TodayTools

India's DPDP Act flashcards

India's privacy law for digital personal data, with the 2025 Rules.

Donate
Beginner friendly, starts from zero
Section
How to study
0
India's DPDP ActStart from zero · 1 of 12

What is the DPDP Act, in one plain sentence?

India's law that says how companies must collect, use, protect and delete the personal details they hold about you in digital form.

DPDP = Digital Protection.

All topics

India's DPDP Act at a glance

The DPDP Act is India's law on how companies must treat the personal details they hold about people in digital form.

It works like a tailor with your measurements: he may use them for the shirt you asked for, must keep them safe, and should not pass them on or keep them forever.

Words you will meet

Personal data
Any detail that can identify a person, such as a name, phone number or photo
Processing
Doing anything with data: collecting, storing, using, sharing or deleting it
Data Principal
The person the data is about
Data Fiduciary
The company that decides why and how the data is used
Data Processor
A helper company that handles data for the fiduciary
Consent
A person's clear yes to a stated use of his data
Notice
A short note telling people what is collected and why
Breach
When personal data leaks, is stolen or is lost

The steps

  1. 1. Start from zero (12 cards): What the law is for, who is who, and the plain words the rest of the topic uses.
  2. 2. Core basics (15 cards): Who the Act covers, the key roles and the two lawful grounds.
  3. 3. Next steps (16 cards): Rights, duties, legitimate uses, breaches and children.
  4. 4. Go deeper (17 cards): Significant fiduciaries, consent managers, Rules detail, penalties and timelines.
All 12 cards in Start from zero
What is the DPDP Act, in one plain sentence?
India's law that says how companies must collect, use, protect and delete the personal details they hold about you in digital form.
What was the problem before this law?
Apps could collect your number, share it with others and keep it forever, with few clear rules. Now they must ask first, explain why, keep it safe and delete it when done.
Where do you already meet this law in daily life?
Every "I agree" box, privacy notice, "stop marketing messages" link or "delete my account" button on an Indian app is shaped by it.
What is an everyday picture of how the law works?
A tailor takes your measurements to stitch one shirt. He may use them for that shirt, must keep the notebook safe, and should not sell your size to a shop next door.
What counts as personal data, and what is processing?
Personal data is any detail that can identify you: name, phone, photo, address or order history. Processing means doing anything with it: collecting, storing, using, sharing or deleting.
What do Act, Section, Schedule, Rules and notified mean?
An Act is a law passed by Parliament; Sections are its numbered parts and a Schedule is a table at the end. Rules are the detailed how-to added later; notified means officially published.
Who is the Data Principal?
The person the data is about. When a shop app saves Karthik's phone number, Karthik is the Data Principal.
Who are the Data Fiduciary and the Data Processor?
The Data Fiduciary is the company that decides why and how data is used. A Data Processor is a helper that handles the data for them, like a cloud host or SMS service.
What are consent, a notice and withdrawing consent?
Consent is your clear yes to a use of your data. A notice is the short note telling you what is collected and why. Withdrawing means taking your yes back later.
What are the Board, a breach, a penalty and a crore?
The Data Protection Board of India hears complaints and fines companies. A breach is when data leaks or is lost, a penalty is the fine, and one crore is 1,00,00,000 rupees.
What do you need before starting this topic?
Nothing to install and no law degree. If you have ever filled a sign-up form on an app, you already know enough to begin.
What will you be able to do after this topic?
Tell who is responsible for data, write a clear notice and consent, handle requests to see or delete data, and plan what to do after a breach.
India's DPDP Act cheatsheet

Key sections of the Act

  • Sec 3 Scope, incl. outside India if serving India
  • Sec 4 Consent or legitimate use
  • Sec 5 Notice
  • Sec 6 Consent, withdrawal, Consent Managers
  • Sec 7 Certain legitimate uses
  • Sec 8 Fiduciary duties, security, breach
  • Sec 9 Children's data
  • Sec 10 Significant Data Fiduciary
  • Sec 11 to 15 Rights and duties of principals
  • Sec 16 / 33 Transfers / penalties

Penalties (Schedule)

  • Up to 250 crore No reasonable security safeguards
  • Up to 200 crore Breach not intimated
  • Up to 200 crore Children's data duties broken
  • Up to 150 crore SDF duties broken
  • Up to 50 crore Undertaking or any other provision
  • Up to 10,000 rupees Data Principal duty broken

Clocks in the Rules

  • Without delay Breach intimation to Board and people
  • 72 hours Detailed breach report to Board
  • 90 days Max to resolve a grievance
  • 1 year Minimum log retention
  • 3 years idle Erase on large platforms
  • 48 hours Warning before that erasure
  • 12 months SDF DPIA and audit
  • 60 days Appeal to TDSAT

Commencement

  • 13 Nov 2025 Rules notified; Board provisions live
  • ~13 Nov 2026 Consent Manager rules (Rule 4)
  • ~May 2027 Rules 3, 5 to 16, 22, 23 and main duties
  • Until then IT Act 43A and SPDI Rules still apply
  • Check e-Gazette for exact dates

Roles

  • Data Principal The person; parent for under 18
  • Data Fiduciary Decides purpose and means
  • Data Processor Processes for a fiduciary
  • Consent Manager Registered consent platform
  • SDF Notified high impact fiduciary
  • Board Data Protection Board of India
Donate