DPDP Guide
A practical, chapter-by-chapter guide to India's Digital Personal Data Protection Act, 2023 and its 2025 Rules — written to be read start to finish, or opened at exactly the chapter you need.
How to use this guide
This guide covers DPDP compliance from first principles through to implementation — what the law requires, what's considered good operational practice even where the law is silent, and where software can help you run that practice day to day. It's written for founders, product and engineering teams, and compliance owners who need a working understanding of DPDP, not a courtroom-ready legal opinion. Where a specific question turns on your own facts, we say so plainly and point you toward qualified counsel rather than guessing on your behalf.
If you're starting from zero, read Chapters 1 through 3 in order — they build the vocabulary everything after them assumes. If you already know the basics, the sidebar (or the table of contents below) lets you jump straight to the chapter you need; each one stands on its own, with links out to related chapters where the topics genuinely connect.
Every chapter tags its claims this way, so you always know whether something is a legal obligation, a practice we'd recommend, or a capability a platform like Digital Anumati can help operationalize — not a substitute for the first two.
Who this is for
Founders, product/engineering leads, marketing teams, and compliance owners at businesses that handle personal data of people in India.
What it won't do
Give you a legal opinion on your specific obligations. For that, we'll point you toward qualified DPDP counsel at the relevant chapter.
20 chapters, beginner to advanced
All 20 chapters are live, from first principles through implementation.
DPDP Fundamentals
What DPDP is, who it applies to, and the vocabulary the rest of the guide assumes.
Personal Data
What counts as personal and digital personal data under the Act, and how the data lifecycle works.
DPDP Roles
Data Principal, Data Fiduciary, Data Processor, Consent Manager, SDF, and the Data Protection Board.
Consent Management
What counts as valid consent under DPDP, and how to run its lifecycle end to end.
Data Principal Rights
Access, correction and erasure, grievance redressal, and the right to nominate.
Data Processing
Collection, use, storage, sharing, and disclosure — and what makes processing lawful.
Data Inventory & Mapping
Building and maintaining a working record of what data you hold and where it flows.
Data Retention & Deletion
Retention periods, deletion obligations, backups, and keeping a defensible schedule.
Data Security
Reasonable security safeguards — access control, encryption, monitoring, and policy.
Data Breach
Detection, containment, the notification timeline, and post-incident review.
Children's Data
Parental consent, prohibited tracking, and what changes for websites, apps, and EdTech.
Data Processors & Vendors
Fiduciary vs. processor, due diligence, contracts, and vendor offboarding.
Significant Data Fiduciary
Who may qualify, and the additional obligations that come with SDF status.
DPIA & Privacy Risk
What a Data Protection Impact Assessment covers, and running one in practice.
Website Compliance
Forms, cookies, analytics, consent banners, and third-party scripts on your own site.
Digital Marketing
Email, SMS, WhatsApp, retargeting, and consent across marketing and CRM tools.
Governance
Roles, policies, training, documentation, and building an internal privacy culture.
DPDP Implementation
A practical, step-by-step roadmap from a standing start to a running programme.
DPDP Compliance Checklist
Practical checklists by business type — website, SaaS, e-commerce, healthcare, and more.
DPDP Technology
Where consent platforms, data-mapping tools, and automation genuinely help — and where they don't.