AMLEGALS
Privacy · Governance · Strategic counsel India ↔ The world
PERSONAL DATA / A HUMAN STORY
PhotoNot shared
LocationNot shared
MessagesNot shared
Payment detailsNot shared
PurposePublish a selected photo
Photo-sharing serviceAwaiting permission
Withdraw consent · Request erasure →
01 / 04Personal data

Her information. Her life.

A photograph, a location, a conversation, a payment. Each record relates to a person.

Illustrative consent-based journey. Other lawful grounds and retention duties may apply.
DPDPA exposure / Where it starts

DPDPA law firm. Data privacy in India.

Legal advice on the DPDP Act, 2023, DPDP Rules, 2025 and data privacy governance.

Map your exposure
Data protection / The leadership agenda

Data moves. Responsibility stays.

DPDPA advisory and privacy governance for the decisions that shape your business. In India. Across borders. Throughout the data lifecycle.

Explore our practice
India / International business

One business. Many borders. A clear position.

Understand the Indian and overseas dimensions of your data relationships — from market entry to cross-border operations.

Explore international advisory
Governance / The working record

Beyond the policy. Into the organisation.

Connect legal obligations with operational ownership, practical controls and evidence of implementation.

Explore privacy governance
Principal obligations commence
13 May 2027 · DPDP Act, 2023 & DPDP Rules, 2025
--
Days
--
Hours
--
Min
--
Sec
Organisations that trust this practice

Recent work highlights

DKMS
Deepak Nitrite
Thermax
Gather India
SEW-Eurodrive
Nazara Technologies
HCG Hospitals
Health-e
Deepak Phenolics
BioX
Deepak Chem Tech
Dräxlmaier
Linde
Independent recognition / 2026
IBLJ INDIA BUSINESS
LAW JOURNAL

Law Firm
Awards.

Recognised in Arbitration & ADR, Corporate, and Technology.

Legal practice and professional recognition.

Founder conversations

One voice.
Wider conversations.

Anandaday Misshra
Founder & Managing Partner, AMLEGALS

Anandaday Misshra
ManageEngine Insights / DPDPA

DPDPA compliance in India: What it requires, and what it costs to get wrong

With Athira Jayakumar. A conversation on consent, governance and the business implications of privacy.

Open the conversation
HKU / Regulatory Ramblings

Respect Personal Data: A look into India's new personal data privacy law

With Ajay Shamdasani. The founder's perspective on India's data protection framework, from the Regulatory Ramblings podcast.

Open the conversation
In focus DPDP Rules 2025 — A phased transition. A practical plan. Understand the framework
DPDPA compliance

DPDPA compliance and
data privacy compliance.

DPDPA compliance means meeting the duties in the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The Rules were notified on 13 November 2025 and most duties apply from 13 May 2027. Each guide below covers one part of the work and names the provision behind it.

Next step Scope your DPDPA compliance work — send your name and email; the reply comes from [email protected]. Send your details
Our practice

From legal obligation
to everyday operation.

Privacy touches every part of an organisation. We bring legal interpretation, governance and implementation into one conversation.

01 / Build

DPDPA implementation

Understand your position. Map the gaps. Put notices, consent, contracts and operating procedures into place.

Explore DPDPA advisory
02 / Connect

Cross-border data privacy

Coordinate Indian requirements with the privacy frameworks that govern your international operations.

Explore global privacy
03 / Govern

AI & technology governance

Connect AI use cases with legal review, human oversight, vendor terms and evidence of responsible operation.

Explore AI advisory
Specialist advice, through the full privacy lifecycle. View all practice areas
Your responsibility

A different seat.
A shared responsibility.

Find guidance for the decisions on your desk.

Legal & complianceGeneral Counsel & DPOs Leadership & financeBoards & CFOs Security & technologyCISOs & technology teams
Sector perspective

The same law.
A different business context.

