Why Does the DPDPA Matter?
Until 2023, India had no comprehensive data protection legislation. The IT Act's Section 43A and the SPDI Rules (2011) were limited in scope, outdated, and insufficient for the scale of India's digital economy.
With over 800 million internet users, India processes massive volumes of personal data daily. The DPDPA establishes clear, enforceable rules for how organizations collect, store, process, and share digital personal data.
Non-compliance carries penalties up to ₹250 crore per instance. The Data Protection Board of India will adjudicate complaints, investigate breaches, and impose penalties.
Internet Users in India
Max Penalty per Instance
Year Enacted
Comprehensive Data Protection Law
Who Needs to Act?
The DPDPA regime impacts every organization that processes digital personal data in India: here's who in your organization should be paying attention.
What Does the DPDPA Cover?
Dive deep into India's data protection regime: from foundational concepts to actionable compliance guidance.
Explore DPDPA Topics
Dive into specialised topics across India's Digital Personal Data Protection regime.
The DPDPA Journey
From committee formation to Presidential assent: the legislative path to India's first comprehensive data protection law.
Srikrishna Committee Formed
Justice B.N. Srikrishna Committee constituted by the Government of India to study data protection frameworks and recommend a law.
Draft Bill Submitted
The Srikrishna Committee submits its report ('A Free and Fair Digital Economy') along with a draft Personal Data Protection Bill.
PDP Bill Introduced in Parliament
The Personal Data Protection Bill, 2019 is introduced in Lok Sabha and referred to a Joint Parliamentary Committee (JPC) for detailed examination.
JPC Report Submitted
The Joint Parliamentary Committee submits its report with 81 amendments and 12 recommendations, significantly reshaping the original Bill.
DPDPA Introduced and Enacted
The Digital Personal Data Protection Bill, 2023 is introduced in Parliament, passed by both Houses, and receives Presidential assent.
Draft Rules Published
The Draft Digital Personal Data Protection Rules are published for public consultation, detailing implementation mechanisms.
DPDP Rules Notified
The DPDP Rules, 2025 notified via Gazette S.O. 846(E). Board provisions (Rules 17-21) take immediate effect.
Consent Manager Registration Opens
Rule 4 provisions for Consent Manager registration and associated obligations come into effect, 1 year after notification.
Full Operational Enforcement
All operational provisions including privacy notices, consent management, security safeguards, breach notification, and grievance redressal come into full effect.
Interactive Compliance Tools
Assess your readiness, estimate exposure, and generate compliant notices, all in minutes.
Built by India's Leading Law Firm
DPDPA Decoded is an informational resource by Lakshmikumaran & Sridharan Attorneys, one of India's largest law firms with 40+ years of practice, 800+ team members across 14 offices. Our team brings deep expertise in technology law, data privacy, and regulatory compliance.