{"id":669,"date":"2026-08-13T08:54:29","date_gmt":"2026-08-13T08:54:29","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=669"},"modified":"2026-08-13T08:54:29","modified_gmt":"2026-08-13T08:54:29","slug":"dpdp-act","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/","title":{"rendered":"DPDP Act: Rules, Deadlines and Penalties"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: DPDP ACT\n     Same design system as the VAPT, MFA, Penetration Testing and ISO 27001 pages.\n     Paste the whole block into one Custom HTML block. No H1 (WP adds it).\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n.og .p-yes{background:var(--sage-100);color:var(--sage-700)}\n.og .p-no{background:#eef0f4;color:var(--muted)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">The DPDP Act is India&#8217;s data protection law. It sets the rules for how organisations may collect, use and store the personal data of people in India, and what those people are entitled to ask for in return.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">Compliance<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India. It requires organisations to obtain consent, use data only for the stated purpose, keep it secure, report breaches, and delete it once the purpose is served. The supporting DPDP Rules were notified on 14 November 2025, with full compliance required by 14 May 2027.<\/p>\n<\/div>\n\n<p>It applies to any company processing the personal data of people in India, including companies based outside India that sell into the country. A startup with Indian users is in scope whether or not it is registered in India.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#roles\">Key roles under the Act<\/a><\/li>\n    <li><a href=\"#requires\">What it requires<\/a><\/li>\n    <li><a href=\"#timeline\">Key deadlines and what to do<\/a><\/li>\n    <li><a href=\"#penalties\">Penalties<\/a><\/li>\n    <li><a href=\"#osto\">How Osto supports DPDP<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"roles\">Key roles under the Act<\/h2>\n\n<p>DPDP gives each party a specific name, and the obligations follow those names. This is how they relate to one another.<\/p>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 340\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"How DPDP roles relate: the data principal gives data to the data fiduciary, which instructs processors, is overseen by the Data Protection Board, and may use a consent manager.\">\n  <defs>\n    <marker id=\"dp1\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0,0 L9,4.5 L0,9 z\" fill=\"#4a52a8\"\/><\/marker>\n    <marker id=\"dp2\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0,0 L9,4.5 L0,9 z\" fill=\"#8a90a8\"\/><\/marker>\n    <marker id=\"dp3\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0,0 L9,4.5 L0,9 z\" fill=\"#6b4576\"\/><\/marker>\n  <\/defs>\n\n  <rect x=\"292\" y=\"24\" width=\"196\" height=\"54\" rx=\"12\" fill=\"#e2eff7\"\/>\n  <text x=\"390\" y=\"46\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"13.5\" font-weight=\"700\" fill=\"#2f6a89\">Consent Manager<\/text>\n  <text x=\"390\" y=\"65\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Optional. One place to manage consent<\/text>\n  <path d=\"M292,52 L150,52 L150,132\" fill=\"none\" stroke=\"#8a90a8\" stroke-width=\"1.8\" stroke-dasharray=\"5 5\" marker-end=\"url(#dp2)\"\/>\n  <path d=\"M488,52 L620,52 L620,132\" fill=\"none\" stroke=\"#8a90a8\" stroke-width=\"1.8\" stroke-dasharray=\"5 5\" marker-end=\"url(#dp2)\"\/>\n\n  <rect x=\"20\" y=\"140\" width=\"196\" height=\"72\" rx=\"12\" fill=\"#e9ecfa\"\/>\n  <text x=\"118\" y=\"168\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#4a52a8\">Data Principal<\/text>\n  <text x=\"118\" y=\"188\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">The individual. Holds the<\/text>\n  <text x=\"118\" y=\"204\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">rights the Act creates<\/text>\n\n  <line x1=\"222\" y1=\"176\" x2=\"284\" y2=\"176\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#dp1)\"\/>\n  <text x=\"253\" y=\"164\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">gives data<\/text>\n\n  <rect x=\"292\" y=\"132\" width=\"196\" height=\"88\" rx=\"12\" fill=\"#1c267a\"\/>\n  <text x=\"390\" y=\"164\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"15\" font-weight=\"700\" fill=\"#ffffff\">Data Fiduciary<\/text>\n  <text x=\"390\" y=\"185\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#b9c1e6\">You. Decides why and how<\/text>\n  <text x=\"390\" y=\"202\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#b9c1e6\">data