Navigating the DPDP Act: Compliance and Consent Explained

Introduction

India’s Digital Personal Data Protection Act, 2023 is now the central law governing how organisations collect, process, store, and share digital personal data in India. As enforcement milestones under the DPDP Act and DPDP Rules 2025 begin to take effect, businesses are actively searching for clear guidance on DPDP Act compliance, consent management, and lawful data processing obligations.

Built on the constitutional recognition of privacy as a fundamental right, the DPDP Act establishes enforceable accountability for data fiduciaries while allowing innovation across India’s digital economy. For organisations evaluating DPDP compliance tools, consent management platforms in India, and alternatives to global privacy frameworks such as GDPR, understanding the Act’s structure is essential.

With phased enforcement beginning in November 2025 and full operationalisation expected by 2027, this article explains the DPDP Act’s core components, timelines, and compliance implications. The content is aligned strictly with the Digital Personal Data Protection Act, 2023 and the notified Digital Personal Data Protection Rules, 2025, with limited GDPR comparison for contextual clarity.

Legislative Background and Rollout Timeline

The DPDP Act traces its origins to the 2017 Puttaswamy judgment, which affirmed privacy as a fundamental right under the Indian Constitution. Following multiple consultation drafts, the legislation received Presidential assent on 11 August 2023.

Implementation is intentionally phased:

• Structural provisions and foundational obligations were notified in November 2025.

• Requirements related to consent managers and Data Protection Officers are expected to take effect by November 2026.

• Full enforcement, including the operational Data Protection Board of India, is scheduled by May 2027.

This staggered rollout is designed to give organisations time to operationalise consent, rights management, and audit mechanisms without disrupting ongoing digital services.

Scope and Applicability of the DPDP Act

The DPDP Act applies exclusively to digital personal data. This includes personal data collected directly in digital form and offline personal data that is subsequently digitised. Organisations assessing whether the DPDP Act applies to them must evaluate both the nature of the data and the method of processing.

The Act has extraterritorial applicability. Any entity outside India that offers goods or services to individuals in India, or processes personal data in connection with profiling Indian data principals, is required to comply with DPDP Act requirements.

By replacing the IT Rules, 2011, the DPDP Act introduces a unified, consent-driven framework for digital personal data protection in India, making DPDP compliance mandatory across sectors such as fintech, SaaS, e-commerce, insurance, healthcare, and online platforms.

Key Roles Under the Act

The DPDP framework is built around clearly defined roles:

• Data Principal: The individual to whom the personal data relates. For children, parents or lawful guardians act on their behalf.

• Data Fiduciary: The entity that determines the purpose and means of processing personal data.

• Data Processor: An entity that processes personal data on behalf of a Data Fiduciary.

Certain organisations may be classified as Significant Data Fiduciaries based on factors such as volume of data processed, sensitivity, or potential risk to individuals. These entities face enhanced obligations, including the appointment of an India‑based Data Protection Officer, periodic audits, and Data Protection Impact Assessments.

Consent Under the DPDP Act and Lawful Processing

Consent is the primary lawful basis for processing personal data under the DPDP Act. For consent to be valid, it must be free, specific, informed, unconditional, and unambiguous, and must be obtained through a clear affirmative action.

Data Fiduciaries are required to provide clear and concise consent notices that specify the categories of personal data collected, the purpose of processing, data sharing practices, the rights of the Data Principal, and grievance redressal mechanisms. Withdrawal of consent must be as easy as granting it, reinforcing the Act’s emphasis on meaningful user choice.

In addition to consent, the DPDP Act recognises specific legitimate uses where personal data may be processed without consent. These include compliance with legal obligations, employment-related processing, medical emergencies, delivery of government subsidies or services, and other uses expressly permitted by law. Unlike GDPR’s legitimate interest framework, these lawful uses are fixed and predefined, simplifying DPDP compliance mapping for Indian businesses.

Rights and Duties of Data Principals Under the DPDP Act

The DPDP Act grants Data Principals a focused set of rights designed to ensure transparency and control over personal data. These rights include the right to access personal data being processed, the right to correction and erasure, and the right to grievance redressal through the Data Fiduciary or the Data Protection Board of India.

