TodayTools

India's DPDP Act flashcards

India's privacy law for digital personal data, with the 2025 Rules.

Donate
Beginner friendly, starts from zero
Section
How to study
0
India's DPDP ActStart from zero · 1 of 12

What is the DPDP Act, in one plain sentence?

India's law that says how companies must collect, use, protect and delete the personal details they hold about you in digital form.

DPDP = Digital Protection.
Show again
12 left
Got it

Tap to turn over. Swipe right if you know it, left to see it again.

All topics

What you will learn

  1. Start from zero

    • What the law is and why it exists4 cards
    • Key legal words2 cards
    • The people and the roles2 cards
    • Consent and enforcement words2 cards
    • Before and after this topic2 cards

  2. Core basics

    • Scope: what and who is covered3 cards
    • The roles in practice3 cards
    • Lawful grounds, consent and children5 cards
    • Notices3 cards
    • Duties and enforcement3 cards

  3. Next steps

    • Rights and duties of the Data Principal5 cards
    • Legitimate uses without consent3 cards
    • Personal data breaches4 cards
    • Children's data2 cards
    • Transfers abroad and appeals2 cards
    • Processors and privacy contacts2 cards

  4. Go deeper

    • Significant Data Fiduciaries4 cards
    • Consent Managers2 cards
    • Security, logs and retention3 cards
    • Commencement timeline and the IT Act4 cards
    • Penalties and settlement3 cards
    • Exemptions, comparison and compliance3 cards

Final test and certificate

10 questions drawn fresh from the whole topic, about 15 minutes. Sign in, score 80% or more and get a free certificate with your name and a public check link anyone can open, such as an employer or a teacher. Not signed in? Try a practice test from the cards.

Take the final test

About these cards

  • Reviewed 26 October 2026
  • CoversDigital Personal Data Protection Act, 2023DPDP Rules, 2025 (notified November 2025; phased to May 2027)Status as of October 2026: Board provisions in force, Consent Manager rules from 13 November 2026, main duties from 13 May 2027
How these cards are made

India's DPDP Act at a glance

The DPDP Act is India's law on how companies must treat the personal details they hold about people in digital form.

It works like a tailor with your measurements: he may use them for the shirt you asked for, must keep them safe, and should not pass them on or keep them forever.

Words you will meet

Personal data
Any detail that can identify a person, such as a name, phone number or photo
Processing
Doing anything with data: collecting, storing, using, sharing or deleting it
Data Principal
The person the data is about
Data Fiduciary
The company that decides why and how the data is used
Data Processor
A helper company that handles data for the fiduciary
Consent
A person's clear yes to a stated use of his data
Notice
A short note telling people what is collected and why
Breach
When personal data leaks, is stolen or is lost

The steps

  1. 1. Start from zero (12 cards): What the law is for, who is who, and the plain words the rest of the topic uses.
  2. 2. Core basics (17 cards): Who the Act covers, the key roles and the two lawful grounds.
  3. 3. Next steps (18 cards): Rights, duties, legitimate uses, breaches and children.
  4. 4. Go deeper (19 cards): Significant fiduciaries, consent managers, Rules detail, penalties and timelines.
All 12 cards in Start from zero
What is the DPDP Act, in one plain sentence?
India's law that says how companies must collect, use, protect and delete the personal details they hold about you in digital form.
What was the problem before this law?
Apps could collect your number, share it with others and keep it forever, with few clear rules. Now they must ask first, explain why, keep it safe and delete it when done.
Where do you already meet this law in daily life?
Every "I agree" box, privacy notice, "stop marketing messages" link or "delete my account" button on an Indian app is shaped by it.
What is an everyday picture of how the law works?
A tailor takes your measurements to stitch one shirt. He may use them for that shirt, must keep the notebook safe, and should not sell your size to a shop next door.
What counts as personal data, and what is processing?
Personal data is any detail that can identify you: name, phone, photo, address or order history. Processing means doing anything with it: collecting, storing, using, sharing or deleting.
What do Act, Section, Schedule, Rules and notified mean?
An Act is a law passed by Parliament; Sections are its numbered parts and a Schedule is a table at the end. Rules are the detailed how-to added later; notified means officially published.
Who is the Data Principal?
The person the data is about. When a shop app saves Karthik's phone number, Karthik is the Data Principal.
Who are the Data Fiduciary and the Data Processor?
The Data Fiduciary is the company that decides why and how data is used. A Data Processor is a helper that handles the data for them, like a cloud host or SMS service.
What are consent, a notice and withdrawing consent?
Consent is your clear yes to a use of your data. A notice is the short note telling you what is collected and why. Withdrawing means taking your yes back later.
What are the Board, a breach, a penalty and a crore?
The Data Protection Board of India hears complaints and fines companies. A breach is when data leaks or is lost, a penalty is the fine, and one crore is 1,00,00,000 rupees.
What do you need before starting this topic?
Nothing to install and no law degree. If you have ever filled a sign-up form on an app, you already know enough to begin.
What will you be able to do after this topic?
Tell who is responsible for data, write a clear notice and consent, handle requests to see or delete data, and plan what to do after a breach.
India's DPDP Act cheatsheet

Key sections of the Act

  • Sec 3 Scope, incl. outside India if serving India
  • Sec 4 Consent or legitimate use
  • Sec 5 Notice
  • Sec 6 Consent, withdrawal, Consent Managers
  • Sec 7 Certain legitimate uses
  • Sec 8 Fiduciary duties, security, breach
  • Sec 9 Children's data
  • Sec 10 Significant Data Fiduciary
  • Sec 11 to 15 Rights and duties of principals
  • Sec 16 / 33 Transfers / penalties

Penalties (Schedule)

  • Up to 250 crore No reasonable security safeguards
  • Up to 200 crore Breach not intimated
  • Up to 200 crore Children's data duties broken
  • Up to 150 crore SDF duties broken
  • Up to 50 crore Undertaking or any other provision
  • Up to 10,000 rupees Data Principal duty broken

Clocks in the Rules

  • Without delay Breach intimation to Board and people
  • 72 hours Detailed breach report to Board
  • 90 days Max to resolve a grievance
  • 1 year Minimum log retention
  • 3 years idle Erase on large platforms
  • 48 hours Warning before that erasure
  • 12 months SDF DPIA and audit
  • 60 days Appeal to TDSAT

Commencement

  • 13 Nov 2025 Rules notified; Board provisions live
  • ~13 Nov 2026 Consent Manager rules (Rule 4)
  • ~May 2027 Rules 3, 5 to 16, 22, 23 and main duties
  • Until then IT Act 43A and SPDI Rules still apply
  • Check e-Gazette for exact dates

Roles

  • Data Principal The person; parent for under 18
  • Data Fiduciary Decides purpose and means
  • Data Processor Processes for a fiduciary
  • Consent Manager Registered consent platform
  • SDF Notified high impact fiduciary
  • Board Data Protection Board of India
Donate