A patient record, a payment journey and an AI training dataset raise different questions. Start with the context of your business.

01 Banking & financial servicesFinancial data. Vendors. Regulatory overlap. 02 Healthcare & life sciencesPatient information. Research. Digital care. 03 Technology & AIPersonal data. Model use. Accountability. 04 E-commerce & retailCustomer journeys. Consent. Retention. 05 Insurance & InsurTechPolicyholder data. Claims. Intermediaries. 06 Gaming & digital platformsChildren's data. Age assurance. User rights.
For startups & growing businesses For international companies entering India
The product · Introducing

The DPDPA File

Compliance is a file, not a claim. Fifty-six exhibits. Every obligation, mapped to a control, an owner and an artefact.

Open The DPDPA File
Exhibit · Significant Data Fiduciary

The SDF duties

Once notified an SDF, Section 10 read with Rule 13 adds an India-based DPO, an independent auditor, DPIAs and algorithmic due diligence. The exhibit lists each duty and its artefact.

56
Exhibits
44
Sections
23
Rules, 2025
7
Schedules
₹250 Cr
Maximum penalty
The framework · Proprietary

Inviolum™

A governance framework built from the DPDPA statutory text — not translated from the GDPR. It measures your compliance stance against all 44 Sections and 23 Rules, and resolves to one Board-ready number.

Inviolum Pulse Score
0 – 100

A single Board-ready index, assessed against the Act and the Rules — reported the way a finance committee reads a metric.

Trust Engineering

Legal and operational governance disciplines.

Explore Trust Engineering

The systematic conversion of legal, regulatory, contractual and governance obligations into continuously operating business systems that can be measured, monitored and independently verified — organised across ten engineering disciplines.

Legal Engineering
01
Legal Engineering
Encode statutory obligations into machine-readable rules and continuously operating controls.
 Data Privacy Engineering
02
Data Privacy Engineering
Design privacy into the data architecture itself — consent, rights, purpose limitation and erasure.
 AI Governance Engineering
03
AI Governance Engineering
Govern AI systems through measurable, auditable frameworks across the model lifecycle.
 Regulatory Engineering
04
Regulatory Engineering
Harmonise overlapping RBI, SEBI, IRDAI, CERT-In and global demands into one operating model.
 Compliance Engineering
05
Compliance Engineering
Move compliance from periodic audits to continuous, policy-as-code verification.
 Contract Engineering
06
Contract Engineering
Instrument DPA clauses, SCCs and SLA commitments into monitored contract intelligence.
 Cyber Governance Engineering
07
Cyber Governance Engineering
Bridge CISO operations and board governance — incident, breach and posture management.
 Risk Engineering
08
Risk Engineering
Quantify regulatory risk in business terms — penalty exposure and board-ready registers.
 Evidence Engineering
09
Evidence Engineering
Design evidence chains that satisfy regulators, auditors and courts on demand.
 Digital Trust Analytics
10
Digital Trust Analytics
Measure trust posture with the same rigour as financial metrics — scorecards and dashboards.
Across borders

Different markets.
Connected responsibilities.

Section 3(b) extends India's data protection regime to every organisation offering goods or services to Data Principals in India — regardless of where it is incorporated.

Multinational compliance
MNC compliance14 min

The DPDPA Obligation for Multinationals

A GDPR programme cannot be transplanted to the DPDPA. The Board examines Indian law. Not your global framework.

Read the analysis
Cross-border transfers
Cross border12 min

Cross Border Transfers Under the DPDPA

Section 16 permits transfers today. It can restrict them by executive notification tomorrow. The architecture must exist before that day.

Read the analysis
Investment due diligence
Investment & DD11 min

DPDPA Due Diligence for Foreign Investment

Privacy due diligence examines processing activities, contracts, incidents and applicable obligations.

Read the analysis
Maximum penalty · Schedule to the DPDPA, 2023
₹250
Crores

The Schedule prescribes the maximum. The Board determines the quantum under Section 33.