The Act also introduces the right to nominate another individual to exercise data protection rights in the event of death or incapacity. This provision is unique to India’s data protection framework and is an important consideration for organisations building DPDP-compliant consent and rights management workflows.

Alongside these rights, Data Principals have statutory duties, including the obligation to provide accurate information and refrain from submitting false or frivolous grievances. Breach of these duties can attract penalties of up to ₹10,000, reinforcing balanced accountability under the DPDP Act.

Children’s Personal Data

Children’s data receives heightened protection under Section 9 of the Act. For individuals under 18 years of age:

• Verifiable parental or guardian consent is mandatory

• Tracking, profiling, behavioural monitoring, and targeted advertising are prohibited

• Processing that may cause harm is not permitted

Limited exceptions exist for purposes such as education, healthcare, or government benefits, subject to necessity and safeguards. Penalties for violations related to children’s data can extend up to ₹200 crore, reflecting the Act’s strict stance in this area.

Data Security, Retention, and Cross‑Border Transfers

Data Fiduciaries must implement reasonable security safeguards, ensure data accuracy, and erase personal data once the stated purpose is fulfilled.

In the event of a personal data breach, notification obligations apply, with enhanced scrutiny for Significant Data Fiduciaries.

Cross‑border transfers follow a blacklist model. Data may be transferred outside India unless the Central Government explicitly restricts transfers to specific countries or territories. This approach differs from GDPR’s adequacy and standard contractual clause framework and offers greater operational flexibility for global digital services.

Enforcement and Penalties

The Data Protection Board of India is the central enforcement authority under the Act. It has powers comparable to a civil court, including conducting inquiries and imposing penalties.

Penalties can reach up to ₹250 crore per instance, with specific caps for certain violations such as children’s data and breach‑related failures. Appeals lie with the Telecom Disputes Settlement and Appellate Tribunal, followed by the High Courts.

DPDP Act and GDPR: A Strategic Comparison

While GDPR familiarity covers a significant portion of DPDP compliance thinking, the Indian framework is narrower and more digital‑focused. Key distinctions include:

• Digital‑only scope versus GDPR’s broader personal data coverage

• Fixed lawful uses instead of a balancing test

• A higher uniform age threshold for children

• A blacklist‑based approach to cross‑border transfers

• Predictable penalty ceilings rather than turnover‑linked fines

These differences require India‑specific compliance design rather than direct GDPR replication.

Preparing for Compliance

As enforcement timelines approach, organisations should focus on:

• Auditing existing data flows and consent mechanisms

• Updating notices to meet clarity and language requirements

• Building verifiable consent and withdrawal processes

• Preparing for rights management and grievance handling at scale

Aligning early with the DPDP Act not only reduces regulatory risk but also strengthens user trust in an increasingly privacy‑aware digital market.

Conclusion

The Digital Personal Data Protection Act, 2023 establishes a clear and enforceable framework for personal data protection in India’s digital ecosystem. With defined consent standards, focused data principal rights, structured enforcement, and predictable penalties, the DPDP Act moves data protection from policy intent to operational accountability.

As DPDP Act enforcement timelines approach, organisations that invest early in DPDP compliance, consent management, and auditable data governance will be better positioned to reduce regulatory risk and build user trust. Aligning internal systems with the DPDP Act and DPDP Rules 2025 is no longer optional, but a foundational requirement for doing digital business in India.

How Blutic Supports DPDP Act Compliance

Blutic is designed to help organisations operationalise DPDP Act requirements without disrupting existing digital experiences. By enabling clear, verifiable consent collection, simplified consent withdrawal, and auditable consent records, Blutic supports key obligations under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

As businesses prepare for phased enforcement, platforms like Blutic can assist with implementing consent notices aligned with statutory requirements, managing user preferences at scale, and maintaining consent evidence for regulatory review. This approach allows organisations to move from theoretical compliance to practical, defensible data governance under India’s evolving data protection framework.

At Blutic, we are building tools with these obligations in mind. If you are working through your DPDP compliance roadmap, Blutic can help you think through consent, governance, and operational readiness in a structured and practical way.