The DPDP Act: India's Privacy Reckoning
The Digital Personal Data Protection Act, 2023 (DPDP Act) received Presidential assent on August 11, 2023, marking the end of a decade-long legislative journey that began with the Justice B.N. Srikrishna Committee. With the DPDP Rules notified in November 2025 and their operative provisions commencing in phases, most obligations taking effect around May 2027, every organization that processes digital personal data within India, or outside India in connection with offering goods or services to individuals in India, must now build or demonstrate a compliance architecture.
The numbers are stark. The Act prescribes penalties up to ₹250 Crore for the most severe violations, with a graduated penalty structure that makes even minor non-compliance expensive. For a mid-market organization, a single significant breach notification failure could attract penalties that dwarf annual cybersecurity budgets.