by
DPDP Act guide
The DPDP Act and Rules, in plain English.
What the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 ask of your organisation, when each duty starts, and where Sehmat helps.
Key dates
Most duties apply from 13 May 2027.
The Rules come into force in phases. Most of what your organisation must do starts on one day.
— days
until most DPDP duties apply
13 Nov 202513 May 2027
The Act becomes law
The Digital Personal Data Protection Act receives the President's assent. It sets out how organisations in India must handle personal data.
The Rules are published
The DPDP Rules, 2025 (G.S.R. 846(E)) explain how the Act works in practice. The Data Protection Board of India is established in law.
Consent Managers can register
Companies can apply to the Board to become registered Consent Managers. Your own duties have not started yet.
Your duties begin
Notices, consent, withdrawal, security, breach notices, children's data, rights, grievances and erasure.
Dates as notified in the Gazette. A 2026 proposal to bring them forward has not been notified.
Duty by duty
What the law asks, and where Sehmat helps.
Sehmat gives you the tools and the evidence. Some parts stay with you, and we say so.
A clear notice
Section 5, Rule 3How Sehmat helpsEach form lists the data, every purpose, and how to withdraw and complain. Versions are kept.
Your partDescribe your purposes accurately.
In the person's language
Section 5(3), Section 6(3)How Sehmat helpsEnglish and the 22 scheduled languages. AI drafts are accepted by your team.
Your partReview your translations.
Valid consent
Section 6(1)How Sehmat helpsA separate choice for each purpose, a clear action to agree, and the evidence of how they agreed.
Your partAsk only for data you need.
Withdrawal as easy as giving
Section 6(4)How Sehmat helpsWithdraw from My consents or the same link. Your systems are told by signed webhook.
Your partStop processing in your systems.
Proof of consent
Section 6(10)How Sehmat helpsThe notice as shown, the evidence, a receipt, and a hash-chained audit log.
Your partKeep using Sehmat as the record.
People who agreed earlier
Section 5(2)How Sehmat helpsSend a notice or ask again, in bulk, to people who consented before.
Your partDecide who to contact.
Security safeguards
Section 8(5), Rule 6How Sehmat helpsEncryption, access control, logs and backups for the consent records Sehmat holds.
Your partSecure your own systems too.
Breach notices
Section 8(6), Rule 7How Sehmat helpsThe Board clock, notices to each person by email and SMS, and a list of who was told.
Your partInvestigate and contain the breach.
Erasure and retention
Section 8(7), Rule 8How Sehmat helpsRetention set per purpose and linked to the law. Erasure with proof, or a legal hold.
Your partErase data in your own systems.
A contact for questions
Section 8(9), Rule 9How Sehmat helpsYour Grievance Officer or DPO is printed on every notice and receipt.
Your partName the right person.
Children's data
Section 9, Rule 10How Sehmat helpsParent or guardian consent, with DigiLocker or document review. Asked again at 18.
Your partAvoid tracking and targeted ads for children.
Persons with disability
Rule 11How Sehmat helpsConsent by a lawful guardian, with the authority reviewed by your team.
Your partCheck the guardian's appointment.
Access to their data
Section 11How Sehmat helpsA plain-language summary in the person's language, with the data files.
Your partSupply data from your systems.
Correction, completion and erasure
Section 12How Sehmat helpsRequests are handed to your systems, which report the outcome back.
Your partMake the change.
Grievances in 90 days
Section 13, Rule 14How Sehmat helpsA grievance inbox with deadlines. Each reply explains how to go to the Board.
Your partResolve the complaint.
Nominees
Section 14How Sehmat helpsPeople name a nominee who can act on death or incapacity.
Your partConfirm the event.
Significant Data Fiduciaries
Section 10, Rule 13How Sehmat helpsA DPO role, registers and a signed compliance pack to support the yearly impact assessment and audit.
Your partIf notified: appoint a DPO in India and an independent auditor, and do the yearly assessment.
Consent Managers
Section 6(7) to 6(9), Rule 4How Sehmat helpsReady for registered Consent Managers. None can register before 13 November 2026, and the Board has not yet published how they connect.
Your partCheck which Consent Managers your users choose.
General information, not legal advice. Section and rule numbers refer to the DPDP Act, 2023 and DPDP Rules, 2025.
Penalties
What the Board can impose.
- Reasonable security safeguards (Section 8(5))₹250 crore
- Telling the Board and people about a breach (Section 8(6))₹200 crore
- Duties for children's data (Section 9)₹200 crore
- Duties of Significant Data Fiduciaries (Section 10)₹150 crore
- Breaking a voluntary undertaking given to the Board (Section 32)As the original breach
- Any other provision of the Act or Rules₹50 crore
- A Data Principal's own duties (Section 15)₹10,000
From the Schedule to the Act (Section 33). The Board decides the amount in each case.
Who is who
Fiduciary, Processor, Consent Manager.
Data Fiduciary
Your organisation. You decide why and how personal data is used, so the duties under the Act are yours.
Data Processor
Sehmat, for the consent records it keeps for you. It acts only on your instructions and does not use the data for its own purposes.
Consent Manager
A company registered with the Board that people can use to manage consent across organisations. Sehmat is not one.
Questions
Common questions about the DPDP Act.
When do the DPDP Rules apply to my organisation?
Most duties, including notice, consent, security, breach notices, children's data, rights and grievances, apply from 13 May 2027. Consent Managers can register with the Board from 13 November 2026.
Does the DPDP Act cover paper forms?
Yes. Section 3 covers personal data collected in non-digital form and digitised later, so paper consent forms that are scanned or typed in are in scope.
In which languages must the notice be available?
The person must be able to read the notice in English or any of the 22 languages in the Eighth Schedule to the Constitution.
How quickly must a breach be reported?
Rule 7 asks you to inform the Board without delay, send a detailed report within 72 hours, and tell each affected person without delay in plain language.
How long do we have to answer a grievance?
Rule 14 sets a period of up to 90 days. After that, the person can complain to the Data Protection Board.
Is consent always needed?
No. Section 7 lists legitimate uses where consent is not needed, such as some State benefits, legal duties and medical emergencies. Everything else needs consent.
Need help applying this to your organisation?
Talk to usGet ready for the DPDP Act before 13 May 2027.
Request access and a person from our team will set you up.