The Board determines penalties after inquiry, considering the factors in Section 33(2).

Your starting point

What is on
your agenda?

Choose your role and priority to find relevant guidance across the practice.

Insights & knowledge

Explore the questions.
Examine the detail.

Articles, compliance analyses, working resources and answers from the AMLEGALS privacy practice.

The Consent Trap
ArticleMarch 2026

The Consent Trap: Why 90% of Indian Consent Mechanisms Will Fail DPDPA Scrutiny

Consent obtained minus consent understood equals zero legal defence. The gap between collection and validity is where the penalties live.

Read ↗ The Privacy Dividend
FrameworkMarch 2026

The Privacy Dividend: How Compliance Investment Returns More Than Penalty Avoidance

Companies that invest in trust outperform those that invest in damage control. Here is the model and the maths behind it.

Read ↗ DPDPA Readiness Survey
ReportFebruary 2026

DPDPA Readiness: A 50-Company Survey Across 12 Industries

Fifty organisations from BFSI and pharma to IT services and manufacturing. The gap between awareness and action is staggering.

Read ↗
Consent & Rights14 min
Consent Management Under DPDPA
Breach Response16 min
Data Breach Notification Under DPDPA
International13 min
Cross-Border Data Transfers Under DPDPA
Penalties14 min
DPDPA Penalties and Fines Structure
Read the full statutory analysis ↗All insights ↗
Compliance intelligence

The analyses that
define the terrain.

Each analysis maps a specific obligation to its operational reality — statutory text, regulatory overlap, implementation architecture and evidence requirements.

Compliance Cost Analysis
Cost heads, complexity bands and scope variables for implementation across organisation sizes.
13 May 2027 Deadline Roadmap
Phased commencement timeline, 30/90/180-day milestones and the Board-readiness evidence checklist.
DPDPA for CFOs
Penalty exposure quantification, Ind AS 37 provisioning, D&O insurability and Board disclosure.
Vendor Claims Register
No DPDPA certification body exists in India. How to evaluate vendor compliance claims against the statute.
Consent Manager Framework
Rule 4 registration, First Schedule Part A obligations and intermediary architecture for the consent lifecycle.
BFSI Compliance Architecture
RBI localisation, IRDAI overlay and SEBI KYC governance — reconciled with the Act Section by Section.
Cross-Border Transfers
The Section 16 negative-list regime, Rule 15 requirements and sectoral localisation mandates mapped.
GDPR vs DPDPA Comparison
Structural divergences: consent architecture, transfer mechanisms, penalties and enforcement models.
Knowledge Hub

DPDPA 2023 — every obligation,
every resource.

44 Sections. 23 Rules. One knowledge architecture — from statutory analysis to sector-specific compliance, from Board governance to operational implementation.

OfficesNew Delhi · Ahmedabad · Mumbai · Bengaluru · Pune · Kolkata · Chennai · Prayagraj · Surat · Vadodara
Speak with a practitioner ↗
Insights & answers

What practitioners and boards are asking.

Twenty-eight answers, each grounded in the statutory text rather than in a vendor's framework.

