Key findings
Consent records must be demonstrable. Organisations should be able to show when and how consent was given for a specific purpose, and when it was withdrawn; consent assumed from legacy terms and conditions is unlikely to meet the Act's standard.
High confidenceData mapping is the activity with the longest lead time, and every other workstream depends on it.
High confidenceContracts with data processors need revision, because the data fiduciary remains responsible for processing carried out on its behalf.
High confidenceBreach response plans built for CERT-In reporting need extending to cover notification of the Data Protection Board and affected individuals.
Moderate confidence
Context
The Digital Personal Data Protection Act, 2023 gives India its first comprehensive law on digital personal data. It creates rights for individuals, called data principals, and obligations for the organisations that determine how their data is processed, called data fiduciaries. Penalties are significant: up to 250 crore rupees for failing to take reasonable security safeguards to prevent a personal data breach.
What we recommend
- Start a data map now: what personal data you hold, why, where it flows and who processes it.
- Redesign consent so that it is specific, informed and as easy to withdraw as to give, with records you can produce.
- Review every contract with a vendor that processes personal data on your behalf.
- Extend your incident response plan to cover DPDP breach notification alongside CERT-In reporting.
- Confirm the commencement dates and transition periods that apply to you, with legal counsel.
References
- Government of India. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023).
- Ministry of Electronics and Information Technology. Digital Personal Data Protection Rules, 2025.
- Indian Computer Emergency Response Team (CERT-In). Directions under sub-section (6) of section 70B of the Information Technology Act, 2000. 28 April 2022.
- Government of India. The Information Technology Act, 2000, as amended.
How we reached these conclusions
This brief draws on 4 published regulations, standards and frameworks, listed in the references, applied through Krynthnode analysis. Vendor claims are never counted as evidence on their own. Each finding is graded in the Krynthnode confidence ledger, described on our methodology page, and the whole brief is due for review by 27 January 2027.