← Policy & Regulation: Sector rules & licensing (all topics)
DPDP Act & data protection compliance
What it is
The Digital Personal Data Protection Act 2023 was operationalised by Rules notified on 13 Nov 2025, creating India's first comprehensive personal data regime. Full substantive compliance is due by 13 May 2027, with consent manager registration opening around Nov 2026
Penalties reach Rs 250 cr per violation category, and the Data Protection Board is already constituted and able to receive complaints
Impact on industries
- Compliance cost is material and broad-based - notice and consent, breach reporting, retention limits and data principal rights affect any business holding customer data
- Significant Data Fiduciaries face additional audit, impact assessment and localisation-adjacent obligations, which lands hardest on banks, insurers, telcos and platforms
- Creates a service market in consent management, compliance tooling and audit, and alignment with global privacy law helps Indian providers handling overseas data
- MeitY has consulted on compressing the window from 18 to 12 months, so the effective deadline may move earlier
Industries affected
IT Services-Large & Medium
Private Sector Bank
Telecom-Mobile network/other services
Financial Market Infrastructure, Ratings & Fintech
Internet Platforms-Marketplaces & Classifieds
Internet Platforms-E-Commerce & Consumer
Internet Platforms-Online Travel (OTA)
Internet Platforms-Logistics & Commerce Enablement
Digital Media, Content & Gaming