DPDP gap assessment

Under Section 6 of the DPDP Act 2023, consent to process personal data must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the specified purpose. A Data Principal may withdraw consent at any time, and withdrawing it must be as easy as giving it. Under Section 5, every request for consent must be accompanied or preceded by a notice, in clear and plain language, that gives an itemised description of the personal data and the purpose of processing, the manner in which the Data Principal may exercise their rights and withdraw consent, and the manner of making a complaint to the Data Protection Board.

On becoming aware of a personal data breach, a Data Fiduciary must, without delay, intimate each affected Data Principal in a concise, plain-language notice describing the breach, its likely consequences, the mitigation measures the Data Fiduciary has taken, the safety measures the Data Principal can take, and contact details for queries. It must also intimate the Data Protection Board of India without delay with the initial facts (nature, extent, timing, location and likely impact), followed by a detailed report - including broad facts, causes, mitigation and the notifications made to Data Principals - within 72 hours of becoming aware, or a longer period the Board allows on request.

Chapter III of the DPDP Act 2023 grants every Data Principal four rights against a Data Fiduciary: the right to access information about the personal data being processed and the identities of other fiduciaries with whom it has been shared (Section 11); the right to correction, completion, updating and erasure of personal data (Section 12); the right of grievance redressal through the Data Fiduciary's or Consent Manager's mechanism, exercisable before approaching the Data Protection Board (Section 13); and the right to nominate another individual to exercise these rights in the event of the Data Principal's death or incapacity (Section 14). Section 15 sets out corresponding duties of the Data Principal.

Under Section 9 of the DPDP Act 2023, a 'child' is a person who has not completed 18 years of age. Before processing a child's personal data (or that of a person with a disability who has a lawful guardian), a Data Fiduciary must obtain verifiable consent of the parent or lawful guardian. A Data Fiduciary must not undertake processing likely to cause a detrimental effect on the well-being of a child, and must not carry out tracking, behavioural monitoring, or targeted advertising directed at children. The Central Government may exempt notified classes of Data Fiduciary, or notified purposes, from some of these conditions.

Under Section 10 of the DPDP Act 2023, the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary (SDF), based on factors including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential effect on the sovereignty and integrity of India, risk to electoral democracy, and security of the State and public order. An SDF must: appoint a Data Protection Officer based in India who represents it under the Act and is the point of contact for grievance redressal; appoint an independent data auditor to evaluate compliance; and undertake periodic Data Protection Impact Assessments, periodic audits, and such other measures as may be prescribed.

Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023); Presidential assent 11 August 2023; Gazette ID CG-DL-E-12082023-248045.

Digital Personal Data Protection Rules, 2025 notified 13 November 2025 as G.S.R. 843(E), Gazette of India Extraordinary Part II s.3(i).

Gazette date corroborated across multiple law-firm analyses; the PIB document filename carries the press-release date (17 Nov), not the notification date.

Provisions constituting and empowering the Data Protection Board (ss.18–26), definitions, and procedural rules took effect on 13 November 2025.

Section 6(9) (verifiable parental consent) and section 27(1)(d) (publication duty) commence one year from notification — November 2026.

Notice and consent standards, data fiduciary duties, children's data and data principal rights commence eighteen months from notification — May 2027. Published analyses split on 12 vs 13 May; confirm the exact day with counsel before relying on it.

The Schedule to the Act caps monetary penalties at up to ₹250 crore per instance for the highest tier (failure to take reasonable security safeguards to prevent a personal data breach), with lower tiers at ₹200 crore, ₹150 crore and below; the Data Protection Board determines penalties on the facts.

Amount verified directly against the Gazette PDF text ('may extend to two hundred and fifty crore rupees'). Enforcement follows the phased commencement (see dpdp-phase-3).

Under Rule 7 of the DPDP Rules 2025, a data fiduciary must intimate the Data Protection Board of a personal data breach without delay on becoming aware, follow with a detailed report within 72 hours (extendable by the Board), and notify affected data principals of the breach in plain language.

Timelines corroborated across multiple legal publishers. Enforcement follows the phased commencement (see dpdp-phase-3). Runs in parallel with CERT-In’s 6-hour incident reporting — the same incident triggers both.

Every consent request must be accompanied or preceded by a notice informing the data principal of: (i) the personal data and the purpose of processing; (ii) the manner of exercising rights under s.6(4) (withdrawal) and s.13 (grievance redressal); and (iii) the manner of making a complaint to the Data Protection Board. For consents given before commencement, notice must follow as soon as reasonably practicable.

Contents verified directly against the Gazette PDF text. Notice must be available in English or any Eighth Schedule language.

Rule 4 of the Digital Personal Data Protection Rules, 2025 establishes the registration and oversight framework for Consent Managers and comes into force on 13 November 2026. A Consent Manager is registered with the Data Protection Board of India and acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent via an accessible, transparent and interoperable platform.

MeitY returns HTTP 403 to automated retrieval for both the Rules page and its own FAQ PDF, so this is corroborated across independent legal analyses rather than read from the primary text. Verify against the notified Rules before relying on it in a deliverable.

Part A of the First Schedule sets the conditions the Board must be satisfied of before registering a Consent Manager. They include incorporation in India, a minimum net worth of INR 2 crore (adjusted for inflation), sound financial condition and general character of management, and sufficient technical, operational and financial capacity to discharge the role. Directors, key managerial personnel and senior management must be persons of general reputation and record of fairness and integrity.

MeitY returns HTTP 403 to automated retrieval for both the Rules page and its own FAQ PDF, so this is corroborated across independent legal analyses rather than read from the primary text. Verify against the notified Rules before relying on it in a deliverable.

A Consent Manager acts in a fiduciary capacity toward the Data Principal. It must not act as Data Fiduciary or Data Processor for the same Data Principal whose consent it manages, must route personal data in a form it cannot itself read, must treat all Data Fiduciaries neutrally without preferential access, and must retain consent records for at least seven years.

MeitY returns HTTP 403 to automated retrieval for both the Rules page and its own FAQ PDF, so this is corroborated across independent legal analyses rather than read from the primary text. Verify against the notified Rules before relying on it in a deliverable. The conflict rule is the commercially significant one: an organisation cannot register as a Consent Manager for data subjects it also serves as a Data Fiduciary.