The DPDP Act, 2023 and the DPDP Rules, 2025 — section by section
Each page below takes one provision of India's Digital Personal Data Protection Act, 2023 or of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), notified 13 November 2025), restates it in plain English, names the penalty band that applies when you get it wrong, and shows the control that satisfies it. Written for DPOs, CISOs and legal teams who need the citation, not a summary.
These are explainers, not legal advice, and the legal text on each page is paraphrased — check the gazette before you rely on a provision.
The Act — Digital Personal Data Protection Act, 2023
DPDP §4
Grounds of Processing Personal Data
There are exactly two lawful bases: consent (§5-§6) or a §7 legitimate use.
DPDP §5
Notice & Free Consent
Notice must be served at or before the point of consent.
DPDP §6
Conditions of Valid Consent
Free + specific + informed + unconditional + unambiguous.
DPDP §7
Legitimate Uses
§7 carves out narrow grounds where consent under §6 is not required.
DPDP §8
Obligations of the Data Fiduciary
Accuracy — keep data correct and complete.
DPDP §9
Processing of Children's Data
Verifiable parental consent before processing.
DPDP §11
Right to Access, Correction, Erasure
Access — a principal can demand a summary of their data.
DPDP §12
Right to Nominate
Every principal can name a nominee who steps into their rights on death or incapacity.
DPDP §13
Grievance Redressal
Publish a grievance officer (DPO or designate).
The Rules — Digital Personal Data Protection Rules, 2025
DPDP Rule 9 (2025)
Contact Information for Questions About Processing
A named, reachable contact point is a standalone obligation — not a line in your privacy policy.
DPDP Rule 10 (2025)
Verifiable Parental Consent
Consent for a child's personal data must come from the parent or lawful guardian, and it must be verifiable — the child's own consent, or an unchecked self-declaration, is not enough.
DPDP Rule 12 (2025)
Exercise of Principal Rights
You must publish how a principal can exercise rights.
DPDP Rule 13 (2025)
Grievance Resolution Timeline
Acknowledge promptly.
Where to go next
- The DPDP primer — the Act end to end, in one read.
- The modules — the controls that satisfy each obligation.
- Pricing — what a DPDP programme costs on ProtectComply.
- DPDP FAQ — the questions buyers actually ask.