DPDP Act 2023: The Complete Guide for Indian Product Companies

India's Digital Personal Data Protection Act, 2023 (DPDP Act) is the country's first comprehensive data protection law. It received presidential assent on August 11, 2023, the DPDP Rules were notified on November 13, 2025, and penalty enforcement is expected to begin around May 2027. If your company processes personal data of people in India, the Act applies to you now, even while parts of the enforcement machinery are still being stood up.

This guide is for founders, CTOs, and engineering teams who need to know what the law requires, what the deadlines are, and what "compliance" looks like in practice for a product company. It is not legal advice. It is a map of the operational work, written by people who build privacy infrastructure.

What the DPDP Act actually is

The Act regulates "data fiduciaries" (the entities deciding how personal data is processed) and protects "data principals" (the people the data is about). It replaces the fragmented regime of Section 43A of the IT Act, which had effectively been superseded since the 2017 Puttaswamy judgment recognised privacy as a fundamental right.

The law is deliberately leaner than GDPR. It has one primary ground for processing (consent), a defined set of "legitimate uses," and a penalty regime capped at ₹250 crore per violation under Section 33.

The timeline that matters

| Date | Milestone | |------|-----------| | August 11, 2023 | DPDP Act receives presidential assent | | January 3, 2025 | Draft DPDP Rules released for public consultation | | November 13, 2025 | DPDP Rules, 2025 notified (G.S.R. 846(E)) | | November 2026 | Consent Manager registration window opens | | ~May 2027 | Full penalty enforcement expected to begin |

The Act itself was law from 2023. What changed in November 2025 is that the rules gave the Act operational teeth: notice formats, consent requirements, security safeguard standards, breach reporting timelines, and the Significant Data Fiduciary framework.

The five conditions for valid consent

Section 6 of the Act defines consent as "free, specific, informed, unconditional and unambiguous" and requires a "clear affirmative action" from the data principal. The Rules add more: notice in English and the languages listed in the Eighth Schedule of the Constitution, an option to withdraw consent as easily as it was given, and separate consent for separate purposes.

What this means in practice for a product team:

• A pre-ticked checkbox is not consent
• Bundling unrelated purposes into one "Accept" is not consent
• Consent must be recorded in a way you can reconstruct later, including what the user saw at the time
• Withdrawal must be as easy as giving consent was

The last two points are where most companies fall down, because they are engineering problems, not drafting problems.

Consent is the primary basis, not one of six

GDPR gives controllers six legal bases for processing. The DPDP Act is narrower: consent, plus a closed set of "legitimate uses" defined in Section 7. Those cover things like employment-related processing, state functions, medical emergencies, and data made public by the principal themselves.

For most Indian consumer internet companies, consent is the ground you will rely on for marketing, analytics, and personalisation. That makes your consent infrastructure the centre of your compliance program, not an add-on.

Erasure and the rights of the data principal

The Act's rights framework centres on erasure. Section 12 gives data principals the right to erasure, and the operational reality is that a deletion request in India now has a legal clock behind it. A rights request in 2026 typically arrives by email, gets forwarded to an engineer, and dies in a Slack thread. The Act expects more: you need a way to receive requests, verify the person, act on them across every system that holds the data, and document what happened.

That last part, documentation, matters more than most teams realise. If you cannot reconstruct what you did for a request, you have not fulfilled it from a defensibility standpoint.

What the Rules add: security, breach reporting, and SDFs

Three parts of the DPDP Rules, 2025 matter most to engineering teams:

• Rule 6 (security safeguards): reasonable security safeguards, including encryption, access controls, and a floor of one year of logs for systems processing personal data.
• Rule 7 (breach notification): notify the Data Protection Board within 72 hours of a breach, and notify affected individuals. Note this sits alongside CERT-In's incident reporting rules, which have their own timeline.
• Rule 13 (Significant Data Fiduciaries): the government can designate SDFs based on volume, sensitivity, and risk. SDF obligations include Data Protection Impact Assessments, periodic data audits, and appointing a Data Protection Officer based in India.

If your company is a healthtech, fintech, or consumer platform with large volumes of data, assume you are SDF-adjacent and build the evidence trail early.

What "compliance" looks like for a product team

Strip away the legal language and the operational checklist looks like this:

1. Publish a notice that states who you are, what you collect, why, and how to exercise rights
2. Collect consent with proof: receipts that pin what the user saw and chose, at a point in time
3. Know where personal data lives across your systems
4. Have a repeatable way to receive, verify, and fulfil erasure requests
5. Keep evidence of fulfilment that you can export when challenged
6. Secure the systems that hold personal data and keep audit logs

None of this is optional theatre. A privacy policy and a banner do not delete a row in production Postgres. The work is operational, and it lives in your data layer, your SDK, and your request handling, not in a legal document.

Where Erasure fits

Erasure is a privacy operations platform built for exactly this workload. Accord handles notice and consent with versioned configuration and immutable receipts. Rights handles deletion requests with OTP verification, durable jobs, and honest outcome states. Data Maps and Systems handle knowing where data lives and acting on it across Postgres, MySQL, HTTP, and Webhook. Evidence packages what happened into exportable form.

We built it because the alternative, spreadsheets and manual SQL, breaks the moment request volume grows past a handful. It is invite-only during beta, and the pricing is designed for Indian startups: Free, Starter at ₹999/month, and Growth at ₹9,999/month.

If you want the shorter operational version of this guide, our DPDP compliance checklist walks through the same work item by item. And if you are comparing this law to Europe's, our GDPR vs DPDP comparison covers the differences that change engineering decisions.

The Act is in force. The rules are notified. The clock on enforcement is running. The question is not whether to act, but how much of the work you want to do by hand.