is used, carries the duties<\/text>\n\n  <line x1=\"496\" y1=\"176\" x2=\"558\" y2=\"176\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#dp1)\"\/>\n  <text x=\"527\" y=\"164\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">instructs<\/text>\n\n  <rect x=\"564\" y=\"140\" width=\"176\" height=\"72\" rx=\"12\" fill=\"#e9ecfa\"\/>\n  <text x=\"652\" y=\"168\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#4a52a8\">Data Processor<\/text>\n  <text x=\"652\" y=\"188\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Your cloud and SaaS<\/text>\n  <text x=\"652\" y=\"204\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">vendors<\/text>\n\n  <line x1=\"390\" y1=\"262\" x2=\"390\" y2=\"228\" stroke=\"#6b4576\" stroke-width=\"2.5\" marker-end=\"url(#dp3)\"\/>\n  <text x=\"470\" y=\"250\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">investigates and penalises<\/text>\n  <rect x=\"256\" y=\"268\" width=\"268\" height=\"54\" rx=\"12\" fill=\"#f0e6f3\"\/>\n  <text x=\"390\" y=\"290\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"13.5\" font-weight=\"700\" fill=\"#6b4576\">Data Protection Board of India<\/text>\n  <text x=\"390\" y=\"309\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">The regulator. Operational since Nov 2025<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full diagram. <\/span>Almost every company is a Data Fiduciary, which is where the obligations sit. A Fiduciary handling large volumes may be designated a <strong>Significant Data Fiduciary<\/strong>, adding an India-based DPO, annual audits and impact assessments.<\/figcaption>\n<\/figure>\n\n<h2 id=\"requires\" class=\"c-sage\">What it requires<\/h2>\n\n<p>Seven obligations. The engineering work sits mostly in safeguards, breach reporting and erasure.<\/p>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th>Obligation<\/th><th>What it means in practice<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td><strong>Notice and consent<\/strong><\/td><td>Clear itemised notice before collection. Withdrawal as easy as consent.<\/td><\/tr>\n    <tr><td><strong>Purpose limitation<\/strong><\/td><td>Use data only for the stated purpose. New purpose, fresh consent.<\/td><\/tr>\n    <tr><td><strong>Security safeguards<\/strong><\/td><td><a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-readiness-checklist\/\">Encryption, access control, logging and monitoring<\/a>.<\/td><\/tr>\n    <tr><td><strong>Breach notification<\/strong><\/td><td>Tell affected individuals without delay. Board within 72 hours.<\/td><\/tr>\n    <tr><td><strong>Erasure<\/strong><\/td><td>Delete once the purpose is served, with advance notice.<\/td><\/tr>\n    <tr><td><strong>Children&#8217;s data<\/strong><\/td><td>Verifiable parental consent under 18. No tracking or ad targeting.<\/td><\/tr>\n    <tr><td><strong>Grievance redressal<\/strong><\/td><td>A published contact point and a response process.<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<div class=\"callout\">\n  <p class=\"k\">On cross-border transfers<\/p>\n  <p>DPDP takes a negative-list approach. Personal data may be transferred outside India unless the central government specifically restricts a country by notification. This is more permissive than the data localisation many organisations expected from the draft rules.<\/p>\n<\/div>\n\n<h2 id=\"timeline\" class=\"c-apri\">Key deadlines and what to do<\/h2>\n\n<p>The Act passed in 2023 but had no operative detail until the DPDP Rules were notified in November 2025. Obligations switch on across three dates, and the work sits in the gap between them.<\/p>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 300\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"DPDP deadlines: rules in force November 2025, consent manager obligations November 2026, all obligations enforceable May 2027.\">\n  <text x=\"20\" y=\"26\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" letter-spacing=\"1.2\" fill=\"#0f1538\">WHAT SWITCHES ON, AND WHEN<\/text>\n\n  <line x1=\"96\" y1=\"118\" x2=\"700\" y2=\"118\" stroke=\"#dfe3f5\" stroke-width=\"6\" stroke-linecap=\"round\"\/>\n  <line x1=\"96\" y1=\"118\" x2=\"330\" y2=\"118\" stroke=\"#4a52a8\" stroke-width=\"6\" stroke-linecap=\"round\"\/>\n\n  <circle cx=\"130\" cy=\"118\" r=\"14\" fill=\"#4a52a8\"\/>\n  <text x=\"130\" y=\"66\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#4a52a8\">14 Nov 2025<\/text>\n  <text x=\"130\" y=\"88\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Rules in force<\/text>\n  <text x=\"130\" y=\"158\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Board can