CevroIndia: India DPDPA and what it requires
Digital Personal Data Protection Act 2023 + Rules 2025: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Data Protection Board of India.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Depends on thresholds or circumstances |
| Data localization | Not required |
Penalties and enforcement
Fines up to ₹250 crore.
What to know in practice
Phased rollout, with full obligations effective from May 2027; Significant Data Fiduciaries carry extra DPO/DPIA/audit duties.
The security duty
Under s.8(5): Reasonable security safeguards to prevent personal data breaches; the 2025 Rules name encryption, masking, access control, log monitoring and backups. Source: published text, checked 2026-10.
How Cevro helps
- Maps India DPDPA to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in s.8(5).
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in India?
Data Protection Board of India oversees Digital Personal Data Protection Act 2023 + Rules 2025.
Is breach notification mandatory under India DPDPA?
Our reference does not record a fixed hourly deadline for India DPDPA. Check the statute and Data Protection Board of India guidance for the notification timing that applies to you.
Does India restrict cross-border data transfers?
Conditionally. Transfers are restricted in some circumstances, so check whether your data flows trigger the rules before relying on them.
Do you need a data protection officer under India DPDPA?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in India?
Fines up to ₹250 crore.