Find the personal data
Data mapping across apps, databases, logs, backups and third parties. You cannot protect what nobody has written down, and section 8(5) is judged on what you actually hold.
DPDP Act 2023 · IT Act 2000 · CERT-In
Compliance you can evidence.
India's data protection regime stops being theoretical on 14 May 2027. We map where you stand, close the gaps, and leave you with the proof.
Walk the DPDP timeline.
Scroll from the day the Rules were notified to the day every obligation applies.
- 14 Nov 2025 · Rules notifiedThe DPDP Rules 2025 were notified. The Act commenced and the Data Protection Board was established.
- TodayConsent Manager registration opens on 14 November 2026 (6 days left).
- 14 Nov 2026 · Consent ManagersConsent Manager registration opens, and the Board gains power to investigate registration breaches and impose penalties.
- 14 May 2027 · Everything elseNotice and consent, breach reporting, security safeguards, children's data, Significant Data Fiduciary duties, Data Principal rights and cross-border transfer rules all take effect.
14 Nov 2025
Rules notified
The DPDP Rules 2025 were notified. The Act commenced and the Data Protection Board was established.
Done
14 Nov 2026
Consent Managers
Consent Manager registration opens, and the Board gains power to investigate registration breaches and impose penalties.
6 days left
14 May 2027
Everything else
Notice and consent, breach reporting, security safeguards, children's data, Significant Data Fiduciary duties, Data Principal rights and cross-border transfer rules all take effect.
187 days leftSource: Digital Personal Data Protection Rules, 2025, notified by MeitY on 14 November 2025. Section 44(2) of the DPDP Act, which removes section 43A of the IT Act 2000 and with it the SPDI Rules 2011, commences on 13 May 2027.
The Schedule to the DPDP Act.
These are statutory maximums, imposed by the Data Protection Board after an inquiry. They are penalties on the organisation, not on individuals.
| Breach | Provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | s. 8(5) | ₹250 crore |
| Failure to notify the Board or affected individuals of a personal data breach | s. 8(6) | ₹200 crore |
| Breach of the additional obligations relating to children's data | s. 9 | ₹200 crore |
| Breach of the additional obligations of a Significant Data Fiduciary | s. 10 | ₹150 crore |
| Breach of any other provision of the Act or the Rules | residual | ₹50 crore |
| Breach of a voluntary undertaking accepted by the Board | s. 32 | Up to the amount for the underlying breach |
| Breach of a Data Principal's own duties | s. 15 | ₹10,000 |
Still in force today
IT Act 2000 and CERT-In.
The DPDP Act does not switch these off. Section 43A and the SPDI Rules govern personal data until 13 May 2027, and the CERT-In Directions apply right now.
| Obligation | Provision | Exposure |
|---|---|---|
| Negligent failure to protect sensitive personal data, causing wrongful loss or gain | IT Act s. 43A | Compensation, with no statutory ceiling |
| Disclosing personal information in breach of a lawful contract | IT Act s. 72A | Up to 3 years' imprisonment and/or ₹5 lakh |
| Failure to comply with a CERT-In direction | IT Act s. 70B(7) | Up to 1 year's imprisonment and/or ₹1 lakh |
| Reporting a cyber incident later than six hours after noticing it | CERT-In Directions, 28 Apr 2022 | Penalised under s. 70B(7) |
| Failure to retain 180 days of ICT logs within India | CERT-In Directions, 28 Apr 2022 | Penalised under s. 70B(7) |
| VPN and cloud providers: customer records for 5 years after de-registration | CERT-In Directions, 28 Apr 2022 | Penalised under s. 70B(7) |
Figures are the statutory maximums as written in the Schedule to the DPDP Act 2023 and the cited sections of the IT Act 2000. This page is a summary for orientation, not legal advice. The Board sets the actual penalty case by case, having regard to the factors in section 33(2).
Four moves, in order.
01 02 Test the safeguards
Penetration testing and configuration review against the same data. The output is evidence that the safeguards were reasonable, which is the test the Board applies after a breach.
03 Rehearse the six hours
A breach runbook that fits the CERT-In six-hour window and the separate DPDP duty to notify the Board and the affected individuals. We rehearse it with your team so it isn't just a document in a folder.
04 Leave the paper trail
180 days of ICT logs held in India, clocks synchronised to NIC or NPL, consent records, and a gap register with owners and dates. When the Board asks, this is what you show them.
It probably applies to you.
The DPDP Act covers digital personal data processed in India, and personal data processed outside India where goods or services are offered to people in India. The Act sets no revenue or headcount threshold. Under section 17(3) the government can exempt notified classes of business, including startups, from some duties, but that happens only by notification.
- Applies to
- Any organisation that decides why and how digital personal data is processed. The Act calls you a Data Fiduciary
- Also applies to
- Processing outside India, where it relates to offering goods or services to people inside India
- Your customers' data
- Engaging a processor does not transfer liability. The Data Fiduciary stays answerable for the processor's failures
- Significant Data Fiduciary
- Government may designate you by volume and sensitivity of data, adding audit, DPIA and India-resident DPO duties under s. 10
- Breach notice
- Owed to both the Data Protection Board and every affected individual. This s. 8(6) duty is separate from CERT-In's
- CERT-In, today
- Six-hour incident reporting and 180-day in-India log retention are already in force and independent of the DPDP timeline
Start with the gap assessment.
We will tell you what you hold, where it leaks, and what the Board would ask for. If you are already in good shape, we will say so.