DPDP Act: What's Coming Next
India’s Digital Personal Data Protection (DPDP) Act is being rolled out in phases. Here are the key dates, compliance requirements, and penalties your business needs to know.
India passed the Digital Personal Data Protection (DPDP) Act in August 2023 to protect people’s personal data online. The Act aims to give people more control over their personal information and make organizations responsible for how they collect, use, store, and protect it.
DPDP Act Implementation Timeline
13 November 2025: Completed
Data Protection Board Established
Strengthen your organization’s data privacy framework with structured assessment and advisory aligned with India’s Digital Personal Data Protection Act (DPDPA), GDPR, PDPA, LGPD, CCPA, and other applicable privacy requirements.
Eagle’s Data Privacy Compliance Advisory service helps organizations understand their applicable privacy practices, identify compliance gaps, and help implement practical measures to improve data handling, protection, retention, access, and privacy governance framework.
13 November 2026: Coming Soon
Consent Manager Registration Begins
Consent Managers can start registering with the Data Protection Board of India. They help people give, check, and withdraw permission for businesses to use their personal data through a single platform. Businesses should start preparing their systems and processes to work with registered Consent Managers and manage customer consent properly.
13 May 2027: The Big Deadline
Core Compliance Obligations Take Effect
Organizations must prepare to meet the applicable requirements under the DPDP Act and Rules, including:
Notice and Consent: Provide clear, itemized privacy notices and obtain valid consent before processing personal data, where required.
Security Safeguards: Implement reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or loss.
Personal Data Breach Reporting: Notify the Data Protection Board and affected individuals of personal data breaches as required under the applicable rules and prescribed timelines.
Children’s Data: Meet applicable requirements for verifiable parental consent and the protection of children’s personal data.
Data Retention and Erasure: Define retention periods and erase personal data when its purpose has been fulfilled, unless retention is required or permitted by law.
Significant Data Fiduciaries: Prepare for additional obligations applicable to organizations classified as Significant Data Fiduciaries, including prescribed assessments, audits, and other compliance measures.
Cross-Border Data Transfers: Review international data transfers and ensure compliance with applicable restrictions and government notifications.
DPDP Act Penalties for Non-Compliance
The DPDP Act provides for financial penalties of up to ₹250 crore for certain contraventions. The applicable penalties depend on the nature of the breach and the specific obligation violated.
The following maximum penalties apply to the relevant contraventions under the Act:
Penalties as follows
| Nature of Non-Compliance / Breach | Maximum Penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | Up to ₹250 crore |
| Failure to notify the Data Protection Board and affected individuals of a personal data breach, as required | Up to ₹200 crore |
| Breach of additional obligations relating to children's personal data | Up to ₹200 crore |
| Breach of additional obligations applicable to Significant Data Fiduciaries | Up to ₹150 crore |
| Any other breach of the Act or its Rules | Up to ₹50 crore |
| Breach of duties by an individual (Data Principal) | Up to ₹10,000 |
How are penalties determined?
The Data Protection Board determines the penalty based on the circumstances of each case, considering factors such as the nature, gravity, and duration of the contravention, the type of personal data involved, and the steps taken to mitigate its consequences.
Security safeguards and breach reporting deserve particular attention because failures in these areas can lead to substantial financial penalties. Strong IT security, timely incident detection, and an effective response process can help organizations reduce their exposure.
How Eagle Can Help
The time to prepare is now. Eagle helps organizations assess their data protection readiness, strengthen cybersecurity, and build the processes needed to support DPDP compliance.
Our team can help you:
Assess Data Protection Readiness
Identify gaps in your current practices, map where personal data is stored and processed, and understand the steps required to improve compliance readiness.
Strengthen Security Controls
Improve your security posture through vulnerability assessment and penetration testing (VAPT), security reviews, and recommendations to address identified weaknesses.
Build Breach Detection and Response Capabilities
Develop incident response playbooks, strengthen detection and escalation processes, and prepare procedures to support applicable breach notification requirements.
Prepare for Consent and Data Rights Management
Review your privacy notices, consent workflows, data correction and erasure processes, and grievance redressal mechanisms.
Improve Data Protection Governance
Support the development of data handling policies, retention practices, access controls, and accountability measures aligned with your organization’s compliance needs.
Start Preparing for DPDP Compliance Today
Don’t wait until the compliance deadlines approach. Assess your current data protection practices, identify gaps, and take the necessary steps to protect personal data and strengthen your organization’s readiness.
Connect with Eagle to assess your DPDP readiness and strengthen your data protection and cybersecurity practices.
Call us: +91-9667088955 Or Email: sales@eagle.in