Penalties
DPDPA penalties: how big can one get? Up to ₹250 crore
The Schedule sets maximums. The Board fixes an amount only after an inquiry finds a significant breach, using seven factors set out in the Act.
Our article · Penalties ·
6 min read
Top stories, free to read
More to read
Security safeguards
DPDP security safeguards: a checklist for small business
The Rules list seven minimum safeguards, from data security to keeping logs for a year. The duty starts on 13 May 2027.
Registration
DPDP Act registration: only Consent Managers register
Only Consent Managers register with the Board; those rules come into force on 13 November 2026. Significant Data Fiduciaries are notified by the government. Other businesses meet the duties from 13 May 2027.
Erasure
Delete request vs invoices under the DPDP Act: which one wins?
Erase on request unless keeping the data is necessary for the purpose or to comply with a law. The Act and Rules name no invoice period, so the period comes from the other law.
Vendors
Zoho, Tally, Google Workspace, WhatsApp Business: a Data Processor?
Where a supplier stores or handles customer data for you, it is your Data Processor and you stay responsible. What the law asks, with Zoho, Tally, Google Workspace and WhatsApp Business as examples of where data sits.
DPDPA Support
Small business
DPDP Act for small businesses: there is no size test
The law has no size test. These are the duties that start on 13 May 2027, with our own first steps for a shop, an app, a coaching institute or a salon, clearly labelled.
More articles
Children’s data
Children’s data, DPDP Act: who is a child and who must consent?
Clinics and hospitals
Clinics and hospitals under the DPDP Act: what about emergencies?
Consent Managers
DPDP Consent Managers: who can register from 13 November 2026?
Definitions
Data Fiduciary, Data Processor, Data Principal: which one are you?
Retention
How long can you keep customer data? Logs have a one-year minimum
Privacy page
Privacy policy for an Indian website? The DPDP Act uses other words
In case you missed it
More news
Other laws
DPDP Act vs IT Act 2000: does it override?
The DPDP Act adds to other laws and prevails only to the extent of a conflict. It amends the IT Act, including omitting 43A, from 13 May 2027.
5 min read
Our view
Sections of our articles that give our own opinion on what to do. The law each one relies on is cited earlier in that article.
- Complaint to the Data Protection Board: the steps and 60-day appealOur view: what to do now
- Are startups exempt from the DPDP Act? Only if notifiedOur view: what to do now
- Do you need a DPO or a DPIA? Only if the government notifies youOur view: what to do now
- DPDP Act vs IT Act 2000: does it override?Our view: what to do now
- DPDP security safeguards: a checklist for small businessOur view: a checklist for a small business
- Delete request vs invoices under the DPDP Act: which one wins?Our view: a way to handle the request
Start here
Are startups exempt from the DPDP Act? Only if notified
The Act has no startup test. The government may notify startups out of five named provisions. We have seen no such notification as of 7 Oct 2026. Duties start on 13 May 2027.
DPDP Act registration: only Consent Managers register
Only Consent Managers register with the Board; those rules come into force on 13 November 2026. Significant Data Fiduciaries are notified by the government. Other businesses meet the duties from 13 May 2027.
DPDP Act for small businesses: there is no size test
The law has no size test. These are the duties that start on 13 May 2027, with our own first steps for a shop, an app, a coaching institute or a salon, clearly labelled.
DPDPA penalties: how big can one get? Up to ₹250 crore
The Schedule sets maximums. The Board fixes an amount only after an inquiry finds a significant breach, using seven factors set out in the Act.
Plan the work
DPDP Act vs IT Act 2000: does it override?
The DPDP Act adds to other laws and prevails only to the extent of a conflict. It amends the IT Act, including omitting 43A, from 13 May 2027.
DPDP Act dates: 13 Nov 2025, 13 Nov 2026, 13 May 2027. Which is yours?
Two instruments dated 13 November 2025 set three dates. Most duties on businesses start on the third.
Read elsewhere
Know your data
Children’s data, DPDP Act: who is a child and who must consent?
A child is anyone under 18. You need a parent’s verifiable consent first, and you may not track, behaviourally monitor or target ads at children unless an exemption applies.
Data Fiduciary, Data Processor, Data Principal: which one are you?
The three roles in the DPDP Act on one page, with the Act’s definitions in plain words and what each role owes.
Read elsewhere
- Third-Party Data Processors And Privacy Compliance: Emerging Risks Under Digital Personal Data Protection Act, 2023 (opens in a new tab)
- Processing children’s personal data under the DPDPA (opens in a new tab)
- Parental Consent Necessary For Online Platforms To Use Child’s Data As Centre Notifies DPDP Rules 2025 (opens in a new tab)
Set the rules
DPDP security safeguards: a checklist for small business
The Rules list seven minimum safeguards, from data security to keeping logs for a year. The duty starts on 13 May 2027.
Privacy policy for an Indian website? The DPDP Act uses other words
The law does not use the words privacy policy. It asks for a notice, a contact, a way to make requests and a grievance period.
Ask properly
DPDP Consent Managers: who can register from 13 November 2026?
Registration of Consent Managers starts on 13 November 2026. Data Fiduciary duties start later, on 13 May 2027.
DPDP consent notice: does yours meet Section 5 and Rule 3?
Every request for consent needs a notice that comes with it or before it. The Act and the Rules set the minimum contents.
Keep only as long as needed
Delete request vs invoices under the DPDP Act: which one wins?
Erase on request unless keeping the data is necessary for the purpose or to comply with a law. The Act and Rules name no invoice period, so the period comes from the other law.
How long can you keep customer data? Logs have a one-year minimum
Erase when the purpose ends unless a law says to keep it. Logs and related data are kept for at least one year for purposes the Rules list, then erased. Large platforms have a three-year limit.
Answer people on time
Complaint to the Data Protection Board: the steps and 60-day appeal
A person uses your grievance process first. The Board then checks, inquires and hears you, and an order can be appealed within 60 days.
DPDP rights: what the 90-day limit really covers
The Act gives people four rights against a Data Fiduciary. The Rules cap the grievance response period at 90 days. The 90 days covers the reply to a grievance.
Check risky processing
Do you need a DPO or a DPIA? Only if the government notifies you
Only a Significant Data Fiduciary, which the Central Government notifies, must appoint a DPO and run DPIAs. Those duties start on 13 May 2027.
Control your vendors
Zoho, Tally, Google Workspace, WhatsApp Business: a Data Processor?
Where a supplier stores or handles customer data for you, it is your Data Processor and you stay responsible. What the law asks, with Zoho, Tally, Google Workspace and WhatsApp Business as examples of where data sits.
Clinics and hospitals under the DPDP Act: what about emergencies?
Patient records are personal data like any other. The Act lists medical emergencies as a use that needs no consent, and the Rules give clinics a limited exemption for children’s data.
DPDP processors: what goes in a DPA, and why you stay responsible
The Act keeps the duty with you whatever the contract says, and requires a valid contract for processors engaged to help you offer goods or services.
Data leaving India
Can you send personal data outside India? Section 16 and Rule 15
The Act allows transfers abroad unless the government restricts a country by notification. The Rules add requirements about foreign States, and stricter Indian law still applies.
Read elsewhere
- The DPDP cross-border transfer rules aren't live yet; so why are contracts being redrafted as if they are? (opens in a new tab)
- DPDP Rules: How Section 16 Governs Data Transfers Abroad (opens in a new tab)
- Government notifies DPDP rules, sets 18-month roadmap for data protection regime (opens in a new tab)
When something goes wrong
DPDP data breach under Rule 7: what to send the Board in 72 hours
Two filings to the Board and a notice to every affected person. What each must contain, and when it is due.
Rules 2025
DPDP security safeguards: a checklist for small business
The Rules list seven minimum safeguards, from data security to keeping logs for a year. The duty starts on 13 May 2027.
DPDP Consent Managers: who can register from 13 November 2026?
Registration of Consent Managers starts on 13 November 2026. Data Fiduciary duties start later, on 13 May 2027.
How long can you keep customer data? Logs have a one-year minimum
Erase when the purpose ends unless a law says to keep it. Logs and related data are kept for at least one year for purposes the Rules list, then erased. Large platforms have a three-year limit.
DPDP rights: what the 90-day limit really covers
The Act gives people four rights against a Data Fiduciary. The Rules cap the grievance response period at 90 days. The 90 days covers the reply to a grievance.
Penalties
Complaint to the Data Protection Board: the steps and 60-day appeal
A person uses your grievance process first. The Board then checks, inquires and hears you, and an order can be appealed within 60 days.
DPDPA penalties: how big can one get? Up to ₹250 crore
The Schedule sets maximums. The Board fixes an amount only after an inquiry finds a significant breach, using seven factors set out in the Act.
Breach
DPDP data breach under Rule 7: what to send the Board in 72 hours
Two filings to the Board and a notice to every affected person. What each must contain, and when it is due.
Read elsewhere
- Navigating legal liabilities: Understanding DPDP execution (opens in a new tab)
- Digital Personal Data Protection (DPDP) Rules, 2025: Key Highlights of the Newly Notified Framework (opens in a new tab)
- Inside India's DPDP rules: Shaping future of personal data privacy in digital era (opens in a new tab)
Rights
Delete request vs invoices under the DPDP Act: which one wins?
Erase on request unless keeping the data is necessary for the purpose or to comply with a law. The Act and Rules name no invoice period, so the period comes from the other law.
Children
Children’s data, DPDP Act: who is a child and who must consent?
A child is anyone under 18. You need a parent’s verifiable consent first, and you may not track, behaviourally monitor or target ads at children unless an exemption applies.
Cross-border
Can you send personal data outside India? Section 16 and Rule 15
The Act allows transfers abroad unless the government restricts a country by notification. The Rules add requirements about foreign States, and stricter Indian law still applies.
Read elsewhere
- The DPDP cross-border transfer rules aren't live yet; so why are contracts being redrafted as if they are? (opens in a new tab)
- DPDP Rules: How Section 16 Governs Data Transfers Abroad (opens in a new tab)
- Government notifies DPDP rules, sets 18-month roadmap for data protection regime (opens in a new tab)
Small business
Are startups exempt from the DPDP Act? Only if notified
The Act has no startup test. The government may notify startups out of five named provisions. We have seen no such notification as of 7 Oct 2026. Duties start on 13 May 2027.
DPDP Act registration: only Consent Managers register
Only Consent Managers register with the Board; those rules come into force on 13 November 2026. Significant Data Fiduciaries are notified by the government. Other businesses meet the duties from 13 May 2027.
Zoho, Tally, Google Workspace, WhatsApp Business: a Data Processor?
Where a supplier stores or handles customer data for you, it is your Data Processor and you stay responsible. What the law asks, with Zoho, Tally, Google Workspace and WhatsApp Business as examples of where data sits.
DPDP Act for small businesses: there is no size test
The law has no size test. These are the duties that start on 13 May 2027, with our own first steps for a shop, an app, a coaching institute or a salon, clearly labelled.
Read elsewhere
- Third-Party Data Processors And Privacy Compliance: Emerging Risks Under Digital Personal Data Protection Act, 2023 (opens in a new tab)
- DPDP Act explained: Are startups ready for India's new data protection law? (opens in a new tab)
- TCS is all set to seek ‘consent manager’ permit under DPDP (opens in a new tab)
Free tools
- Your DPDPA processing map
Tick what you collect, the tools you use and where data goes, and see the DPDP Act duties and toolkit documents that match.
- The DPDPA duties list
The DPDPA duties in plain words, each with its section or rule.
Key dates
- Rules notified
- Consent Manager rules start
- The main Data Fiduciary duties start
Each date is cited in our timeline article.
Every story, newest first (49)
- DPDPA Support Complaint to the Data Protection Board: the steps and 60-day appeal
- DPDPA Support Are startups exempt from the DPDP Act? Only if notified
- DPDPA Support Do you need a DPO or a DPIA? Only if the government notifies you
- DPDPA Support DPDP Act vs IT Act 2000: does it override?
- DPDPA Support DPDP security safeguards: a checklist for small business
- DPDPA Support DPDP Act registration: only Consent Managers register
- DPDPA Support Delete request vs invoices under the DPDP Act: which one wins?
- DPDPA Support Zoho, Tally, Google Workspace, WhatsApp Business: a Data Processor?
- DPDPA Support DPDP Act for small businesses: there is no size test
- DPDPA Support Children’s data, DPDP Act: who is a child and who must consent?
- DPDPA Support Clinics and hospitals under the DPDP Act: what about emergencies?
- DPDPA Support DPDP Consent Managers: who can register from 13 November 2026?
- DPDPA Support Data Fiduciary, Data Processor, Data Principal: which one are you?
- DPDPA Support How long can you keep customer data? Logs have a one-year minimum
- DPDPA Support Privacy policy for an Indian website? The DPDP Act uses other words
- DPDPA Support Can you send personal data outside India? Section 16 and Rule 15
- DPDPA Support DPDP processors: what goes in a DPA, and why you stay responsible
- DPDPA Support DPDP rights: what the 90-day limit really covers
- DPDPA Support DPDP consent notice: does yours meet Section 5 and Rule 3?
- DPDPA Support DPDP data breach under Rule 7: what to send the Board in 72 hours
- DPDPA Support DPDPA penalties: how big can one get? Up to ₹250 crore
- DPDPA Support DPDP Act dates: 13 Nov 2025, 13 Nov 2026, 13 May 2027. Which is yours?
- DPDPA Support DPDP Act: does it apply to you? There is no size cutoff
- Hindustan Times (HT Insight) First DPDP challenge: Knowing where your personal data lives
- LiveLaw Third-Party Data Processors And Privacy Compliance: Emerging Risks Under Digital Personal Data Protection Act, 2023
- Bar & Bench The DPDP cross-border transfer rules aren't live yet; so why are contracts being redrafted as if they are?
- LiveLaw One Function, Two Rulebooks: Consent Manager-Account Aggregator Overlap Under DPDP Rules, 2025.
- LiveLaw From Checkbox To Control: Operationalising Consent Under DPDP Act
- Bar & Bench Navigating legal liabilities: Understanding DPDP execution
- The Times of India DPDP Act explained: Are startups ready for India's new data protection law?
- LiveLaw Cross-Border Transfer Of Healthcare Data: Reconciling India's DPDPA With GDPR
- SCC Online Blog Connected Healthcare and the Right to Privacy — Impact of DPDPA on Med-Tech
- Hindustan Times (HT Insight) Processing children’s personal data under the DPDPA
- Bar & Bench Companies can save up to ₹250 crore: Navigating the DPDP Act 2023
- LiveLaw The Digital Gavel: Navigating Adjudication Under DPDP Act, 2023
- The Economic Times TCS is all set to seek ‘consent manager’ permit under DPDP
- The Hindu From trust to tech: protecting India’s health data
- SCC Online Blog Digital Personal Data Protection (DPDP) Rules, 2025: Key Highlights of the Newly Notified Framework
- Moneycontrol Most MSMEs aren’t aware of DPDP Rules compliance yet, says Tally Solutions MD Tejas Goenka
- MediaNama DPDP Rules: How Section 16 Governs Data Transfers Abroad
- Bar & Bench MeitY notifies final Digital Personal Data Protection Rules 2025
- The Economic Times Inside India's DPDP rules: Shaping future of personal data privacy in digital era
- The Hindu What are the Digital Personal Data Protection Rules and when do they apply?
- LiveLaw Parental Consent Necessary For Online Platforms To Use Child’s Data As Centre Notifies DPDP Rules 2025
- MediaNama DPDP Rules: Consent Managers Must Be India-Incorporated Firms
- MediaNama DPDP Rules 2025: Fiduciary Duties Phase In Over 18 Months
- CNBC TV18 Government notifies DPDP rules, sets 18-month roadmap for data protection regime
- MediaNama DPDP Rules: Report Breach 'Without Delay', Update Board in 72 Hrs
- SCC Online Blog Data Deletion — A Key Compliance under the Digital Personal Data Protection Act, 2023
Headlines are quoted as each outlet published them, and each links to that outlet’s own page. For what applies and from when, see the DPDP Act timeline. The page changes when the site is rebuilt.
A drafting aid. Get legal advice for your situation. These pages report the published text.