ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXEverything businesses need to know about India's data protection law obligations, consent rules, and compliance steps.
The law defines the responsibilities of organisations that determine why and how personal data is processed, known as Data Fiduciaries, and gives rights to individuals, known as Data Principals.
The DPDPA establishes requirements around notice, consent, withdrawal of consent, children's data, data security, personal-data breaches, Data Principal rights, grievance handling, and other obligations.
DPDPA is in force, enforced by Data Protection Board of India; Rules 2025 (notified 13 Nov 2025) rolling out in phases.
DPDPA stands for the Digital Personal Data Protection Act.
It is commonly referred to as the DPDP Act 2023 or simply DPDPA.
The law establishes a framework for processing digital personal data in India while giving individuals greater control over how their personal data is collected and used.
For organisations, this means privacy cannot be treated only as a policy document. Businesses need processes and technical controls that support lawful data processing, meaningful consent where required, security, user rights, and accountability.
The DPDPA is written around the individual rather than the organisation. It treats digital personal data as something a person entrusts to a business for a stated purpose, not something the business acquires outright by collecting it.
That places control with the Data Principal. Notice has to be specific and understandable, consent has to be a real choice tied to a defined purpose, and the individual can revisit that choice later, so a decision made once continues to bind the organisation that relied on it.
The protection is practical rather than only declaratory. Personal data is meant to be limited to what the stated purpose needs, kept secure for as long as it is held, and not retained once that purpose has been served.
The DPDPA applies to the processing of digital personal data within the scope defined by the Act, including processing by organisations that operate in India.
It can also apply to certain processing outside India when it is connected with offering goods or services to Data Principals in India.
The law is therefore relevant to a wide range of organisations, including:
Organisations should assess their specific processing activities and legal obligations rather than assuming that every processing activity is treated identically.
Personal data is data about an individual who is identifiable by or in relation to that data.
Under the DPDPA, the framework focuses on digital personal data.
Examples can include information such as:
The actual applicability of the Act depends on the nature of the data and the processing activity.
A Data Fiduciary is a person who, alone or together with other persons, determines the purpose and means of processing personal data.
In simple terms, a Data Fiduciary is generally the organisation that decides:
Examples can include an online business collecting customer information, a SaaS platform processing user account data, or an e-commerce company using customer information to provide its services.
The concept is broadly comparable to a data controller under the GDPR, although the legal frameworks are different.
A Data Principal is the individual to whom the personal data relates.
For example, if a customer creates an account on an e-commerce website, the customer is the Data Principal and the organisation determining how that customer's personal data is processed may be the Data Fiduciary.
The DPDPA gives Data Principals certain rights and provides mechanisms for exercising those rights.
The DPDPA introduces several important privacy and data-protection requirements.
These include:
The exact obligations depend on the organisation, processing activity, and provisions applicable to it.
Consent is one of the central concepts under the DPDPA.
Where consent is relied upon, the Act requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action.
Consent should relate to a specified purpose rather than functioning as unrestricted permission to process personal data.
Organisations should also provide an effective mechanism for Data Principals to withdraw consent.
This makes the consent experience an important part of DPDPA compliance.
DPDPA consent management is the process of collecting, recording, enforcing, and managing consent in accordance with the requirements of the DPDP Act.
A consent management platform (CMP) can help businesses:
Consent management should be connected to the systems that actually process personal data so that a user's decision can be respected in practice.
The DPDPA is particularly relevant to websites and applications that use cookies, analytics tools, advertising technologies, and other tracking mechanisms where these involve processing of personal data, which makes cookie consent a core part of website compliance.
A cookie consent banner by itself does not automatically make a website DPDPA compliant.
Businesses should understand:
For websites serving users in multiple countries, DPDPA requirements may need to operate alongside GDPR, UK GDPR, CCPA/CPRA, or other applicable privacy frameworks.
The DPDPA provides specific protections for children's personal data.
A child is an individual who has not completed 18 years of age under the Act.
Section 9 establishes requirements around verifiable parental consent and places restrictions on processing involving children, including restrictions concerning tracking, behavioural monitoring, and targeted advertising directed at children, subject to applicable provisions and exemptions.
