Resource Hub · DPDP Act Compliance
DPDP Act Compliance — The Complete Hub
India's Digital Personal Data Protection Act, explained end-to-end: obligations, penalties, consent, DPIA and the fastest path to readiness.
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data-protection law. It applies to virtually every organisation that processes digital personal data of individuals in India — and its penalty regime reaches ₹250 crore per breach category. With the DPDP Rules moving toward enforcement, boards are asking one question: are we ready?
This hub organises everything CyberSigma has published on DPDP — explainers, checklists, comparisons, tools and templates — into one guided path, from understanding the Act to running a defensible privacy program.
Who this applies to
- Any business processing digital personal data of Indian individuals — e-commerce, healthcare, fintech, edtech, HR-tech, SaaS.
- Data Fiduciaries (who decide purpose/means) carry the core obligations; Significant Data Fiduciaries face extra duties (DPO, audits, DPIA).
- Global companies serving Indian users are in scope even without an Indian entity.
- Triggers: DPDP Rules enforcement, board/legal mandate, a breach, consumer-data products, cross-border transfers.
The compliance journey
- 1. Understand the Act — read the guide What DPDP covers, definitions, rights and penalties.
- 2. Map your data Inventory personal data, flows, purposes and processors.
- 3. Assess your gaps — read the guide Score yourself against every obligation.
- 4. Build consent & rights — read the guide Consent management, notices, grievance and rights workflows.
- 5. Run DPIA & governance Impact assessments, DPO/governance, breach procedures — then keep evidence current.
Everything in this cluster
Learn
Compare
Prepare
Tools & assessments
Frequently asked questions
Who must comply with the DPDP Act?
Essentially every organisation processing digital personal data of individuals in India — including foreign companies serving Indian users. Obligations scale up for Significant Data Fiduciaries.
What are the penalties under DPDP?
Up to ₹250 crore per category of breach — the highest for failing to prevent personal-data breaches. Penalties are per-instance and can stack.
What should we do first?
Map your personal-data inventory and run a gap assessment against the Act's obligations. That sequence tells you the real scope of consent, rights and security work.
How does CyberSigma help?
DPDP readiness assessment, consent and DPIA build-out, policy packs, DPO advisory and audit-grade evidence — delivered by senior consultants who work with Indian regulators' expectations.
Talk to a senior auditor
Scoping within 48 hours — CERT-In empanelled, PCI QSA authorized, never junior testers.