All DPDPA FAQs ↗
01What is DPDPA 2023 and who does it apply to?+
The Digital Personal Data Protection Act, 2023 governs digital personal data. Section 3 covers processing in India where data is collected digitally or collected in non-digital form and digitised later. It also covers processing outside India connected with offering goods or services to Data Principals within India. There is no general revenue or size threshold, but the Act contains exclusions and exemptions, including personal or domestic processing and specified publicly available data.
02What are the maximum penalties under DPDPA?+
The Schedule sets a ceiling of up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to meet the additional obligations relating to children, as determined by the Board after inquiry. These are ceilings, not fixed charges. Section 33(2) requires consideration of factors including the nature, gravity and duration of the breach, the type of data, repetition and mitigation.
03What is the Inviolum Framework by AMLEGALS?+
Inviolum™ is AMLEGALS' proprietary governance framework built from the DPDPA 2023 statutory text. It measures compliance across five operational layers — Signal (privacy frequency across consent records and data flows), Pulse (governance stance against all 44 Sections and 23 Rules), Drift (compliance entropy and deviations from baseline), Dividend (privacy ROI through trust metrics and audit readiness) and Culture (organisational privacy maturity) — producing a single Board-ready Inviolum Pulse Score from 0 to 100.
04When will DPDPA be fully enforceable?+
The Act received Presidential Assent on 11 August 2023. The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). Commencement is phased: institutional provisions including the Data Protection Board commenced on 13 November 2025; the Consent Manager framework under Rule 4 commences on 13 November 2026; and the substantive obligations on notice, consent, breach reporting, children's data, Significant Data Fiduciaries, rights and cross-border transfers commence on 13 May 2027. Treat the current period as the build window.
05How does DPDPA compare to GDPR?+
The laws have different structures. Section 16 of the DPDPA allows the Government to restrict transfers to notified countries; GDPR provides transfer mechanisms including adequacy decisions and appropriate safeguards. The DPDPA has no right to data portability and enforcement sits with the Data Protection Board. Its penalties have rupee-denominated ceilings, not fixed charges or turnover-based percentages. Its scope includes data collected digitally and data collected in non-digital form and digitised later.
06What is a Significant Data Fiduciary under DPDPA?+
Under Section 10, the Central Government may notify a Data Fiduciary as Significant based on the volume and sensitivity of data processed, risk to Data Principals and other prescribed factors. SDFs carry enhanced obligations including a mandatory DPO appointment based in India, periodic audits by independent auditors, and Data Protection Impact Assessments. Rule 13 requires a DPIA and audit once in every twelve-month period from notification and a report of significant observations to the Board.
07Does DPDPA apply to foreign companies?+
Yes. Section 3 extends applicability to the processing of digital personal data outside India where that processing is in connection with offering goods or services to Data Principals within India. This extraterritorial scope means foreign companies must comply regardless of their physical location.
08What are the DPDP Rules 2025 and when were they notified?+
The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)) under Section 40. They contain 23 Rules and 7 Schedules covering notice requirements (Rule 3), Consent Manager registration and obligations (Rule 4), breach notification form and manner (Rule 7), children's data safeguards (Rule 10), SDF obligations including DPIA, audit and algorithmic due diligence (Rule 13), Data Principal rights (Rule 14), cross-border transfer requirements (Rule 15), the Data Protection Board (Rules 17 to 21) and appeals (Rule 22). Commencement is phased, with the substantive obligations commencing on 13 May 2027.
09What are the consent requirements under Section 6?+
Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to data necessary for the specified purpose. Section 5 read with Rule 3 requires a notice accompanying or preceding the consent request that itemises the data and purposes and explains how to exercise rights. Withdrawal must be comparable in ease to giving consent under Section 6(4). Section 7 permits specified uses, subject to their conditions, including employment, certain State functions and medical emergencies; it is not a general public-interest permission.
10What is the data breach notification obligation?+
