-001-encryption-data-masking). ### 6\. Children's data and verifiable parental consent (section 9; rules 10 to 12) Under-18s are children. You need verifiable parental consent before processing, and no tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 accepts identity and age details you already hold, details the parent volunteers, or a virtual token from an authorised entity such as a Digital Locker provider. Engineering work: an age step at sign-up, a parent verification flow, and feature flags that disable analytics and ad SDKs for child accounts. Done looks like: a child account cannot emit a behavioural event. Controls: [SC-008](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-008-children-s-data-processing-controls), [SC-002](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-002-data-principal-identification-guardian-consent-management). ### 7\. Cross-border transfers and region strategy (section 16; rules 13(4) and 15) The Act takes a blacklist approach: transfers are allowed except to countries the Central Government notifies, and rule 15 adds conditions the Government may set by order on making data available to a foreign State. No country had been restricted when this was written. SDFs may be told to keep specified data and its traffic data in India. Keep a transfer register and the ability to pin workloads to India regions: AWS ap-south-1 (Mumbai) and ap-south-2 (Hyderabad); Azure Central India, South India and West India; GCP asia-south1 (Mumbai) and asia-south2 (Delhi). Enforce with an SCP on `aws:RequestedRegion`, Azure Policy "Allowed locations", and the GCP org policy `constraints/gcp.resourceLocations`. Controls: [IT-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/it-001-international-data-transfer-register-restriction-screening), [IT-002](https://support.icompaas.com/compliance/india-dpdp-act-2023/it-002-cross-border-data-transfer-policy-overseas-processor-contracts). ## Evidence to keep, and for how long There is no auditor's checklist for ordinary fiduciaries, so the evidence is what the Board would ask for in an inquiry (section 28 gives it civil-court powers to call for documents) and what an SDF's independent auditor needs. Keep it in four groups. - **Policies and notices:** the standalone notice in each language with version history; consent and withdrawal policy; retention schedule; breach response plan; children's data policy; processor and transfer policies; grievance SOP. Each with an owner and a review date. - **Records:** the data inventory and ROPA; the [legal-obligation register](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-002-legal-obligation-processing-register); processor register with signed contracts; consent and withdrawal log; request and grievance register with received and closed dates; breach register with copies of Board and user intimations; [nomination records](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-008-data-principal-nomination-mechanism); DPIA reports ([PD-001](https://support.icompaas.com/compliance/india-dpdp-act-2023/pd-001-data-protection-impact-assessment-programme)). - **Technical exports:** key management and default-encryption settings; audit-log configuration and retention values; lifecycle and TTL rules; region-restriction policies; backup vault settings ([SE-004](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-004-personal-data-backup-recovery)); quarterly access-review output ([SE-002](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-002-role-based-access-control-rbac-least-privilege)). - **Tickets:** every DSAR, erasure job, processor confirmation, breach drill and real incident, with timestamps. Retention: the Act sets no limitation period, and section 6(10) means consent evidence must outlive the processing it justifies. A defensible floor is: consent and notice records for the life of the relationship and at least one year after the last processing, including the erasure itself (rule 8(3)); access logs for at least one year (rule 6), which already exceeds CERT-In's 180 days; breach and grievance files for the same period as your contractual limitation clauses. Consent Managers must keep their records for seven years (First Schedule), a useful benchmark if you integrate with one. ## How enforcement and assessment actually work There is no DPDP certificate to earn. Three processes matter. ### Board inquiry A proceeding starts with a breach intimation under section 8(6), a Data Principal complaint (after exhausting your grievance process, section 13(3)), a Government reference, or a court direction. The Board first decides whether there are sufficient grounds (section 28(3)). If so it inquires with civil-court powers, must give you a hearing, and under rule 19(9) must finish within six months, extendable three months at a time. Outcomes: closure, directions, a voluntary undertaking (section 32, which bars further proceedings on the same matter if honoured), or a penalty under section 33 sized on gravity, duration, data type, repetition, gain, and mitigation. Appeals go to TDSAT within 60 days (section 29), filed digitally with a fee as under the TRAI Act (rule 22); TDSAT aims to decide within six months. ### SDF annual cycle Once notified, an SDF must every 12 months complete a DPIA and an audit and have the assessor send a report of significant observations to the Board (rule 13). Expect a 6 to 10 week engagement: scoping, evidence pull, interviews, testing of consent and rights flows, and a report. Cost drivers are the number of processing purposes, processors and jurisdictions, and whether algorithmic systems need the rule 13(3) due-diligence review. ### Readiness review For everyone else, assessment is self-driven or customer-driven. Indian enterprise customers increasingly ask for a gap assessment against the Act and Rules in procurement. A useful internal cadence is a full readiness review before May 2027, then an annual review aligned with your ISO 27001 or SOC 2 cycle, reusing their evidence. The [complaint pathway control](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-006-dpb-complaint-pathway-grievance-exhaustion) describes the grievance-to-Board route in detail. ## Common mistakes in DPDP readiness reviews - **Copying the GDPR basis table.** "Legitimate interests" and "contractual necessity" do not exist here. Fix: re-run every purpose through the matrix; most B2C purposes land on consent or section 7(a) voluntary provision. - **Burying the notice in the privacy policy.** Rule 3(a) requires a notice understandable on its own. Fix: a short, itemised notice at the point of collection with a link to the full policy, per language. - **Forgetting existing users.** Section 5(2) requires a fresh notice to everyone who consented before commencement. Fix: a scheduled campaign with delivery logs, not a banner. - **Withdrawal harder than consent.** Section 6(4) makes the ease comparable. Fix: a one-click withdrawal in the same surface as the consent toggle, and a job that propagates it to processors. - **Planning the breach process around 72 hours.** The first intimations are "without delay", and CERT-In wants 6 hours. Fix: pre-approved templates and an on-call rota with authority to send. - **Deleting logs at 180 days.** CERT-In's 180 days is a floor, not the DPDP target; rule 6 wants one year. Fix: set retention to 365 days on the audit trail and document why. - **No age signal at sign-up.** Without it you cannot show you have no children's data. Fix: a date-of-birth or age-band step, and child-account flags that disable tracking SDKs. - **Reading "no localisation" as "no constraint".** Section 16(2) keeps sector rules alive, CERT-In logs must stay in India, and SDFs can be ordered to localise. Fix: maintain the region map and the ability to move a workload to an India region on notice. - **Treating the DPO as optional for everyone.** Only SDFs must appoint one, but every fiduciary must publish a contact who can answer processing questions (section 8(9), rule 9) and respond within 90 days. Fix: name the person now. ## How iCompaas helps with DPDP readiness iCompaas maps the Act and the 2025 Rules to the 36 controls in the library below, grouped the way the work is actually done: scope and classification, lawful basis, transparency, Data Principal rights, data processing, privacy by design and DPIA, security, incident response, international transfer and governance. Each control article states what the law requires, what to implement and what evidence to keep. On the platform, continuous checks run across connected AWS, Azure, GCP and other cloud accounts for the technical safeguards in rule 6: encryption defaults, audit-log coverage and retention, backup configuration, access-control posture and region placement. Policy templates mapped to the DPDP controls come with named owners and review cadences, including notice templates per language, consent and withdrawal handling, retention schedules and a breach notification playbook laid out for the Board's reporting content. A grievance redressal workflow tracks each request against its SLA. Evidence is collected from the connected accounts and policy workflows and can be exported when a customer, an SDF auditor or the Board asks for it. ## Frequently asked questions ### Is the DPDP Act in force in 2026? Partly. Since 13 November 2025 the definitions, the Data Protection Board provisions and the rules on Board appointments are in force. Consent Manager registration opens on 13 November 2026. The obligations that affect most companies, including notice, consent, security safeguards, breach notification, Data Principal rights and penalties, commence on 13 May 2027 under G.S.R. 843(E) and rule 1 of the DPDP Rules, 2025. Until then the IT Act section 43A regime continues to apply. ### Does the DPDP Act apply to a foreign SaaS company with users in India? Yes. Section 3(b) applies the Act to processing outside India that is connected with offering goods or services to Data Principals within India. There is no establishment or size threshold. The only relevant carve-out runs the other way: section 17(1)(d) exempts Indian processors handling data of people outside India under a contract with a foreign client from most obligations. A foreign company is a Data Fiduciary for its Indian users and must meet the same notice, consent, security and breach duties. ### What is the breach notification timeline under the DPDP Rules? Rule 7 sets two tracks. On becoming aware of a breach you must inform each affected Data Principal without delay, through their account or registered contact channel, and inform the Board without delay with a description of the breach. Within 72 hours of awareness, or longer if the