accept<\/text>\n  <text x=\"130\" y=\"175\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">complaints from today<\/text>\n\n  <circle cx=\"330\" cy=\"118\" r=\"9\" fill=\"#ffffff\" stroke=\"#6b4576\" stroke-width=\"3\"\/>\n  <rect x=\"272\" y=\"86\" width=\"116\" height=\"22\" rx=\"11\" fill=\"#f0e6f3\"\/>\n  <text x=\"330\" y=\"102\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" letter-spacing=\".6\" fill=\"#6b4576\">YOU ARE HERE<\/text>\n  <text x=\"330\" y=\"158\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-weight=\"700\" fill=\"#6b4576\">Build time<\/text>\n  <text x=\"330\" y=\"175\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Safeguards, consent flows,<\/text>\n  <text x=\"330\" y=\"191\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">breach process, erasure<\/text>\n\n  <circle cx=\"520\" cy=\"118\" r=\"14\" fill=\"#7b9dc9\"\/>\n  <text x=\"520\" y=\"66\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#2f6a89\">14 Nov 2026<\/text>\n  <text x=\"520\" y=\"88\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Consent managers<\/text>\n  <text x=\"520\" y=\"158\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Registration and duties<\/text>\n  <text x=\"520\" y=\"175\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">begin for that role<\/text>\n\n  <circle cx=\"700\" cy=\"118\" r=\"16\" fill=\"#1c267a\"\/>\n  <text x=\"700\" y=\"66\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#1c267a\">14 May 2027<\/text>\n  <text x=\"700\" y=\"88\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">Everything else<\/text>\n  <text x=\"700\" y=\"158\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Notice, consent, rights<\/text>\n  <text x=\"700\" y=\"175\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">and breach reporting<\/text>\n\n  <rect x=\"96\" y=\"222\" width=\"604\" height=\"56\" rx=\"14\" fill=\"#f4f5fd\"\/>\n  <text x=\"398\" y=\"246\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#4a52a8\">The security safeguards obligation has no grace period in practice<\/text>\n  <text x=\"398\" y=\"266\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" fill=\"#0f1538\">A breach today is judged on the measures you had in place at the time, not on the 2027 date<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full chart. <\/span>The 2027 date is when the paperwork obligations bite. The technical controls are what a breach would be judged against long before then.<\/figcaption>\n<\/figure>\n\n<h2 id=\"penalties\" class=\"c-plum\">Penalties<\/h2>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Maximum DPDP penalties by type of failure, in crore rupees.\">\n  <text x=\"20\" y=\"28\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" letter-spacing=\"1.2\" fill=\"#0f1538\">MAXIMUM PENALTY BY FAILURE<\/text>\n\n  <text x=\"286\" y=\"70\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"600\" fill=\"#0f1538\">Security safeguards<\/text>\n  <rect x=\"300\" y=\"52\" width=\"400\" height=\"30\" rx=\"8\" fill=\"#1c267a\"\/>\n  <text x=\"686\" y=\"72\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#ffffff\">&#8377;250 crore<\/text>\n\n  <text x=\"286\" y=\"120\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"600\" fill=\"#0f1538\">Breach notification<\/text>\n  <rect x=\"300\" y=\"102\" width=\"320\" height=\"30\" rx=\"8\" fill=\"#4a52a8\"\/>\n  <text x=\"606\" y=\"122\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#ffffff\">&#8377;200 crore<\/text>\n\n  <text x=\"286\" y=\"170\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"600\" fill=\"#0f1538\">Children&#39;s data<\/text>\n  <rect x=\"300\" y=\"152\" width=\"320\" height=\"30\" rx=\"8\" fill=\"#7b9dc9\"\/>\n  <text x=\"606\" y=\"172\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#ffffff\">&#8377;200 crore<\/text>\n\n  <text x=\"286\" y=\"220\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"600\" fill=\"#0f1538\">Significant Data Fiduciary duties<\/text>\n  <rect x=\"300\" y=\"202\" width=\"240\" height=\"30\" rx=\"8\" fill=\"#c2d9ec\"\/>\n  <text x=\"526\" y=\"222\" text-anchor=\"end\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#25547a\">&#8377;150 crore<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full chart. <\/span>Penalties are imposed by the Data Protection Board and set against the failure, not against turnover.