The Digital Personal Data Protection Act, 2023
A six-module course and the full text of the Act and the Rules, in the gazette's own words. Every statement carries the provision it rests on.
Start where you are
You need to know what applies to you and what it costs to get wrong.
Find out whether the Act applies to youYou need the text, its amendments, and what supersedes what.
Read the Act and the Rules, section by sectionYou need consent and notice that hold up in a real user flow.
Check whether a consent flow is validYou need retention, access control, and breach handling in code.
Learn the core rules: notice, consent, security, breachReference
The full text of the DPDP Act 2023, section by section, in the gazette's words, with the date each provision applies from.
Data Principal, Data Fiduciary, Significant Data Fiduciary, Consent Manager — who each term binds.
What a Data Fiduciary must do: notice, consent, purpose limitation, retention, security safeguards.
Access, correction, erasure, grievance redressal, and nomination — and the timelines attached.
The DPDP Rules 2025: notice, consent managers, security safeguards, breach intimation, retention periods, and the Board.
What to do in the first 72 hours, who to notify, and what the Board expects on record.
The course
Read them in order. Each one ends with a short self-test and a link to the next.
Readiness
SaralPrivacy runs the readiness assessment: your gaps written up against each provision, with the templates to close them.
Take the assessment on SaralPrivacy ↗Common questions
It applies to anyone processing digital personal data in India, and to processing outside India where goods or services are offered to people in India. It does not cover personal data processed for a purely personal or domestic purpose, or data made publicly available by the person themselves or under a legal obligation.
Failing to take reasonable security safeguards carries a penalty of up to ₹250 crore. Failing to notify the Data Protection Board or affected Data Principals of a breach carries up to ₹200 crore. Penalties are set by the Board after an inquiry, weighing the nature, gravity, and duration of the breach.
It must describe the personal data being sought, the purpose of processing, how a Data Principal may exercise their rights, and how to complain to the Board. It must be standalone, itemised, and written in plain language, and be available in English or any of the 22 languages in the Eighth Schedule.
A class the Central Government may notify based on the volume and sensitivity of data processed, risk to Data Principals, and impact on sovereignty, electoral democracy, and public order. Additional obligations follow: appointing a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments.
Anyone under 18 is a child. Verifiable consent from a parent or lawful guardian is required before processing. Tracking, behavioural monitoring, and targeted advertising directed at children are prohibited, though the Government may exempt certain classes of Data Fiduciary.
The Rules were notified on 13 November 2025. Rules 1, 2 and 17 to 21 (definitions and the Data Protection Board) apply from that date; Rule 4 (Consent Manager registration) from 13 November 2026; the remaining rules, including notice, security safeguards, breach intimation and children's consent, from 13 May 2027. Each rule page shows its own date.
Only Significant Data Fiduciaries must appoint a Data Protection Officer, who has to be based in India and answerable to the board of directors or equivalent. Every Data Fiduciary must nevertheless publish the contact details of someone able to answer questions about processing.
A Data Principal can obtain a summary of the personal data being processed and the identities of others it has been shared with, ask for correction or erasure, nominate someone to act on their behalf in the event of death or incapacity, and use a grievance redressal route before approaching the Board.
A working checklist covering notice, consent, retention, rights, and breach response. No sales sequence.
We email the checklist when it is ready, and nothing else unless you ask.