Board allows on a written request, you must send the Board a detailed report covering causes, mitigation, findings about the person responsible and the notices sent to users. CERT-In separately requires incident reporting within 6 hours. ### Does the DPDP Act require data localisation in India? Not as a general rule. Section 16 lets the Central Government restrict transfers to notified countries, and rule 15 lets it impose conditions on making data available to a foreign State; no such notification existed in October 2026. Two exceptions matter: Significant Data Fiduciaries can be required under rule 13(4) to keep specified personal data and its traffic data in India, and section 16(2) preserves stricter sector rules. CERT-In also requires ICT logs to be kept within Indian jurisdiction for 180 days. ### How long do we have to respond to a Data Principal request or grievance? Rule 14(3) requires every Data Fiduciary and Consent Manager to publish the period within which it responds to grievances, and that period cannot exceed 90 days. The Rules set no separate deadline for access, correction, update, erasure and nomination requests, so treat the same ceiling as the practical deadline. A Data Principal must use your grievance process before complaining to the Board (section 13(3)), so a missed 90-day response is the most direct route to a Board proceeding. ### What are the penalties under the DPDP Act? The Schedule to the Act sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify the Board or affected users of a breach, up to ₹200 crore for breaching the children’s data obligations, up to ₹150 crore for Significant Data Fiduciary duties and up to ₹50 crore for any other breach. Section 42 lets the Government raise these by notification to at most double the original figures. The Board sizes each penalty on the section 33(2) factors. ### Do we need a Data Protection Officer under the DPDP Act? Only if you are notified as a Significant Data Fiduciary, in which case section 10(2) requires a DPO based in India who reports to the board of directors and is the contact for grievances. Every other Data Fiduciary must still publish the business contact details of a person able to answer questions about processing (section 8(9), rule 9) and include them in every response to a rights request. Most SaaS companies name a privacy lead for this role rather than a formal DPO. ## Automate DPDP Act with iCompaas iCompaas connects to your cloud accounts, identity provider and version control, maps the evidence to every DPDP Act requirement, runs the technical checks continuously, and keeps policies and reviews on schedule. - [Get started](https://app.icompaas.com/signin?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=india-dpdp-act-2023&utm_term=get-started) - [Book a product tour](https://calendly.com/icompaas/product-tour?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=india-dpdp-act-2023&utm_term=product-tour) ## Related compliance guides - [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Most teams extend an existing GDPR programme to India; this guide shows where the lawful bases, timelines and breach rules differ. - [ISO/IEC 27701:2025 PIMS Controls — control library](https://support.icompaas.com/compliance/iso-27701-2025): A privacy information management system gives DPDP controls an owner, a review cycle and audit evidence that an SDF assessor can reuse. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Rule 6's reasonable security safeguards map almost one-to-one onto ISO 27001 Annex A controls you may already operate. ## Digital Personal Data Protection Act, 2023 (India): control library 36 controls in 10 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Data Processing (DP) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 DP-001 — Data Processing Agreements (DPA) - Full Compliance](https://support.icompaas.com/compliance/india-dpdp-act-2023/dp-001-data-processing-agreements-dpa-full-compliance) ### Data Subject Rights (DS) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 DS-001 — Data Subject Access Request (DSAR) - Information Rights](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-001-data-subject-access-request-dsar-information-rights) - [India DPDP Act 2023 DS-002 — Right of Access - Data Copy Provision](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-002-right-of-access-data-copy-provision) - [India DPDP Act 2023 DS-003 — Right to Rectification - Correction, Completion & Update](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-003-right-to-rectification-correction-completion-update) - [India DPDP Act 2023 DS-004 — Right to Erasure - Technical Deletion & Processor Cascade](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-004-right-to-erasure-technical-deletion-processor-cascade) - [India DPDP Act 2023 DS-005 — Consent Withdrawal Mechanism](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-005-consent-withdrawal-mechanism) - [India DPDP Act 2023 DS-006 — DPB Complaint Pathway & Grievance Exhaustion](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-006-dpb-complaint-pathway-grievance-exhaustion) - [India DPDP Act 2023 DS-007 — Grievance Redressal Mechanism](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-007-grievance-redressal-mechanism) - [India DPDP Act 2023 DS-008 — Data Principal Nomination