DPDP Act readiness check. Your gap analysis in 10 minutes.
Answer simple questions covering every area of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Get a scored gap analysis report in PDF, with the legal reference and the fix for each gap.
The DPDP Act, in nine areas.
A plain-language summary of the obligations the readiness check covers.
A clear, stand-alone notice listing each data item and its purpose, in English or Indian languages.
Free, specific, informed consent by clear action, as easy to withdraw as to give, or a listed legitimate use.
Encryption or masking, access control, logging and monitoring, backups, logs kept for a year.
Tell affected people and the Data Protection Board without delay; detailed report within 72 hours.
Access, correction, erasure, grievance redressal and nomination, through published channels.
Verifiable parental consent; no tracking, behavioural monitoring or targeted ads aimed at children.
Erase data when the purpose is served or consent is withdrawn, unless another law requires keeping it.
Use processors only under a valid contract; you stay accountable for what they do.
India-based DPO, yearly impact assessment and independent audit, algorithm due diligence.
DPDP Rules: key dates.
DPDP Rules notified. Data Protection Board provisions in force.
Consent manager registration and obligations apply.
Notice, consent, security, breach reporting, children’s data, rights and retention duties apply.
What non-compliance can cost.
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards | ₹250 crore |
| Failure to report a personal data breach | ₹200 crore |
| Breach of obligations for children’s data | ₹200 crore |
| Breach of Significant Data Fiduciary obligations | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
DPDP compliance, answered.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India’s law on digital personal data. It sets out how organisations (data fiduciaries) may collect and use personal data, the rights of individuals (data principals), and penalties of up to ₹250 crore per breach. The DPDP Rules, 2025 add the operational details.
When do DPDP compliance obligations apply?
The DPDP Rules were notified on 13 November 2025. The Data Protection Board provisions applied immediately, consent manager rules apply after 12 months (13 November 2026), and most duties of data fiduciaries, including notice, consent, security safeguards, breach reporting, children’s data and rights, apply from 13 May 2027.
Does the DPDP Act apply to my company?
It applies to any organisation that processes digital personal data in India, or outside India when offering goods or services to people in India. Customer, patient, student and employee data are all covered, whatever the size of the business.
What are the penalties under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a personal data breach or for breaching children’s data obligations, up to ₹150 crore for Significant Data Fiduciary obligations, and up to ₹50 crore for other breaches.
How quickly must a data breach be reported under the DPDP Rules?
The Data Protection Board and affected individuals must be informed without delay, and a detailed report must reach the Board within 72 hours of becoming aware of the breach.
What is a DPDP gap analysis?
A gap analysis compares how you handle personal data today with what the Act and Rules require, area by area, and lists what to fix. The Phynix readiness check gives you a basic gap analysis report in PDF in about 10 minutes.
How does Phynix help with DPDP compliance?
Phynix is an on-premises appliance that measures the technical side of DPDP: a live inventory of systems, access and activity logging, vulnerability tracking, early incident detection and the evidence a 72-hour breach report needs, without your data leaving your premises. Policy items such as notices and consent need your legal or privacy team.
This page summarises the DPDP Act, 2023 and DPDP Rules, 2025 for general information. It is not legal advice.
See it on your own network.
A 2-day health check, then a 15-day live pilot. Write to us or book a live demo.
office@phynix.co.in