<\/figcaption>\n<\/figure>\n\n<h2 id=\"osto\">How Osto supports DPDP<\/h2>\n\n<p>Security safeguards is where DPDP becomes an engineering problem rather than a legal one. Osto maps DPDP controls alongside 200+ frameworks and draws the evidence from its own modules: access management and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/mfa\/\">MFA<\/a>, file access <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dlp\/\">DLP<\/a>, endpoint control, cloud posture, logging and vulnerability testing. The detection timeline needed for a 72-hour breach report comes from the same system that enforces the controls.<\/p>\n\n<p class=\"related\"><strong>Product documentation:<\/strong> Setup guides and technical reference are available in the <a href=\"https:\/\/docs.osto.one\/\" target=\"_blank\" rel=\"noopener\">Osto documentation<\/a>.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Free security assessment<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Reasonable security safeguards, actually deployed<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Osto covers the technical controls DPDP expects and maps the evidence automatically. Tell us your scope and we will tailor a plan.<\/p>\n  <a href=\"https:\/\/osto.one\/contact\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 30px;border-radius:12px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Get a free security assessment<\/span><\/a>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:transparent;color:#ffffff;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:600;font-size:16px;text-decoration:none;border:1.5px solid rgba(255,255,255,.5);border-radius:12px;padding:13px 28px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a platform walkthrough<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:14px 0 0;\">200+ frameworks &middot; Built for Indian startups &middot; One platform, everything<\/p>\n<\/div>\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What does DPDP stand for?<\/summary>\n  <p>DPDP stands for Digital Personal Data Protection. The full name is the Digital Personal Data Protection Act, 2023, India&#8217;s law governing how digital personal data is collected, used and stored.<\/p>\n<\/details>\n\n<details>\n  <summary>Does DPDP apply to companies outside India?<\/summary>\n  <p>Yes, where the processing relates to offering goods or services to individuals in India. A company registered elsewhere with Indian users falls within scope.<\/p>\n<\/details>\n\n<details>\n  <summary>When do organisations have to comply?<\/summary>\n  <p>The DPDP Rules were notified on 14 November 2025. Consent manager registration and obligations begin on 14 November 2026, and the remaining obligations, including notice, consent, data principal rights and breach processes, are enforceable from 14 May 2027. The Data Protection Board has been operational since November 2025.<\/p>\n<\/details>\n\n<details>\n  <summary>How is DPDP different from GDPR?<\/summary>\n  <p>DPDP is shorter and more consent-centred. It has no separate category of sensitive personal data, no general right to data portability, and takes a negative-list approach to cross-border transfers, permitting them unless a country is specifically restricted. GDPR relies on multiple lawful bases including legitimate interest, which DPDP replaces with a narrower list of legitimate uses.<\/p>\n<\/details>\n\n<details>\n  <summary>What are the penalties under DPDP?<\/summary>\n  <p>Penalties are imposed by the Data Protection Board and reach \u20b9250 crore for failing to take reasonable security safeguards, and \u20b9200 crore for failing to notify a breach or for breaching obligations relating to children&#8217;s data.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> GDPR &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dlp\/\">Data Loss Prevention<\/a> &middot; Encryption &middot; Access Control &middot; Incident Response &middot; ISO 27701<\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The DPDP Act is India&#8217;s data protection law. It sets the rules for how organisations may collect, use and store\u2026<\/p>\n","protected":false},"author":8,"featured_media":670,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[247,249,246,248,250],"class_list":["post-669","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary","tag-data-fiduciary","tag-digital-personal-data-protection-act-2023","tag-dpdp-act","tag-dpdp-compliance","tag-dpdp-rules"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/669","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=669"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/669\/revisions"}],"predecessor-version":[{"id":671,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/669\/revisions\/671"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/670"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}