India's DPDP Act and Rules: a practical guide for businesses
What the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 expect of organisations, the dates that matter, and where technology helps. General information, not legal advice.
The DPDP Act and Rules at a glance
- The DPDP Act, 2023 sets duties for organisations that handle digital personal data (Data Fiduciaries) and rights for individuals (Data Principals).
- The DPDP Rules, 2025 were notified in the Gazette on 13 November 2025 (G.S.R. 846(E)) and phase in over 18 months.
- The Consent Manager rules apply from about mid-November 2026. Notices, consent, security safeguards, breach intimation, children's data and the remaining core obligations apply from about mid-May 2027.
- Technology helps with the technical safeguards, but compliance also depends on legal, process and people decisions.
Who is who under the Act
Five terms explain most of the Act. These definitions follow the Government's own summary.
Data Fiduciary
An entity that decides why and how personal data is processed, alone or with others.
Data Principal
The individual the personal data relates to. For a child, this includes a parent or lawful guardian.
Data Processor
An entity that processes personal data on behalf of a Data Fiduciary.
Consent Manager
An entity that provides a single, transparent and interoperable platform for a Data Principal to give, manage, review or withdraw consent.
Appellate Tribunal
The Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which hears appeals against decisions of the Data Protection Board.
What the Rules expect of a Data Fiduciary
A summary of the main duties. Your counsel should confirm how each applies to you.
Clear, standalone notices
Tell people, in plain language and on a standalone notice, what personal data you collect and the specific purpose you use it for.
Seven core principles
Consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability.
Reasonable security safeguards
Protect personal data with reasonable technical and organisational measures, for example access control, encryption, logging and backups.
Breach response
Tell affected individuals promptly, in plain language, what happened, the likely consequences, what you have done and who to contact. Report to the Data Protection Board too: the Rules set a 72-hour window for the detailed report.
Children's data
Get verifiable consent from a parent or guardian before processing a child's personal data, with limited exemptions for essential purposes such as healthcare, education and real-time safety.
Persons with disabilities
Where a person cannot make legal decisions even with support, consent must come from a lawful guardian verified under applicable law.
Someone to contact
Publish clear contact details, such as a designated officer or Data Protection Officer, so people can raise questions about how their data is used.
Individuals' rights
Be ready to handle requests to access, correct and erase personal data, and to deal with grievances.
Why it matters
The Act's penalty schedule goes up to ₹250 crore for the most serious failures, including not taking reasonable security safeguards. Customers and partners also increasingly ask how you protect personal data, so good safeguards help your business as well as your compliance.
How Microsoft technology supports the technical safeguards
These tools help you find, protect, monitor and recover personal data. They support compliance; they do not make an organisation compliant on their own.
Microsoft Purview
Find and classify personal data, apply sensitivity labels and data loss prevention, and set retention so data is not kept longer than needed.
Microsoft Entra ID and Conditional Access
Control who can reach personal data, with multifactor authentication and least-privilege access.
Microsoft Defender
Detect and contain attacks on endpoints, identities, email and cloud workloads.
Microsoft Sentinel and audit logs
Collect and keep the logs you need to investigate an incident and show what happened.
Microsoft Intune
Keep laptops and phones encrypted, patched and compliant.
Backup and recovery
Restore data after an incident, with tested restores and copies kept in India where you need them.
Five steps to get ready
Map your personal data
Find where personal data sits in Microsoft 365, Azure, applications and devices, who can reach it and how long it is kept.
Decide your roles
Work out where you are a Data Fiduciary or a Data Processor, and ask your counsel whether any extra duties apply to you.
Fix notices and consent
Rewrite privacy notices and consent requests so they are clear, specific and stand alone.
Tighten safeguards
Apply access controls, labels, encryption, logging and monitoring, and review the vendors that handle personal data for you.
Rehearse a breach
Agree who decides, who is told and how, and test the plan before you need it.
What we do and do not do
We configure and document technical controls and help you find where personal data sits in Microsoft 365 and Azure. We do not certify compliance or give legal advice: how the DPDP Act applies to you stays with you, your legal counsel and your auditors.
DPDP: common questions
Does the DPDP Act apply to my business?
If you process digital personal data about individuals, such as customers, employees or website visitors, it is likely to. Whether it applies, and whether you are a Data Fiduciary or a Data Processor, are legal questions for your counsel.
When do I need to be ready?
The main obligations apply from about mid-May 2027, eighteen months after the Rules were published in the Gazette on 13 November 2025. The Consent Manager rules apply from about mid-November 2026. Count from the Gazette date and confirm the exact day with your legal adviser.
Can Askari Infotech make us compliant?
No one can do that from the outside, and we do not certify compliance. Compliance depends on your whole organisation, including legal, process and people. We help with the technical side: finding personal data in Microsoft 365 and Azure, controlling access, setting retention and putting detection and response in place.
Which Microsoft tools help?
Microsoft Purview for finding, labelling and retaining data, Entra ID and Conditional Access for access, Defender and Sentinel for detection, response and logs, Intune for devices, and backup for recovery. They support the safeguards; they do not make you compliant on their own.
What does a DPDP readiness review look like?
We assess where personal data sits in Microsoft 365 and Azure, who can reach it, how long it is kept, and how you would detect and respond to a breach. You get a prioritised plan that your counsel and your team can act on.
Is Microsoft 365 Copilot affected?
Copilot only surfaces what a user can already access, so permissions, sharing and sensitivity labels matter. Getting them right is part of readiness for both Copilot and DPDP.
Read the official material
- Digital Personal Data Protection Rules 2025 and the enforcement timeline (opens in a new tab) (Ministry of Electronics and IT)
- Government notifies DPDP Rules to empower citizens and protect privacy (opens in a new tab) (PIB, 14 November 2025)
- DPDP Rules, 2025 Notified (backgrounder) (opens in a new tab) (PIB, 17 November 2025)
This guide summarises published material for general information. It is not legal advice, and the official Act, Rules and notifications prevail. Reviewed November 2026.
Get ready for DPDP with a team that knows Microsoft security
Tell us what you want to achieve and we will come back with a practical next step.