Section 8(6) requires every Data Fiduciary to inform both the Data Protection Board of India and each affected Data Principal of a personal data breach. Rule 7 prescribes a staged model: affected Data Principals must be intimated without delay; the Board must receive an initial intimation without delay; and a detailed report must follow to the Board within 72 hours of becoming aware of the breach, or such longer period as the Board may allow on request. Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore, as determined by the Board after inquiry under Section 33 and the Schedule.
11How does DPDPA protect children's personal data?+
Section 9 requires verifiable parental consent before processing a child's data, meaning anyone below eighteen years. Data Fiduciaries must not undertake tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 prescribes the manner of obtaining verifiable parental consent. Processing that may cause a detrimental effect is prohibited, and the penalty for non-compliance is up to ₹200 crore, as determined by the Board after inquiry under Section 33 and the Schedule. These duties are subject to the exemptions in Section 9 read with Rule 12 and the Fourth Schedule.
12Does DPDPA apply to US SaaS companies selling to Indian customers?+
Section 3 covers processing outside India connected with offering goods or services to Data Principals within India. A US SaaS company is a Data Fiduciary where it determines the purposes and means of processing, and a Data Processor where it processes on behalf of another Data Fiduciary. Its role can differ by activity. Applicable duties include notice and consent where required, security safeguards, breach intimation and Data Principal rights. A Data Fiduciary must engage a processor under a valid contract under Section 8(2).
13What happens if a foreign company ignores DPDPA compliance?+
Non-compliance exposes the entity to penalties under Section 33 read with the Schedule, up to ₹250 crore for failure to take reasonable security safeguards, as determined by the Board after inquiry. The Board can issue directions, impose penalties and require remedial measures. Beyond money, non-compliance risks reputational damage, contract termination by Indian partners and, where the conditions in Section 37 are met, a Government blocking direction after an opportunity to be heard. Blocking is not an automatic consequence of a breach.
14How is DPDPA different from PDPA Singapore and LGPD Brazil?+
The DPDPA covers digital personal data, including data collected in non-digital form and digitised later. It uses rupee-denominated penalty ceilings and does not provide a data portability right. Section 16 permits restrictions on transfers to notified countries, supplemented by Rule 15 and applicable sector rules. Singapore's PDPA and Brazil's LGPD have different transfer conditions and grounds for processing. Their compliance programmes need an India-specific assessment rather than assuming the laws are interchangeable.
15What is algorithmic due diligence under the DPDP Rules 2025?+
Rule 13 introduces algorithmic due diligence as an obligation for Significant Data Fiduciaries. It requires SDFs to verify that algorithmic systems processing personal data are not likely to pose a risk to the rights of Data Principals — including algorithms used for profiling, automated decision-making or content recommendation.
16What are the DPDPA obligations for the BFSI sector?+
Banks, insurers, NBFCs and payment aggregators carry overlapping obligations. Under the Act: Section 5 notice, Section 6 consent, Section 8 breach notification and Section 10 SDF obligations if notified. In addition, RBI data localisation circulars mandate that payment system data be stored exclusively in India, IRDAI requires health and claims data retention, and SEBI mandates KYC data governance. The sector must reconcile these sectoral mandates with the Act to avoid regulatory conflict.
17How should a multinational structure its DPDPA compliance programme?+
Across four layers: entity mapping to identify which group entities qualify as Data Fiduciaries or Data Processors; data flow mapping to trace cross-border transfers under Section 16 and Rule 15; consent architecture design reconciling Section 6 consent with GDPR consent or legitimate interests already in place; and governance documentation including privacy notices, Data Processing Agreements, breach response protocols and DPO appointment for SDF-designated entities.
18What is a DPDPA Data Protection Impact Assessment?+
Section 10 and Rule 13 require notified Significant Data Fiduciaries to undertake a Data Protection Impact Assessment and an audit once in every twelve-month period from notification. The SDF must cause the person carrying out the assessment and audit to submit a report containing significant observations to the Board. This is not merely an on-request reporting duty. GDPR Article 35 instead uses a likely-high-risk test for its DPIA requirement.
19What is the Rule 15 cross-border transfer requirement?+
