Section 5
Notice before processing
Tell Data Principals what personal data you collect, why, and how they can exercise their rights — in English or any language in the Eighth Schedule.
Built for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025
Run DPDP compliance as an everyday operation, not a yearly project.
DPDPall gives Data Fiduciaries one place to map personal data, manage notices and consent, answer Data Principal requests, respond to breaches and keep audit-ready evidence.
- Maximum penalty for failing to protect personal data
- ₹250 cr
- To file a detailed breach report with the Data Protection Board
- 72 hrs
- Statutory rights every Data Principal can exercise
- 4
- Verifiable parental consent required for a child's data
- Under 18
Preliminary privacy readiness assessment
Assess your organisation's privacy readiness
A free self-assessment across the areas the Act and Rules cover, from notices and consent to breach response and processors. You get an indicative readiness score, your gaps by severity and recommended actions in minutes. It is a self-assessment based on your answers, not legal advice or a certification.
- Read the privacy notice first
- You choose what we may contact you about
- Available to listen to
Obligations of a Data Fiduciary
What the DPDP Act asks of your organisation
The Act applies to digital personal data processed in India, and to processing outside India when it involves offering goods or services to people in India.
Section 6
Valid, withdrawable consent
Consent must be free, specific, informed, unconditional and unambiguous, limited to the stated purpose, and as easy to withdraw as it was to give.
Section 7
Legitimate uses
Process without consent only for the uses the Act permits — and be able to show which one applies to each processing activity.
Section 8(5)
Reasonable security safeguards
Protect personal data in your possession or under your control, including data handled by your Data Processors.
Section 8(6)
Breach intimation
Notify the Data Protection Board and every affected Data Principal of a personal data breach, in the form and manner the Rules prescribe.
Section 8(7)
Retention and erasure
Erase personal data once the purpose is served or consent is withdrawn, and have your processors erase it too.
Section 9
Children's data
Obtain verifiable parental consent, and never track, behaviourally monitor or target advertising at children.
Section 10
Significant Data Fiduciaries
Appoint a Data Protection Officer based in India, engage an independent data auditor and carry out periodic Data Protection Impact Assessments.
Rights of the Data Principal
Every request has a statutory answer — and a deadline
Data Principals can exercise these rights against any Data Fiduciary. DPDPall routes each request, tracks it and keeps the evidence.
Access information
A summary of the personal data being processed, the processing activities, and who it has been shared with.
Section 11Correction and erasure
Correct, complete or update their data, and have it erased when it is no longer needed.
Section 12Grievance redressal
A readily available way to raise a grievance with the Data Fiduciary before approaching the Board.
Section 13Nomination
Nominate someone to exercise their rights in the event of death or incapacity.
Section 14
The DPDPall platform
One control plane for every obligation
Each module maps to a duty under the Act, so compliance work produces evidence as it happens.
Data Discovery
Find where personal data lives across systems and classify it.
Processing Activities
Maintain purposes, legal bases, retention and data flows.
Consent Management
Collect, record and honour consent and its withdrawal.
Notice Management
Publish versioned, multilingual privacy notices.
Rights Requests
Track access, correction, erasure and nomination requests to closure.
DPIA
Run Data Protection Impact Assessments with a consistent method.
Breach Management
Log incidents and meet Board and Data Principal notification timelines.
Audit & Evidence
An immutable trail of who did what, ready for an auditor or the Board.
The Schedule
Penalties the Data Protection Board can impose
Amounts are the maximum per instance. The Board weighs the nature, gravity and duration of the breach, and any steps taken to mitigate it.
| Breach | Up to |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board or affected Data Principals of a breach | ₹200 crore |
| Non-fulfilment of the additional obligations for children | ₹200 crore |
| Non-fulfilment of the additional obligations of a Significant Data Fiduciary | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
Be ready when the Board, an auditor or a Data Principal asks.
Bring your privacy operations, evidence and teams onto one platform built for India's data protection law.
Sign in