Compliance guide · India

The DPDP Act, in plain words.

India’s Digital Personal Data Protection Act covers almost every business that holds customer or staff data, and its main duties apply from 13 May 2027. Here is what it asks of you, the dates, the penalties, and what it means for your AI.

Get a DPDP readiness quote See the deadlines
Act and Rules checked line by lineMain duties from 13 May 2027Penalties up to ₹250 crore
DPDP readiness · sample● demo
  1. BLOCKED Customer phone numbers kept out of chatbot replies
  2. FOUND KYC scans readable through AI search
  3. FIXED Consent notice rewritten in plain language
  4. FLAGGED Chat transcripts kept with no end date
  5. PASSED Breach drill: Board report ready in time
In plain words

The DPDP Act 2023 is India’s main data protection law. If you collect or use digital personal data of people in India (customers, users or staff), you are a Data Fiduciary. You must give a clear notice, get valid consent or rely on a permitted “legitimate use”, keep the data safe, report breaches, delete data you no longer need, and answer people’s requests. The DPDP Rules 2025 fill in the details, and most duties apply from 13 May 2027.

Checked against official sources on . General information, not legal advice.

Law
DPDP Act 2023 and DPDP Rules 2025
Main duties from
13 May 2027
Highest penalty
₹250 crore per breach
Regulator
Data Protection Board of India
Key dates

Three phases, one deadline that matters.

The Rules were notified on 13 November 2025 and switch on in three stages. Changing systems, contracts and notices takes months, so the time to start is now.

AUG 2023DPDP Act becomes lawNOV 2025Rules notified, Board set upNOV 2026Consent manager rules applyMAY 2027Main duties and penalties apply TODAY · NOV 2026
  1. AUG 2023DPDP Act becomes law
  2. NOV 2025Rules notified, Board set up
  3. NOV 2026Consent manager rules apply
  4. MAY 2027Main duties and penalties apply

The Board’s rules applied from 13 November 2025. Consent manager rules apply 12 months later, and the main duties for businesses 18 months later. If the government changes these dates, we update this page.

Who is who

Four roles, one of them is you.

The Act gives everyone a name. Knowing yours tells you which duties are yours, and which you must pass on to vendors by contract.

Who is who under the DPDP Act. The person, called the Data Principal, gets a notice from your company, gives or withdraws consent, and can ask to see, correct or erase their data. Your company, the Data Fiduciary, is responsible: it gives vendors (Data Processors) a contract with safeguards, alerts people about breaches, and reports breaches to the Data Protection Board at once and in full within 72 hours. An optional consent manager, registered with the Board, can manage consent from 13 November 2026. People can complain to the Board after using your grievance process. CONSENT MANAGER · OPTIONAL Manages consent for peopleRegistered with the Board,live from 13 November 2026 THE PERSON Data PrincipalYour customer, useror employee YOUR COMPANY Data FiduciaryDecides why and howpersonal data is used YOUR VENDORS Data ProcessorsCloud, CRM, payroll,AI model APIs DATA PROTECTION BOARD Investigates and finesUp to ₹250 crore a breachNOTICE: WHAT AND WHYCONSENT, OR WITHDRAW ITSEE, CORRECT, ERASEBREACH ALERTCONTRACT+ SAFEGUARDSBREACH REPORT:AT ONCE + 72 HOURSCOMPLAINT, AFTER YOURGRIEVANCE PROCESS
The cast of the DPDP Act. Your company stays responsible for data its vendors handle, including AI model providers.
What you must do

Nine duties, in plain words.

  • Tell people clearly

    A plain notice of what data you collect and why, available in English or any of the 22 languages of the Constitution’s Eighth Schedule.

  • Get valid consent

    Free, specific, informed and a clear yes, limited to the data you need. Withdrawing must be as easy as giving it.

  • Or use a legitimate use

    Some processing needs no consent, such as data a person gives you for a purpose they asked for, employment, or legal duties.

  • Keep it safe

    Encryption or masking, access control, monitoring, backups, and logs kept for at least a year, plus security terms in vendor contracts.

  • Report breaches

    Tell the Board and each affected person without delay, then give the Board a full report within 72 hours.

  • Delete when done

    Erase data once its purpose is served or consent is withdrawn, unless a law says keep it.

  • Answer requests

    Let people see, correct and erase their data and name a nominee, and answer complaints within 90 days.

  • Protect children

    Verifiable parental consent for anyone under 18, and no tracking, behavioural monitoring or targeted ads aimed at children.

  • Hold vendors to it

    You stay responsible for data your processors handle, including cloud, CRM and AI model providers.

Penalties

What getting it wrong can cost.

Penalties are set per breach, by type. The biggest is for the most common failure: not keeping data safe.