Rule 15 supplements Section 16. While Section 16 empowers the Central Government to restrict transfers to notified countries on a negative-list approach, Rule 15 further allows requiring that personal data made available to any foreign State, its agencies or persons or entities under its control meet prescribed requirements. Sectoral localisation mandates under the RBI, IRDAI and SEBI continue to apply independently. Unlike the GDPR, the DPDPA does not require adequacy decisions for permitted jurisdictions.
20What is the Consent Manager framework under the Rules?+
Rule 4 establishes the Consent Manager framework. A Consent Manager is an entity registered with the Board under the First Schedule Part A that acts as a single point of contact for Data Principals to give, manage, review and withdraw consent. Foreign companies can engage a registered Consent Manager, but legal responsibility for lawful processing remains with the Data Fiduciary. The registration framework commences on 13 November 2026.
21How does DPDPA apply to the insurance sector?+
Insurance companies face obligations overlaid with IRDAI requirements: Section 5 notice for policy data, Section 6 consent for health and claims data, Section 8 breach notification and potential Section 10 SDF obligations. IRDAI mandates on data retention, claims processing and policyholder data governance must be reconciled with the Act. AMLEGALS builds sector-specific reconciliation matrices mapping each IRDAI requirement to the corresponding provision.
22What DPDPA obligations apply to e-commerce platforms?+
Section 5 notice obligations at scale, Section 6 consent challenges for multiple processing purposes across marketing, analytics, personalisation and payment, Section 8 breach notification for large user bases, and potential SDF designation under Section 10 for high-volume processors. We advise on consent architecture design, vendor data processing agreements, cross-border transfer mechanisms for international fulfilment, and children's data protection under Section 9.
23Does DPDPA apply to the online gaming industry?+
Yes. Gaming platforms face acute Section 9 challenges because they cannot simply add an age gate. Verifiable parental consent under Rule 10 is required before processing any child's data, and behavioural monitoring, tracking and targeted advertising directed at children are prohibited. Gaming companies must also address Section 6 consent for gameplay analytics, in-app purchase data and social features, plus Section 8 breach notification obligations. Apply the exemptions in Section 9, Rule 12 and the Fourth Schedule where their conditions are met; an age gate alone does not establish compliance.
24What is the DPDPA compliance cost for organisations in India?+
Costs vary by organisation size, sector, processing complexity and existing governance maturity. Key cost heads include legal advisory, consent architecture implementation, privacy notice drafting, data mapping and flow analysis, breach notification infrastructure, DPO appointment for SDFs, Data Protection Impact Assessments, vendor agreement restructuring and ongoing compliance monitoring. We provide structured scope assessments so organisations can understand their specific investment requirement.
25Is there a DPDPA certification body in India?+
The Act and Rules do not establish a general government-issued DPDPA compliance certificate for organisations. An independent audit or a private assessment is different from statutory certification. A vendor's readiness or compliance claim should be checked against its scope, evidence, assessor and limitations; the label alone does not prove compliance or regulatory approval.
26Who provides DPDPA compliance services in Delhi NCR?+
AMLEGALS provides counsel-led DPDPA compliance services from its New Delhi office at A-24, ILBS Colony, Vasant Kunj, New Delhi 110070. The firm advises on DPDP Act 2023 implementation, DPDP Rules 2025 compliance, consent architecture, breach notification, DPO services, cross-border transfers and Significant Data Fiduciary obligations. Contact [email protected] or +91-8448548549.
27Who provides DPDPA compliance services in Mumbai?+
AMLEGALS provides DPDPA compliance advisory from its Mumbai office. Services include implementation, consent management, breach notification protocols, DPO advisory, cross-border transfer structuring and the proprietary Inviolum Framework assessment. The firm serves BFSI, pharmaceutical, e-commerce and technology entities across Maharashtra.
28Who provides DPDPA compliance services in Ahmedabad?+
AMLEGALS operates from its Ahmedabad office, providing DPDPA compliance services to manufacturing, pharmaceutical, chemical and technology companies in Gujarat. Services include DPDP Act implementation, DPDP Rules compliance, consent architecture, Significant Data Fiduciary advisory and the Inviolum Pulse Score assessment.
Start a conversation

What does your next decision need?

Tell us what you are working on. The practitioner from the relevant practice will review your enquiry. Initial enquiries are reviewed by the relevant legal practice.

Data privacy desk
[email protected]
Boardline
+91-8448548549