Mechanism](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-008-data-principal-nomination-mechanism) ### Governance (GV) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 GV-001 — Data Protection Officer (DPO) Appointment & Publication](https://support.icompaas.com/compliance/india-dpdp-act-2023/gv-001-data-protection-officer-dpo-appointment-publication) - [India DPDP Act 2023 GV-002 — Designated Representative Appointment](https://support.icompaas.com/compliance/india-dpdp-act-2023/gv-002-designated-representative-appointment) ### Incident Response (IR) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 IR-001 — Personal Data Breach - DPB Notification](https://support.icompaas.com/compliance/india-dpdp-act-2023/ir-001-personal-data-breach-dpb-notification) - [India DPDP Act 2023 IR-002 — Personal Data Breach - Data Subject Notification](https://support.icompaas.com/compliance/india-dpdp-act-2023/ir-002-personal-data-breach-data-subject-notification) ### International Transfer (IT) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 IT-001 — International Data Transfer Register & Restriction Screening](https://support.icompaas.com/compliance/india-dpdp-act-2023/it-001-international-data-transfer-register-restriction-screening) - [India DPDP Act 2023 IT-002 — Cross-Border Data Transfer Policy & Overseas Processor Contracts](https://support.icompaas.com/compliance/india-dpdp-act-2023/it-002-cross-border-data-transfer-policy-overseas-processor-contracts) ### Lawful Basis (LB) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 LB-001 — Consent Quality & Management](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-001-consent-quality-management) - [India DPDP Act 2023 LB-002 — Legal Obligation Processing Register](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-002-legal-obligation-processing-register) - [India DPDP Act 2023 LB-003 — Emergency & Public Interest Processing Protocol](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-003-emergency-public-interest-processing-protocol) - [India DPDP Act 2023 LB-004 — Voluntary Disclosure Processing Notice & Opt-Out](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-004-voluntary-disclosure-processing-notice-opt-out) - [India DPDP Act 2023 LB-005 — Employee Privacy Notice & HR Data Governance](https://support.icompaas.com/compliance/india-dpdp-act-2023/lb-005-employee-privacy-notice-hr-data-governance) ### Privacy by Design / DPIA (PD) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 PD-001 — Data Protection Impact Assessment Programme](https://support.icompaas.com/compliance/india-dpdp-act-2023/pd-001-data-protection-impact-assessment-programme) ### Scope & Classification (SC) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 SC-001 — Digital Personal Data Inventory](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-001-digital-personal-data-inventory) - [India DPDP Act 2023 SC-002 — Data Principal Identification & Guardian Consent Management](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-002-data-principal-identification-guardian-consent-management) - [India DPDP Act 2023 SC-003 — Data Fiduciary Role Assignment & ROPA](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-003-data-fiduciary-role-assignment-ropa) - [India DPDP Act 2023 SC-004 — Significant Data Fiduciary (SDF) Self-Assessment](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-004-significant-data-fiduciary-sdf-self-assessment) - [India DPDP Act 2023 SC-005 — Data Processor Register & DPA Management](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-005-data-processor-register-dpa-management) - [India DPDP Act 2023 SC-006 — Consent Manager Oversight & Agreement](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-006-consent-manager-oversight-agreement) - [India DPDP Act 2023 SC-007 — Lawful Processing Matrix](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-007-lawful-processing-matrix) - [India DPDP Act 2023 SC-008 — Children's Data Processing Controls](https://support.icompaas.com/compliance/india-dpdp-act-2023/sc-008-children-s-data-processing-controls) ### Security (SE) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 SE-001 — Encryption & Data Masking](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-001-encryption-data-masking) - [India DPDP Act 2023 SE-002 — Role-Based Access Control (RBAC) & Least Privilege](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-002-role-based-access-control-rbac-least-privilege) - [India DPDP Act 2023 SE-003 — Personal Data Access Logging & SIEM Monitoring](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-003-personal-data-access-logging-siem-monitoring) - [India DPDP Act 2023 SE-004 — Personal Data Backup & Recovery](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-004-personal-data-backup-recovery) - [India DPDP Act 2023 SE-005 — Information Security Governance, Training & Audit](https://support.icompaas.com/compliance/india-dpdp-act-2023/se-005-information-security-governance-training-audit) ### Transparency (TR) Digital Personal Data Protection Act, 2023 (India) - [India DPDP Act 2023 TR-001 — Standalone Privacy Notice](https://support.icompaas.com/compliance/india-dpdp-act-2023/tr-001-standalone-privacy-notice) - [India DPDP Act 2023 TR-002 — Multi-Language Consent Interface](https://support.icompaas.com/compliance/india-dpdp-act-2023/tr-002-multi-language-consent-interface)