The DPDP Act at a glance
Who is who under India's DPDP Act, 2023 and DPDP Rules, 2025, what a business must do, and where PIEDAP Consent helps.
India's Digital Personal Data Protection Act, 2023 (the Act) and its Rules of 2025 set out how a business may use personal data.
This is not legal advice
These pages are a summary to help you find your way. They leave out detail and exceptions, and the law may change. Ask your own counsel how it applies to you.
Who is who#
| Term in the Act | Plain meaning | For you |
|---|---|---|
| Data Principal | The person the personal data is about. For a child, this includes the parent or lawful guardian. | Your customers, users and visitors |
| Data Fiduciary | Whoever decides why and how personal data is processed, alone or with others | Your business |
| Data Processor | Whoever processes personal data on behalf of a Data Fiduciary | Your vendors. When PIEDAP Consent is run for you, its operator is your Data Processor for the consent records. |
| Consent Manager | A person registered with the Board who gives people a single place to give, manage, review and withdraw consent | A separate role, open for registration from 13 November 2026 |
| Significant Data Fiduciary | A Data Fiduciary the Government notifies as significant. It has extra duties. | You, only if the Government notifies you or your class of business |
| Data Protection Board of India | The body that looks into complaints and breaches and imposes penalties | Where people may complain. As we read section 13, they raise the grievance with you first. |
As we read section 3, the Act covers digital personal data processed in India. It also covers processing outside India that is connected with offering goods or services to people in India.
Example. Kaveri Stores, a retailer, is the Data Fiduciary. Meera Iyer, who shops there, is a Data Principal. The company that sends the shop's emails is a Data Processor.
Consent Managers and this product#
A Consent Manager is a company that registers with the Board. It manages consent on people's behalf across many businesses.
Rule 4, which covers that registration, takes effect on 13 November 2026. The First Schedule to the Rules sets the conditions. Among them, a Consent Manager must be a company incorporated in India with a net worth of at least ₹2 crore. Its platform must be independently certified.
PIEDAP Consent has a different job. It serves you, the Data Fiduciary, and does not act as a Consent Manager. Your business uses it for its own notices, consents and records.
If people reach you through a registered Consent Manager, you can accept their consent and withdrawals from it. Each answer is sealed into your records like any other. See Accept consent from a Consent Manager.
What a business must do#
| Duty | In short | Read |
|---|---|---|
| Know the dates | The Rules start in three stages, the last on 13 May 2027. | Key dates |
| Have a basis, give a notice, ask properly | You need consent or a legitimate use. Consent needs a notice first. | Notice and consent |
| Look after data you hold | Tell people whose data you collected before the Act. Erase data when its purpose is over. | Existing data and retention |
| Respect people's rights | Let people withdraw, ask what you hold, correct it, erase it and complain. Protect children. | People's rights |
| Report a breach | Tell the people affected and the Board. The Board may impose penalties. | Breaches and penalties |
Other duties#
| Duty | Where | How the product helps |
|---|---|---|
| Reasonable security safeguards: encryption or masking, access control, logs, backups | Section 8(5), Rule 6 | Identifiers are stored as hashes that cannot be turned back, console actions are logged, and each key works only where you allow it. See the security model. |
| Use a Data Processor only under a valid contract. You remain responsible. | Section 8(1), 8(2) | Data processing lists what is processed on your behalf, for your agreement. |
| Extra duties of a Significant Data Fiduciary: a Data Protection Officer based in India, an independent data auditor, and a yearly assessment and audit | Section 10, Rule 13 | The Significant Data Fiduciary page keeps the officer's details, the assessments and the audits, and prepares the report for the Board. Receipts, daily anchors and the audit log support an audit. The appointments and the work are yours. |
| Transfers outside India are allowed except to countries the Government restricts | Section 16, Rule 15 | Settings shows where your deployment keeps records, under Where your data is kept. |
The full mapping, duty by duty, starts at DPDP duties for notice and consent.
What stays with you#
PIEDAP Consent is a tool. No tool can make a business compliant alone. The product helps with the parts a tool can do: the notice, the records that serve as proof, and the deadlines.
You still decide your purposes and the legal basis for each. You act on withdrawals in your own systems. You send the messages the Act asks you to send, because the product sends no email or SMS.
Where to read the law#
- The Digital Personal Data Protection Act, 2023.
- The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), dated 13 November 2025.
Both are published by the Ministry of Electronics and Information Technology. Where these pages name a section or a rule, the line is our short version of that text. Read the Act and the Rules before you rely on it.