Meet India's DPDPA obligations with less manual effort

The Digital Personal Data Protection Act 2023 is India's data protection law for digital personal data. Passed by Parliament and assented to on 11 August 2023, it sets duties for Data Fiduciaries, such as giving notice, obtaining consent, protecting data and reporting breaches, and gives Data Principals rights to access, correct and erase their data, seek grievance redress and nominate someone to act for them.

The DPDPA is being brought into force in phases under the DPDP Rules 2025, notified on 13 November 2025. Provisions setting up the Data Protection Board took effect immediately. Consent Manager registration applies from 13 November 2026, and most Data Fiduciary obligations, including notice, security safeguards, breach reporting and data principal rights, apply from 13 May 2027.

Any person or organisation that determines the purpose and means of processing digital personal data in India must comply as a Data Fiduciary. The Act also reaches organisations outside India that process such data in connection with offering goods or services to people in India. Data processed for purely personal or domestic purposes, and data made publicly available by the individual or under law, is outside its scope.

Penalties are set in the Schedule to the Act and imposed by the Data Protection Board. Failing to take reasonable security safeguards can attract up to ₹250 crore. Failing to notify a personal data breach, or breaching duties for children's data, can attract up to ₹200 crore each. Significant Data Fiduciary breaches can reach ₹150 crore, and other breaches up to ₹50 crore.

A Data Fiduciary must notify both the Data Protection Board and each affected Data Principal of a personal data breach under section 8(6). The DPDP Rules 2025 require prompt notice to affected people describing the breach, its likely consequences and mitigation steps, an initial report to the Board without delay, and a detailed report to the Board within 72 hours, unless the Board allows longer.

The DPDPA shares GDPR principles such as purpose limitation, data minimisation, security and individual rights, but it is narrower. It covers only digital personal data, relies on consent or listed legitimate uses rather than six lawful bases, has no separate special category data, and applies extra duties to Significant Data Fiduciaries named by the government. GDPR controls give a strong starting point but need adjusting.

Yes, ISO 27001 helps with the DPDPA's security obligations but does not cover the whole Act. An ISO 27001 information security management system supports the duty to take reasonable security safeguards and gives a base for breach response. You still need privacy specific measures, including notices, consent handling, data principal rights, retention and erasure, children's data controls and grievance redressal.

Yes, OneClickComply supports the DPDPA today. The platform maps DPDPA obligations to controls, generates policies with AutoComplete, collects evidence automatically from connected tools and monitors controls continuously. Because controls are mapped across frameworks, work done for ISO 27001, SOC 2 or GDPR also counts towards DPDPA. OneClickComply does not certify compliance, as the DPDPA has no certification scheme.