Businesses serving children should therefore consider age determination, parental-consent mechanisms, and technical controls that prevent prohibited processing.
The DPDPA provides Data Principals with rights that can include:
Organisations need processes for receiving, authenticating, tracking, and responding to applicable Data Principal requests.
A Consent Manager is a registered entity designed to provide an interoperable platform through which a Data Principal can give, manage, review, and withdraw consent.
The Consent Manager model is an important part of India's approach to consent management.
Businesses should distinguish between a Consent Manager as defined by the DPDPA framework and ordinary website consent-management software used to operate banners, preferences, and tracking controls.
The Digital Personal Data Protection Rules, 2025 provide detailed requirements supporting implementation of the DPDPA framework.
The Rules address operational areas such as notices, consent mechanisms, security safeguards, breach-related obligations, children's data, Data Fiduciaries, Consent Managers, and other compliance requirements.
The Rules were notified on 13 November 2025 and include phased commencement provisions. Businesses should therefore track the applicable commencement dates rather than treating every requirement as effective on the same day.
The DPDPA provides for significant financial penalties for certain breaches.
Penalties can reach ₹250 crore for specified breaches, depending on the applicable provision and circumstances.
The Data Protection Board of India is responsible for enforcement under the framework.
Because penalties and enforcement requirements can change as regulations and rules develop, organisations should verify the current requirements before relying on a compliance interpretation.
Businesses preparing for DPDPA compliance should consider:
Websites should pay particular attention to consent and tracking because online forms, analytics platforms, advertising tools, cookies, pixels, and third-party scripts can involve personal-data processing.
A practical website compliance workflow includes:
This approach helps ensure that privacy choices are reflected not only in the website's privacy notice but also in its technical behaviour.
ConsentX helps organisations operationalise DPDPA compliance by managing consent, enforcing privacy choices, and maintaining evidence of user consent across digital experiences.
For most teams the hard part is not reading the law. It is showing, months later, that a particular person saw a particular notice, made a particular choice, and that the tags and scripts on the site actually honoured it. That is the operational work ConsentX is built to carry.
ConsentX helps Indian and global businesses turn DPDPA's legal requirements into a working consent system — not just a policy document, but real, enforced controls across the website. Our goal is to make privacy compliance measurable, auditable, and simple to maintain as regulations evolve.
ConsentX supports:
Collect separate, specific consent for each processing purpose instead of one blanket approval.
Consent banners and flows built specifically around DPDPA's legal requirements, not generic templates.
Give users a simple, always-available way to withdraw consent at any time.
Store consent logs in a way that proves they haven't been altered, for audit purposes.
Automatically apply different consent rules depending on the visitor's location.
Stop non-essential trackers and scripts from running before the user gives consent.
Automatically scan and identify cookies and trackers active on the site.
Structured process to receive and respond to user privacy requests (access, correction, erasure).
Mechanisms to verify age and collect verifiable parental consent for children's data.
Maintain records in a format ready to present during regulatory audits.
This helps businesses move from a static privacy notice to an enforced and provable consent process.
ConsentX also supports other privacy frameworks, allowing businesses serving international users to manage consent requirements through a single platform.
ConsentX helps businesses implement purpose-based consent, manage privacy preferences, block applicable trackers before consent, and maintain audit-ready consent records. Start free with ConsentX.
A Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data under the DPDPA.
A Data Principal is the individual to whom the personal data relates.
A Consent Manager is a registered platform through which a Data Principal can give, manage, review, and withdraw consent.
DPDPA consent is consent that meets the requirements of the DPDP Act, including being free, specific, informed, unconditional and unambiguous with clear affirmative action.
Section 9 establishes specific requirements and protections relating to the processing of children's personal data.
Personal data is data about an individual who is identifiable by or in relation to that data.
A consent management platform helps organisations collect, manage, enforce, and document user consent across websites and applications.
Cookie consent is the process of obtaining and managing a user's permission for applicable non-essential cookies and tracking technologies.