Maximum DPDP Act penalties for each breach: ₹250 crore for failing to keep data safe; ₹200 crore for not reporting a breach; ₹200 crore for breaking the rules on children’s data; ₹150 crore for Significant Data Fiduciary duties; ₹50 crore for any other breach; ₹10,000 for a person who breaks their own duties. Data not kept safeNo reasonable security safeguards ₹250 croreBreach not reportedTo the Board and affected people ₹200 croreChildren’s data rules brokenParental consent, no tracking or targeted ads ₹200 croreSignificant Data Fiduciary dutiesDPO in India, audits, impact assessments ₹150 croreAny other breachOf the Act or the Rules ₹50 croreA person’s own dutiesFor example, a false complaint ₹10,000
Maximum penalties from the Schedule to the DPDP Act. The Board sets the actual amount after looking at how serious and how long the breach was, the type of data, whether it happened before, and what you did to limit the harm.
Where your AI fits

Your chatbot is a data processing system too.

The Act does not mention AI by name, but every chatbot, voice agent and AI search tool that touches personal data is covered. This is where it bites.

Where the DPDP Act touches a support chatbot conversation: a plain notice when the chat opens (section 5), a clear consent that is easy to undo (section 6), asking only for data the task needs, the AI looking up only this customer’s data (section 8(5)), transcripts stored encrypted and access-logged (Rule 6) and deleted when the purpose is done (section 8(7)). A red path shows the failure our red team tests for: a prompt injection hidden in a message makes the bot reveal another customer’s details, which is a breach you must report to the Board and the people affected. CHAT OPENSPlain notice shownSECTION 5CONSENTA clear yes, easy to undoSECTION 6ASK LITTLEOnly data the task needsSECTION 6(1)AI LOOKS UPJust this customer’s dataSECTION 8(5)STORED SAFELYEncrypted, access-loggedRULE 6DELETEDWhen the purpose is doneSECTION 8(7)ATTACKPrompt injection hiddenin a customer messageLEAKAnother customer’sdetails in the replyYOUR DUTYTell the Board and people,full report in 72 hours
The red path is what our AI red team looks for. If a hidden instruction makes your bot show one customer’s details to another, that is a personal data breach under the Act, with the same reporting duty as any other.
AI and the DPDP Act

Five AI questions auditors will ask.

  • Can our AI show one customer’s data to another?

    If a prompt injection or a weak access check makes it happen, that is a breach. We test for it in LLM red teaming and AI search leak tests.

  • Can we train AI on customer data?

    Only within the purpose people agreed to, or a legitimate use. Data collected for support is not automatically allowed for training.

  • How long do we keep chat transcripts?

    Only as long as the purpose needs, with security logs kept for at least a year. Set a deletion rule before launch.

  • Do we know every AI tool staff use?

    Staff pasting customer data into public AI tools is a common leak. Shadow AI discovery finds them.

  • Is our AI provider a Data Processor?

    Usually yes. You need a contract with safeguards, and you stay responsible for what they do with the data.

How we get you ready

From data map to evidence pack.

  1. Weeks 1–2

    Data map

    Where personal data comes in, where it lives, who sees it and which vendors and AI tools touch it.

  2. Weeks 2–3

    Gap check

    Every duty in the Act and Rules scored met, partly met or missing, with the fix for each.

  3. Weeks 3–8

    Fix the basics

    Notices, consent flows, retention rules, vendor terms and the security safeguards in Rule 6.

  4. Weeks 6–8

    Breach drill

    A rehearsal of the first hours: who decides, who tells the Board and people, and the 72-hour report.

  5. Weeks 8–10

    Evidence pack

    Records that show the Board, auditors and customers what you did, and when.

Already ISO 27001 certified? Much of the security work carries over, so readiness is usually faster.
Questions

DPDP questions we hear every week.

Q01Does the DPDP Act apply to my company?
Almost certainly, if you process digital personal data in India, or process it abroad in connection with offering goods or services to people in India. It does not cover purely personal or household use, or data a person has made public themselves.
Q02When do we have to comply?
The main duties for businesses, and the penalties, apply from 13 May 2027. The Data Protection Board has been in place since 13 November 2025, and the consent manager rules apply from 13 November 2026. Changing systems and contracts takes months, so most companies are starting now.
Q03What counts as a personal data breach?
Any unauthorised processing, or accidental disclosure, sharing, change, loss or destruction of personal data, or loss of access to it, that harms its confidentiality, integrity or availability. A chatbot revealing one customer’s address to another counts.
Q04How fast must we report a breach?
Tell the Data Protection Board and each affected person without delay. Then send the Board a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer. CERT-In’s six-hour rule for cyber incidents can apply to the same event, so plan for both.
Q05What is a Significant Data Fiduciary?
A company the government names because of the volume or sensitivity of data it handles, or the risk to people or the country. It must appoint a Data Protection Officer based in India and an independent data auditor, run a yearly impact assessment and audit, check that its algorithms do not put people’s rights at risk, and keep specified data in India.
Q06Do we need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint one, based in India. Everyone else must publish the contact details of a person who can answer questions about how you use personal data.
Q07Can we use customer data to train our AI?
Only within the purpose people agreed to, or a legitimate use the Act allows. In most cases, data collected to answer support questions needs fresh consent before it is used to train a model. Collect the minimum and anonymise where you can.
Q08Is this legal advice?
No. We are security engineers, not lawyers. We map your data, close the security and process gaps and build the evidence. Your lawyer should sign off notices and contracts, and we work alongside them.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings