DPDP Act 2023 compliance
for Indian businesses.
Any company, society, trust, LLP or professional practice that decides why and how it processes digital personal data in India is a Data Fiduciary under the DPDP Act, 2023, subject to the Act's exemptions. The DPDP Rules, 2025 were notified on 13 November 2025 and most obligations apply from 13 May 2027. JurisTatva builds the notices, consent architecture, registers, policies and SOPs that turn that exposure into a documented compliance file.
The Act does not ask what kind of entity you are.
It asks whether you determine the purpose and means of processing digital personal data in India. A "person" under Sec. 2(s) includes companies, societies, trusts, LLPs, sole proprietors and unincorporated associations alike — for-profit or not.
Employee & HR Records
Payroll, PF/ESI, appraisals and contact data of staff and consultants — even where processing for employment is a "legitimate use" under Sec. 7, the Act's security-safeguard and breach-notification duties still apply.
Members, Donors & Investors
Governing body, shareholder, donor and funder contact details — a not-for-profit or society structure gives no exemption.
Website, App & Event Data
Visitors, newsletter subscribers, webinar and training participants — every intake channel is a processing activity.
Vendor & Client Contacts
Any personal data shared with, or received from, processors and sub-processors under a service contract.
The Flagship Portals
The advisory company & compliance partner behind every platform below.
Our Specialised Venture Platforms
When do the obligations actually apply?
The DPDP Rules, 2025 were notified on 13 November 2025, and their provisions come into force in three stages. Last updated: October 2026. Always check the latest MeitY notifications, as the Government has proposed shortening some timelines.
Non-compliance is priced in crores, not notices.
Maximum penalties under the Schedule to the DPDP Act, 2023. The Data Protection Board decides the actual amount after an inquiry.
DPDP Act, 2023 — the questions people actually ask.
Any person — including a company, LLP, society, trust or sole proprietor — that determines the purpose and means of processing digital personal data is a Data Fiduciary under Section 2(i), regardless of whether it is for-profit or not-for-profit, subject to the exemptions in the Act.
A Data Fiduciary must notify the Data Protection Board of India and each affected Data Principal without delay, and give the Board a detailed report within 72 hours of becoming aware of the breach (or a longer period the Board allows).
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards. Other bands in the Schedule are up to ₹200 crore (breach notification and children's data), ₹150 crore (Significant Data Fiduciary obligations) and ₹50 crore (other violations by a Data Fiduciary).
Under the DPDP Rules, 2025, a Data Fiduciary must respond to a Data Principal's grievance within a maximum of 90 days, so most entities build their grievance and rights-request SOP around that 90-day limit.
A defensible compliance file typically includes a data mapping register, consent notices and logs, a master privacy policy, retention and breach policies, vendor DPAs, and SOPs for breach, grievance and rights-request handling — JurisTatva's framework organises 44 such instruments across 7 layers.
Find out exactly which of the 44 instruments you're missing.
A short diagnostic call maps your data flows against the DPDP checklist and tells you precisely where your exposure sits — before we quote a single rupee of fee.