Plain-language guide
The DPDP Act and Rules, in plain language
What India’s data protection law asks of a business like yours, and when. Written for clinic owners, shopkeepers and school administrators, not lawyers.
…days
until 13 May 2027, when most obligations under the DPDP Rules (notified 14 November 2025) are expected to apply.
This is not legal advice
When things happen
August 2023
The Digital Personal Data Protection Act, 2023 becomes law.
14 November 2025
The DPDP Rules, 2025 are notified. Rules setting up the Data Protection Board apply straight away.
Around 14 November 2026
Rules on registering Consent Managers are expected to apply, about 12 months after notification.
Around 13 May 2027
Most duties for businesses are expected to apply, about 18 months after notification: notices, consent, security, breach reporting, rights and grievances.
Five words you will see
- Data fiduciary
- Your business, when it decides why and how personal data is used.
- Data principal
- The person the data is about: your patient, customer, student or, for a child, their parent.
- Data processor
- A company that handles data on your instructions, such as your cloud host, CRM or OptProof.
- Consent Manager
- A registered company that lets people manage consents across many businesses. OptProof is not one; it is a tool your business uses.
- Data Protection Board
- The body that hears complaints, investigates breaches and can impose penalties.
What your business has to do
Nine duties, roughly in the order you will meet them.
- 1
Give a clear notice
Before or when you ask for consent, list each item of personal data, what it is for and what that lets the person do, how to withdraw, how to use their rights and how to complain to the Board. In English or a language listed in the Eighth Schedule, and on its own, not buried in your terms.
- 2
Get consent that means something
Consent has to be free, specific, informed, unconditional and unambiguous, given by a clear action. No pre-ticked boxes, no “by using this site you agree”, and only for the data the purpose needs.
- 3
Make withdrawal as easy as agreeing
If agreeing took one tap, withdrawing should take one tap. Once someone withdraws, stop using their data for that purpose and tell your processors to stop too.
- 4
Protect the data
Take reasonable security safeguards: encryption or masking, access control, logs to detect misuse, backups, and contracts that bind your processors.
- 5
Report breaches
Tell the Board and the affected people without delay when a breach happens, and send the Board a detailed report within 72 hours, as we read the Rules.
- 6
Delete when you are done
Erase data once its purpose is served or consent is withdrawn, unless a law requires you to keep it. Some large platforms must also erase after long inactivity, with notice first.
- 7
Answer people
Publish a contact for data questions, answer requests to see, correct or erase data, and resolve grievances within 90 days.
- 8
Take care with children
Anyone under 18 is a child. You need verifiable consent from a parent or guardian, and you must not track children or target ads at them.
- 9
Keep logs
Keep logs of processing for at least 1 year, so you can show what happened.
What people can ask you for
- A summary of the data you hold about them, what you use it for, and who you share it with.
- Corrections and updates, including filling in missing details.
- Erasure, unless a law requires you to keep the data.
- A response to a complaint, before they go to the Board.
- A nominee who can act for them if they die or cannot act.
Where OptProof helps
OptProof gives you tools for each duty. How you use data is still your decision, and your responsibility.
| Duty | What OptProof gives you |
|---|---|
| Clear notice | Notice builder with a pre-publish checker, versions, and 22 Indian languages with human review. |
| Meaningful consent | Widget, inline form block, QR, kiosk and WhatsApp capture; nothing pre-ticked; equal Accept and Reject. |
| Easy withdrawal | Preference centre and floating “Privacy choices” link; withdrawals pushed to your tools. |
| Evidence | Hash-chained ledger, signed receipts, daily anchors and an evidence pack export. |
| Rights and grievances | Rights portal with OTP, request desk with deadlines and reminders. |
| Breaches | Incident workflow with clocks and drafts for your DPO to approve. |
| Erasure | Fan-out to connected tools, a checklist for the rest, and recorded retention exceptions. |
Not sure where you stand? Scan your website for free or read what the Rules mean for a small clinic.
Questions
Common questions
Not legal advice. Talk to your counsel about your specific obligations.
Get ready before the deadline
Install the widget, record test consents and verify your first receipt in under ten minutes.