How ready is your organisation for the new world of
Privacy & AI Governance?
Master India's DPDP Act 2023 with free assessments, expert insights, compliance templates and AI governance tools — built for businesses, DPOs and legal teams.
Shilpi Kulshrestha
Founder & Corporate Law Expert, BusinezExcellence
Common DPDPA Questions Answered
Direct answers to the most frequently asked questions about India's Digital Personal Data Protection Act 2023.
What is the maximum penalty under India's DPDP Act 2023?+
The maximum penalty under the DPDP Act 2023 is ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach. Other penalties range from ₹50 crore to ₹200 crore depending on the nature of the violation, as set out in the Schedule to the Act.
When did the DPDP Act 2023 come into force?+
The DPDP Act 2023 received presidential assent on 11 August 2023. The DPDP Rules 2025 were notified in November 2025. Implementation is phased — main operational provisions, including consent and data principal rights, are scheduled to commence on 13 May 2027.
Is a Data Protection Officer (DPO) mandatory under DPDPA?+
A DPO is mandatory only for Significant Data Fiduciaries (SDFs) notified by the Central Government under Section 10. Non-SDFs are not required to appoint a DPO under the Act, though they still must comply with other obligations.
Does India's DPDP Act require data localisation?+
No. The DPDP Act does not mandate general data localisation. Cross-border transfers are allowed by default unless the Central Government restricts them under Section 16. However, sectoral laws — such as RBI's payment data rules, IRDAI insurance regulations, and SEBI securities rules — may require localisation for specific data types.
Who is a Data Fiduciary under the DPDP Act?+
A Data Fiduciary is any person or entity that alone or jointly with others determines the purpose and means of processing personal data. This includes most businesses, websites, mobile apps, SaaS platforms, and service providers operating in India.
What are the 6 rights of Data Principals under DPDPA?+
The DPDP Act grants six core rights: (1) Right to access information about personal data, (2) Right to correction and erasure, (3) Right to grievance redressal, (4) Right to data portability, (5) Right to nominate, and (6) Right to withdraw consent.
How many countries does Legal Galaxy cover for data protection laws?+
Legal Galaxy compares data protection laws across 90+ jurisdictions, including India's DPDP Act 2023, GDPR, CCPA/CPRA, China's PIPL, Brazil's LGPD, and others. Each country profile covers the law name, enforcement authority, compliance level, and 14-topic coverage analysis.
AI Document Generator
Generate privacy policies, consent forms, and AI governance documents instantly with our intelligent document builder.
Latest Insights
In-depth analysis on India's data protection law and global privacy
DPDP Act 2023: Director Liability, Board Responsibilities and Data Privacy Compliance for Indian Companies
Can directors be personally liable under India's DPDP Act 2023? Explore board responsibilities, CEO accountability, compliance requirements and data breach management for Indian companies.
Data Breach Response & Notification Counsel under India's DPDP Act
The DPDP Rule 7 breach-notification timeline, what to tell affected individuals and the Data Protection Board, the 72-hour detailed report and how organisations should prepare.
GDPR Compliance: A Practical Guide for Indian Businesses Operating in the EU
Understanding GDPR requirements for Indian companies with EU operations. Key obligations, data transfer mechanisms, and compliance strategies for cross-border data flows.
Featured Guides
Comprehensive compliance guides — updated regularly
DPDPA 2023 — Complete Guide
A practical, end-to-end guide to India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Covers applicability, Data Principals, Data Fiduciaries, consent and notice, legitimate uses, rights and duties, children’s data, Significant Data Fiduciaries, security safeguards, personal data breaches, retention and erasure, cross-border transfers, Consent Managers, the Data Protection Board, penalties, commencement timelines, and a practical compliance roadmap for organisations.
GDPR Essentials for Indian Companies
How EU data protection rules affect Indian businesses. Comprehensive guide to GDPR applicability, key principles, lawful bases, data subject rights, and compliance strategies for Indian IT and BPO companies.
Real-World Case Studies
Learn from actual compliance challenges and solutions
Data Breach Incident in a Healthcare Company
Analysis of a data breach incident in a healthcare company and lessons learned for compliance.
Consent Management in E-Commerce Platform
Case study on implementing consent management in a large e-commerce platform.
Free Talk to Our DPDP Act Experts
Fill in your details and a compliance expert will be in touch within one business day.
Why Choose Legal Galaxy?
Built by legal professionals for businesses that need practical, actionable compliance tools
Expert-Built Content
Created by corporate lawyers and privacy specialists with 10+ years of experience
Free Tools
Document generator, compliance scorecard, and 20+ learning modules — all free
Updated Regularly
Content updated to reflect latest DPDPA rules, circulars, and enforcement actions
Global Coverage
Compare privacy laws across 90+ countries including GDPR, CCPA, and PIPL
Practical Focus
Real-world case studies and templates you can actually use — not just theory
No Signup Required
Start using every tool and reading every guide — no email required to begin
Explore the Galaxy
Built by Legal & Governance Professionals
Legal Galaxy is a Privacy & AI Governance platform designed to help businesses understand, assess, and implement responsible data and AI practices.
Learn More →Don't just use AI. Govern it.
Join businesses across India building defensible DPDPA compliance programs. Start with a free assessment, then explore our guides, tools, and expert services.