DPDP Act FAQ: clear answers.

The Digital Personal Data Protection Act, 2023 is India’s statute on processing digital personal data. It defines the rights of individuals (Data Principals), the duties of organisations (Data Fiduciaries) and the powers of the Data Protection Board. Detailed procedures are in the DPDP Rules, 2025.

Generally, any organisation that decides the purpose and means of processing personal data, in India or in connection with offering goods or services to people in India. That can include clinics, schools, coaching institutes, shops and online services. Applicability depends on the Act’s scope provisions and any exemptions.

There is no blanket exemption for small size. The Act allows the Central Government to notify certain classes, including startups, for relaxed treatment of some provisions, so check whether any notification covers you rather than assuming either way.

The Act’s term for the organisation that determines why and how personal data is processed. If you decide to collect customer phone numbers and what to do with them, you are likely a Data Fiduciary for that data. See our plain-English explainer.

Any data about an individual who can be identified by or in relation to it. Names, phone numbers, email addresses, photographs, ID details, appointment records and student records are typical examples.

The Act applies to personal data collected in digital form, and to data collected in non-digital form that is later digitised. A paper form that you then type into a system is within scope once digitised.

In phases. Board-related provisions took effect on 13 November 2025, consent-manager rules follow after one year, and most business duties are scheduled for 13 May 2027. A January 2026 proposal to shorten the 18-month period had not, in the sources we checked, been notified. See the timeline explained.

The Act’s Schedule sets maximum penalties, up to ₹250 crore for failing to take reasonable security safeguards. These are ceilings decided by the Board after an inquiry. See the penalty table.

No. Consent is the main ground, but section 7 lists “legitimate uses” where processing can happen without it, for example where a person voluntarily provides data for a stated purpose. Which ground fits depends on your facts.

In plain language: the personal data being collected, the specific purpose, how to withdraw consent and exercise rights, and how to complain to the Board. See our consent and notice guide.

The Act talks about notices and consent rather than a “privacy policy” by name. Most organisations still publish a policy to explain their practices, and it works alongside the notice shown when data is collected. See privacy policy vs consent notice.

The Act requires a Data Protection Officer based in India only for Significant Data Fiduciaries. Other organisations should still name someone who can answer questions and handle requests, and publish their contact details.

A “child” is anyone under 18. Processing a child’s data generally needs verifiable parental consent, and tracking, behavioural monitoring or targeted advertising directed at children is restricted. The Rules provide certain exemptions, for example for some healthcare and educational purposes, so schools and clinics should read the Rules carefully.

The Act does not ban any tool, but it expects you to know why you collect data, keep it secure and limit its use. See a practical WhatsApp guide.

Inform affected individuals and the Data Protection Board without delay, and provide detailed information to the Board within 72 hours of becoming aware, as we read Rule 7. See our breach response guide.

Access to a summary of their data and how it is processed, correction and erasure, grievance redressal, and the right to nominate someone to act for them. See rights explained.

Generally yes, except to countries the Central Government restricts by notification. Other laws may impose stricter requirements for specific sectors.

A registered entity that lets individuals give, manage, review and withdraw consent through one platform. The registration framework opens around November 2026. Most small businesses will not be consent managers but may meet them as users.

No. Gopyata offers practical readiness support: organising questions, mapping data and planning next steps. For legal interpretation, speak to a qualified lawyer.

List the personal data you hold, why you collect it, who can access it and which vendors receive it. Our readiness checklist and the 7-step guide are good starting points.