Glossary
What is the DPDP Act? India’s Digital Personal Data Protection Act, 2023
India’s Digital Personal Data Protection Act, 2023, with the DPDP Rules, 2025. It asks data fiduciaries to take reasonable security safeguards to prevent personal data breaches.
What it covers
The Act governs how data fiduciaries process digital personal data in India. Section 8(5) says they must protect personal data by taking reasonable security safeguards to prevent a personal data breach, and section 8(4) calls for appropriate technical and organisational measures. Rule 6 of the DPDP Rules, 2025 lists the minimum safeguards, such as encryption, access control, logging and backups.
Dates
The Rules were notified in the Gazette on 13 November 2025 and commence in phases. Counting from that date, section 8 and Rule 6 apply after eighteen months, which is 13 May 2027 by our count. The Schedule provides a penalty that may extend to two hundred and fifty crore rupees for failing to take reasonable security safeguards.
Where training fits
The Act and Rules do not mention staff awareness training. A documented awareness programme is one organisational measure you can add to your safeguards file; the Data Protection Board decides what is reasonable. See our DPDP post and the DPDP evidence page.
Sources
Every clause, incident and figure above comes from these official or original sources.
- MeitYDigital Personal Data Protection Act, 2023Published 11 August 2023 · Accessed 17 October 2026.
- eGazetteGazette of India Extraordinary, No. 760: G.S.R. 846(E), DPDP Rules, 2025Published 13 November 2025 · Accessed 17 October 2026.