Regulatory Framework · India
Data Privacy Lawyer in India
India's data protection law has arrived. Are you compliant?
₹250Cr
Max DPDP Penalty
2023
DPDP Act Enacted
Nov 2025
DPDP Rules Notified
Understanding the Regulatory Framework
The Digital Personal Data Protection Act 2023 (DPDP Act) represents the most significant shift in India's data governance since the IT Act 2000. With the Digital Personal Data Protection Rules, 2025 notified in November 2025 and its obligations phasing in over 18 months, the Act imposes obligations on every organisation processing digital personal data in India — consent management, purpose limitation, data minimisation, data principal rights, breach notification, and restrictions on cross-border data transfers. Penalties reach ₹250 crore for a failure to take reasonable security safeguards. Corpus Juris Legal helps businesses build compliant frameworks before the phased obligations take effect.
DPDP Act readiness assessment and gap analysis
Privacy policy and notice drafting under DPDP framework
Data processing agreements (DPAs) with vendors and processors
Consent management architecture and purpose limitation compliance
Cross-border data transfer restrictions advisory
Data breach response procedures and notification planning
Frequently Asked Questions
When does the DPDP Act 2023 come into full effect?+
The DPDP Act was enacted in August 2023. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and bring it into force in phases: the Data Protection Board provisions applied immediately, consent manager registration follows after a year, and most Data Fiduciary obligations apply 18 months after notification. Businesses should use the transition period to build compliance now.
Who is a Data Fiduciary under the DPDP Act?+
Any person (including a company) that determines the purpose and means of processing personal data. If your organisation collects or uses personal data of Indian individuals, you are likely a Data Fiduciary with obligations under the Act.
Does the DPDP Act apply to businesses outside India?+
Yes. The Act has extra-territorial application — it applies to processing of personal data of Indian data principals even if the processing happens outside India, if in connection with offering goods or services to people in India.
Get DPDP Compliance Advice
Speak directly with a partner. No juniors, no call centres, no runaround.