India's DPDP Act 2023
India's Digital Personal Data Protection Act 2023 — defines Data Principal + Data Fiduciary roles, mandates consent, enforces from May 14, 2027.
The basics — what DPDP regulates
DPDP applies to processing of digital personal data within India, AND to processing outside India that involves offering goods or services to Data Principals in India. Functionally: if you're an Indian company processing personal data of anyone, or a foreign company processing personal data of Indians, you're in scope.
Personal data is defined broadly — any data identifying a person, directly or indirectly. Excludes data anonymised beyond re-identification.
Two key roles. Data Fiduciary: the person/company deciding the purpose + means of processing (= what GDPR calls Data Controller). Data Processor: the person/company processing on behalf of a Data Fiduciary (= GDPR's Data Processor).
The Section 6 consent rules
Consent must be: free, specific, informed, unconditional, unambiguous, and given by a clear affirmative action. Pre-checked boxes don't count. Combined-with-other-terms consent doesn't count.
Notice must be in clear plain language and inform the Data Principal about: the personal data being processed, the purposes, the way to exercise rights, and how to withdraw consent. Notice must be available in English and at least one of the 22 official Indian languages on Data Principal request.
Consent can be withdrawn at any time. Withdrawal can't be made harder than giving consent — and the Data Fiduciary must stop processing within a reasonable time after withdrawal.
Children's data (under 18): consent of parent/guardian required, no tracking or targeted advertising, no behavioural monitoring permitted.
Data Principal rights (Sections 11–14)
Right to access — Data Principals can request a summary of all personal data being processed about them, the identities of Data Fiduciaries with whom data is shared, and any other prescribed information.
Right to correction and erasure — request correction of inaccurate data, request erasure of data no longer needed for the purpose for which it was collected.
Right of grievance redressal — every Data Fiduciary must designate a Data Protection Officer (DPO) or Grievance Officer who responds within a prescribed period.
Right of nomination — Data Principal can nominate another person to exercise rights on their behalf in case of death or incapacity.
Operationally, this means SaaS products serving Indian users must build: a self-service data export, a self-service erasure flow, a grievance contact path, and a published DPO/grievance officer identity.
Grievance Officer + Data Protection Board
Every Data Fiduciary must publish a Grievance Officer's contact info. Functionally — name, email, postal address, and the process for complaints.
If the Grievance Officer doesn't resolve a complaint within the prescribed time, the Data Principal can escalate to the Data Protection Board of India — a new body created by the Act with quasi-judicial powers including ability to impose financial penalties.
Penalties scale aggressively: up to ₹250 crore per breach for failure to take reasonable security safeguards. ₹200 crore for breach of children's data obligations. ₹50 crore for consent / notice / cross-border violations. These are the upper bounds; actual penalties are graded by Board discretion considering nature, gravity, duration, etc.
Cross-border transfer (Section 16)
Section 16 permits transfer of personal data outside India to countries NOT specifically restricted by the central government. The default is permission; restrictions are by negative list.
As of late 2025, no countries have been explicitly restricted. The expectation is that the negative list will be small (China, possibly a few others) rather than the EU GDPR's positive-list adequacy-decision model.
For Indian SaaS using cloud providers in Singapore / Frankfurt / Virginia: the Section 16 default permits this. Document the cross-border flow in your Privacy Policy and you've satisfied the disclosure obligation.
The November 2025 rules + May 2027 enforcement timeline
The DPDP Act passed in August 2023. The substantive provisions don't enforce automatically — they require Rules notified by the central government to define operational details (notice format, breach notification timeline, technical safeguards, etc.).
DPDP Rules 2025 were notified November 13, 2025. They include: 18-month phase-in for Section 24 (security safeguards), specific breach reporting timeline (72 hours), DPO appointment thresholds (Significant Data Fiduciaries by class — to be designated), and consent management standards.
Section 24 substantive enforcement begins May 14, 2027 — the 18-month phase-in from November 2025 notification. Indian SaaS should be DPDP-aligned by that date or face penalty exposure.
Many Indian SaaS are building toward DPDP NOW rather than waiting — adopting the consent model, building the rights-management flows, publishing the Grievance Officer details. The 18-month phase-in is intended for implementation, not procrastination.
How LGTM aligns with DPDP for Indian teams
Grievance officer named · 72h breach SLA · India-jurisdiction governing law
Go to the product pageFAQs
Is DPDP the same as GDPR?
Similar shape, different details. Both define controller/processor roles, both require consent + purpose limitation, both give individuals access/correction/erasure rights. DPDP is closer to GDPR than to CCPA. Key differences: DPDP doesn't have a 'legitimate interest' lawful basis (consent is the primary mechanism), DPDP's cross-border model is permission-by-default with a negative list, DPDP has a single regulator (Data Protection Board) vs GDPR's per-Member-State DPAs.
Does DPDP apply if I'm a US company serving Indian users?
Yes. DPDP's extraterritorial reach (Section 3(b)) covers any processing of Indian Data Principals' personal data, regardless of where the Data Fiduciary is located, if you're offering goods/services to Indians. The mechanics for enforcement against foreign companies are still being worked out — but the legal obligation exists.
What counts as 'reasonable security safeguards' under Section 24?
The Act doesn't enumerate. Industry expectation is GDPR-equivalent — encryption at rest + in transit, access controls, audit logging, breach notification within 72 hours, regular security testing. The November 2025 Rules elaborate some specifics. India's CERT-In guidelines are also being treated as the closest thing to a checklist for what 'reasonable' means in practice.
Do I need to appoint a DPO?
Only if you're designated a 'Significant Data Fiduciary' by the central government — based on volume of processing, sensitivity of data, potential impact on Data Principals. The criteria for designation are still being finalised. Small SaaS startups are unlikely to be Significant Data Fiduciaries. But every Data Fiduciary, big or small, must designate a Grievance Officer (lighter role).
What happens if I don't comply by May 14, 2027?
Penalty exposure begins. Data Principals can complain to the Data Protection Board, the Board can investigate, the Board can impose fines up to ₹250 crore. The Indian regulatory pattern is to start with notices + warnings before financial penalties — but the penalty cap is enforceable from day one.
Where does India's DPDP fit vs the IT Act + IT Rules 2021?
DPDP supersedes the older Section 43A 'reasonable security practices' and SPDI Rules (2011) for personal data. The IT Act 2000 still covers intermediary liability (Section 79), cyber crime offences, electronic signatures. IT Rules 2021 still cover specific intermediary obligations (grievance officer for IT-intermediary purposes, content takedowns). Most Indian SaaS need both DPDP-compliance work AND IT Rules 2021 compliance work — they overlap but aren't identical.
Related across LGTM
Related terms
CI/CD security
CI/CD security covers the attack surface introduced by your build and deploy pipelines: GitHub Actions workflows, Dockerfiles, IaC configs, dependency management, and secret handling. Distinct from (and complementary to) application-layer AppSec.
Software supply-chain attack
A software supply-chain attack compromises a software product by attacking something earlier in the build/distribute chain: a dependency, a build tool, a package registry, a CI/CD pipeline, or a maintainer account. The downstream consumer ships compromised code without knowing.
BYOK (Bring Your Own Key)
BYOK (Bring Your Own Key) means you provide your own AI provider API key to a SaaS tool, so all LLM calls run on your account and your bill — not the vendor's. The vendor never sees or proxies your token.
GitHub App permissions
GitHub App permissions are the granular scopes an installed GitHub App requests on a repository: contents (read source), pull requests (read+write), checks (write Check Runs), metadata (read repo info), etc. Each permission level (none / read / write / admin) controls what the App can do with that resource.