Data Privacy Compliance

DPDP Act & Rules
2025.

"A comprehensive guide to compliance, risk mitigation, and advisory opportunities under India's new digital data protection framework."

Jurisdiction

Scope of Applicability.

Within India

The Act applies to processing personal data within India if that data was collected in one of these two ways:

Born Digital: Data collected directly in digital format (e.g., online forms, apps).
Digitized Later: Data initially collected through non-digital means but subsequently converted into digital format.

Outside India

The Act also has an extraterritorial reach. It applies to the processing of digital personal data outside of India, but only if that processing is connected to an activity that involves offering goods or services to people within India.

Actionable Rights

Empowered
Data Principal.

The DPDP Act moves beyond notice-based transparency to establish concrete, enforceable rights enabling individuals to exercise meaningful control over their personal data.

Right to Access

Request confirmation of data processing, obtain summaries, categories held, and purposes of processing.

Right to Correction

Request correction, completion, or updating of inaccurate or incomplete personal data records.

Right to Erasure

Request deletion of data when consent is withdrawn or processing is no longer necessary.

Right to Nominate

Nominate another individual to exercise rights in the event of death or incapacity.

Section 9 & 10

Enhanced
Protections.

Protection for Minors

Children require heightened protection. Breaches regarding children's data can attract penalties reaching ₹200 Crore.

Verifiable Parental Consent

Requires age verification mechanisms and parental identity processes beyond simple attestation.
Processing Restrictions

Prohibits behavioral monitoring, tracking, and targeted advertising towards children.

Significant Data Fiduciaries (SDFs)

Entities classified as SDFs face heightened obligations due to data volume, sensitivity, or systemic importance. Breaches can incur penalties up to ₹150 Crore.

Impact Assessments (DPIA)

Must conduct comprehensive DPIAs for high-risk processing activities.

Periodic Data Audits

Independent auditors must periodically assess practices and compliance.

Data Protection Officer

Mandatory appointment of an India-based DPO as a primary point of contact.

Financial Exposure

The DPDP Act introduces a stringent penalty structure that demands serious attention from compliance professionals.

S.No.	Breach of Provision	Maximum Penalty
1	Failing to take reasonable security safeguards to prevent a data breach (Section 8(5)).	₹250 Crore
2	Failing to notify the Board or affected Data Principal of a personal data breach (Section 8(6)).	₹200 Crore
3	Breach of additional obligations related to processing children's data (Section 9).	₹200 Crore
4	Breach of additional obligations for a Significant Data Fiduciary (Section 10).	₹150 Crore
5	Breach of any other provision of this Act or the rules made thereunder.	₹50 Crore

CA Audit Focus

"The DPDP Act creates unprecedented demand for specialized compliance advisory services."

We provide Compliance Gap Analysis, Security & Processor Reviews, and Independent Data Auditor Services.

DPDP Act & Rules 2025.