Reference only — not legal advice. This page is EarthReheal WasteLedger's plain-language interpretation of the rule, written to help organisations understand what may apply to them. It can be incomplete or inaccurate. Always read the official gazette notification or statute, and confirm with your regulator or a qualified adviser, before relying on it for compliance decisions.
Quick Summary
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's general data-protection law for digital personal data. The DPDP Rules, 2025 were published in November 2025 and bring the Act into force in phases, with the core duties on organisations — notice and consent, security safeguards, breach intimation, erasure and grievance handling — due to apply from 13 May 2027. Any organisation that decides why and how personal data is processed is a data fiduciary. That includes building and site operators who keep resident or visitor registers, CCTV footage, guest IDs, patient or student records, or staff records in digital form. Penalties go up to ₹250 crore, the highest for failing to take reasonable security safeguards.
What This Rule Is
Full name: The Digital Personal Data Protection Act, 2023, enacted by Parliament on 11 August 2023, with the Digital Personal Data Protection Rules, 2025 made under it by the Ministry of Electronics and Information Technology (MeitY).
Notification. The Rules and the notification bringing provisions of the Act into force were published in the Gazette on 13 November 2025; the Government's own backgrounder (PIB, 17 November 2025) describes the Rules as notified on 14 November 2025.
Phased commencement (as notified):
- Immediately (13 November 2025): provisions establishing the Data Protection Board of India and its procedures.
- After one year (13 November 2026): registration and obligations of consent managers.
- After eighteen months (13 May 2027): the core obligations of data fiduciaries — notice, consent, security safeguards, breach intimation, erasure, children's data and the rights of data principals — and, in practice, exposure to penalties for breaching them.
In early 2026 it was reported that MeitY had consulted industry on shortening parts of this timeline. Check current MeitY notifications before relying on the dates above.
Key terms. A data fiduciary decides the purpose and means of processing. A data principal is the individual the data is about (for a child, including the parent or lawful guardian). A data processor processes data on a fiduciary's behalf — for example a CCTV or visitor-management vendor. The fiduciary remains responsible for what its processors do.
Who This Applies To
The Act applies to processing of digital personal data within India, including personal data collected on paper and later digitised. For premises operators, typical personal data includes:
- Resident and visitor registers — names, phone numbers, flat or unit numbers, vehicle numbers, entry times.
- CCTV footage where individuals can be identified.
- Guest and tenant ID copies — Aadhaar, passports and similar documents collected at check-in or move-in.
- Patient records in hospitals, clinics and diagnostic labs.
- Student records in schools, colleges and hostels — mostly children's data in schools.
- Staff and contractor records — attendance, contact details, ID documents, photographs.
Size does not create a general exemption: a small residential society or clinic that holds this data digitally is a data fiduciary. Certain entities may be notified as significant data fiduciaries, with extra duties such as audits and impact assessments; most premises operators will not be in that category.
State-Level Variations
The DPDP Act is a Central Act and applies uniformly across India. There are no state data-protection rules under it. Sectoral rules — for example health-record or education-board requirements — may add retention or confidentiality duties on top; check these for your sector.
Compliance Requirements — What You Actually Have to Do
Once the core provisions apply, a data fiduciary must:
1. Give notice and obtain consent. Before or when collecting personal data, give a clear, standalone notice setting out what data is collected, for what purpose, how the person can withdraw consent and exercise their rights, and how to complain to the Board. Process data only for the stated purpose, or for a legitimate use the Act allows.
2. Take reasonable security safeguards. Protect personal data in your possession or under your control, including data held by your processors. Examples include access controls on CCTV and visitor systems, encryption or masking of ID copies, and logs of who accessed what.
3. Report personal data breaches. On a personal data breach, intimate the Data Protection Board and each affected data principal. The Rules require affected individuals to be told without delay, in plain language, what happened, the likely impact, the steps taken and whom to contact, with a fuller report to the Board — confirm the exact timelines in the Rules.
4. Erase data when the purpose is served. Unless the law requires you to keep it, erase personal data once the individual withdraws consent or the purpose is no longer being served, and have your processors do the same. Old visitor logs and ID copies are a common gap.
5. Publish a contact for questions and grievances. Display the business contact of a person who can answer data principals' questions (a designated officer or, for significant data fiduciaries, a Data Protection Officer), and run a grievance process. The Government's backgrounder says requests must be answered within ninety days.
6. Get verifiable parental consent for children. A child is anyone under 18. Before processing a child's personal data, obtain verifiable consent of a parent or lawful guardian, and do not track, monitor behaviourally or target advertising at children, subject to exemptions in the Rules.
How EarthReheal WasteLedger helps. To help you be ready before May 2027, WasteLedger tracks a privacy notice, a named grievance contact, a breach response plan, an annual review and erasure of personal data no longer needed, and a breach intimation task for each breach event.
CCTV Notices
A visible notice wherever CCTV records people is good practice and supports the privacy notice the Act requires. Some states (for example Telangana's Public Safety (Measures) Enforcement Act 2013) require CCTV at premises with large footfall.
Penalties & Enforcement
The Data Protection Board of India inquires into breaches and can impose monetary penalties set out in the Schedule to the Act. According to the Government's backgrounder:
- up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach;
- up to ₹200 crore for failing to notify the Board or affected individuals of a breach, and for breaching obligations relating to children;
- up to ₹50 crore for any other breach of the Act or Rules by a data fiduciary.
In deciding the amount, the Board considers factors such as the nature, gravity and duration of the breach and any mitigation. Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Frequently Asked Questions
Q: We are a residential society. Does the Act really apply to our visitor register? A: If the register is digital (an app, spreadsheet or visitor-management system), yes. The society decides why the data is collected, so it is the data fiduciary; the app vendor is typically its processor.
Q: Is CCTV footage personal data? A: Where people can be identified from it, yes. Tell people CCTV is in use and why, restrict access, and delete footage on a defined schedule unless it is needed for an incident.
Q: Can we keep copies of guests' Aadhaar cards? A: Collect only what you need for a stated purpose, protect it, and erase it when the purpose is served unless another law requires retention. Masking or not storing full ID numbers reduces risk.
Q: When do we actually need to be compliant? A: As notified, the core duties apply from 13 May 2027. A shorter timeline was reported as under consideration in 2026 — check current notifications.
Q: Do school records count as children's data? A: Yes. Students under 18 are children under the Act, so verifiable parental consent and the restrictions on tracking apply, subject to exemptions in the Rules for educational institutions — confirm the scope with your adviser.
Government / Official Sources
- DPDP Rules, 2025 Notified — Government backgrounder (PIB, 17 November 2025) — notification, penalties, ninety-day response, breach notice.
- Ministry of Electronics and Information Technology — DPDP Act, 2023, DPDP Rules, 2025 and later notifications.
- eGazette of India — Gazette notifications of 13 November 2025.
Related Rules
- RULE_POSH_ACT — POSH complaint files are highly sensitive personal data; confidentiality duties under both regimes apply.
- RULE_SHOPS_ESTABLISHMENTS — employment records kept under state Shops and Establishments Acts are also staff personal data.
- RULE_FIRE_SAFETY — occupancy and evacuation records may hold resident or visitor personal data.
Additional Reference Content
Secondary sources (law firm explainers, news, consultancy blogs, or official-body sites on a non-.gov.in/.nic.in domain) — useful context, not primary legal authority.