Complete Guide
DPDP Act 2025: The Complete Guide
India's Digital Personal Data Protection Act. What it means for your organization, how to comply, and what you need to do.
Overview
What is the DPDP Act 2025?
The Digital Personal Data Protection Act is India's comprehensive privacy law. It regulates how organizations collect, store, process, and transfer personal data. Every company with employees must comply.
Key Requirements:
- • Protect personal data with appropriate security
- • Obtain verifiable consent (or use legal basis)
- • Allow data principals to access/correct their data
- • Report data breaches to the Board
- • Appoint DPO (if SDF)
Penalties for Non-Compliance:
- • Up to ₹250 crore for data breach
- • Up to ₹50 crore for other violations
- • Reputational damage
- • Loss of customer trust
- • Business disruption
Concepts
Key DPDP Concepts
Understanding the terminology is the first step.
Data Principal
The individual whose personal data is being processed.
- • Your employees
- • Your customers
- • Your vendors/contacts
Data Fiduciary
The entity that determines the purpose and means of processing personal data.
- • Your organization
- • You are the fiduciary for your employee/customer data
- • Primary responsibility for privacy operations
Consent Manager
A third-party entity that manages consent on behalf of data fiduciaries (optional).
- • Independent entity
- • Manages consent preferences
- • Not mandatory but recommended
Significant Data Fiduciary (SDF)
A data fiduciary meeting specific criteria that triggers additional obligations.
- • 100+ employees OR
- • 10,000+ customers/users OR
- • Processes sensitive data
Requirements
SDF vs Regular Data Fiduciary
Additional requirements for Significant Data Fiduciaries.
All Organizations
- Protect personal data
- Obtain consent or use legal basis
- Honor data principal rights
- Report breaches to Board
- Appoint Data Protection Officer (optional)
Significant Data Fiduciary
In addition to regular requirements:
- Must appoint DPO
- Must conduct DPIA
- Must undergo periodic audits
- Must implement consent management
- Must handle data principal rights requests
Rights
Data Principal Rights
Rights that individuals have over their personal data.
Right to Access
Individuals can request a summary of their personal data being processed.
Right to Correction
Individuals can correct inaccurate or incomplete personal data.
Right to Erasure
Individuals can request deletion of their personal data (with exceptions).
Right to Grievance Redressal
Individuals can file complaints with the Data Protection Board.
Right to Nominate
Individuals can nominate another person to exercise rights in case of death/incapacity.
Right to Withdraw Consent
Individuals can withdraw consent previously given for data processing.
Legal Basis
Legal Basis for Processing
When can you process personal data without explicit consent?
1. Consent
The data principal has given verifiable, free, informed, specific, and unambiguous consent. Most common for B2C companies.
2. Legitimate Use
Processing is necessary for a lawful purpose (e.g., employment, contract fulfillment). Most common for employee data — you don't need employee consent to process payroll data.
3. State Function
Processing is necessary for any function of the State (e.g., taxation, welfare, public order). Applies to government entities.
4. Medical Emergency
Processing is necessary to provide medical treatment or health services to the data principal.
Breach Response
Data Breach Reporting
What to do when a breach happens.
Breach Notification Requirements
Assess the Breach
Determine if personal data was compromised, the nature of the data, and potential impact.
Notify the Board
Report to the Data Protection Board within the specified timeline (check latest guidelines).
Notify Affected Individuals
Inform data principals if the breach is likely to cause harm (as per Board guidelines).
Document Everything
Maintain records of the breach, response actions, and evidence of controls in place.
How ztrust helps
ztrust helps with DPDP readiness
Data Discovery: Auto-detect personal data across HRMS, CRM, databases
Risk Scoring: Identify high-risk fields — Aadhaar, health data, financial records
Evidence Timeline: Timestamped proof of privacy safeguards
Proof Pack: One-click export for customers, auditors, regulators
SDF Detection: Automatic SDF status determination
Breach Readiness: Evidence for breach investigations
Ready to get DPDP-ready?
Connect data sources, collect evidence, and generate your Proof Pack in minutes.
Start your free trialFree 14-day trial · No credit card required