{{ p.k }}{{ p.status }}
{{ p.date }}
{{ p.t }}
- —{{ it }}
NEWIndia's marketplace for DPDP Act 2023 compliance
Don't just comply.
Out-trust.
Out-trust.
₹250 crore of risk.
One place to close it.
One place to close it.
Consent-first.
Board-ready.
Built for India.
Board-ready.
Built for India.
Where India's data law meets its sharpest minds.
DPDP Act compliance, done with verified privacy lawyers, auditors and DPOs. Assess your gaps for free, post a requirement, and get proposals from vetted DPDP experts within 48 hours.
Source: Digital Personal Data Protection Act, 2023 (Schedule) and DPDP Rules, 2025 as notified by MeitY.
The law
What is the Digital Personal Data Protection Act, 2023?
The DPDP Act is India's first comprehensive data protection law. It received Presidential assent on 11 August 2023 and governs how organisations collect, use, store, share and erase the digital personal data of individuals in India.
MeitY notified the DPDP Rules, 2025 on 13 November 2025, starting an 18-month phased rollout. The Rules turn the Act's principles into specific duties: how a notice must look, how fast a breach must be reported, how long logs must be kept and when inactive users' data must be erased.
The Act applies to processing inside India, and to processing outside India when it is connected with offering goods or services to people in India. It is enforced by the Data Protection Board of India, with appeals heard by TDSAT.
{{ r.i }}
{{ r.t }}
{{ r.d }}
The seven principles behind the Act
{{ p.n }}{{ p.t }}
WHO MUST COMPLY
Every business, startup, NGO, hospital, school and government body that processes digital personal data of people in India, whatever its size. Foreign companies serving Indian users are covered too.
WHAT IS COVERED
Personal data collected in digital form, and data collected offline that is later digitised: customer records, employee files, CCTV-linked systems, app analytics, KYC and more.
WHAT IS NOT
Data processed for purely personal or domestic purposes, and data made publicly available by the individual or under a legal obligation. Specific exemptions exist under Section 17.
Compliance timeline
DPDP Rules 2025: three phases, eighteen months
The deadlines are fixed in the notification. Consent systems, vendor contracts and data mapping take quarters to build, so most of the work has to be finished well before May 2027.
YOU ARE HERE · {{ todayLabel }}
Use cases & obligations
Twelve DPDP obligations every Data Fiduciary has to operationalise
Each obligation maps to a section of the Act or a Rule, and to experts on the marketplace who deliver it.
{{ o.i }}{{ o.ref }}
{{ o.t }}
{{ o.d }}
Expert help: {{ o.svc }}
Data Principal rights
Rights your users can exercise, and you must honour
Sections 11 to 14 give every individual enforceable rights. Your systems need a documented way to receive, verify and answer each request, and grievances must be resolved within 90 days under Rule 14.
Duties too. Section 15 places duties on Data Principals, such as not filing false or frivolous complaints. Breach can attract a penalty of up to ₹10,000.
{{ r.i }}
{{ r.t }}
{{ r.ref }}{{ r.d }}
Industry use cases
DPDP compliance by industry
The Act is sector-neutral, but the risk isn't. Pick your industry to see the data at stake, the obligations that bite hardest and the services experts usually deliver first.
{{ ind.h }}
{{ ind.p }}
DATA AT STAKE
OBLIGATIONS THAT BITE
- priority_high{{ x }}
START WITH
- check{{ x }}
Services
Every DPDP compliance service, in one marketplace
Twenty services across the full compliance lifecycle, from the first gap assessment to representation before the Data Protection Board. Hire one expert for a single task or a firm for the whole programme.
exploreNot sure which stage you're at? The free readiness assessment tells you in about five minutes.
Take the assessment
How the marketplace works
Two sides, one standard of trust
{{ r.k }}
- •{{ x }}
Post a requirement
Describe the problem. Verified experts send proposals.
Posting is free and takes two minutes. Your company name stays hidden until you choose to share it, and every expert signs a platform NDA before seeing details.
scheduleFirst proposals typically within 48 hours
visibility_offAnonymous until you shortlist
verified_userOnly verified experts can respond
task_alt
Requirement posted
Reference {{ rfpRef }}. Matched experts are being notified. Expect your first proposals within 48 hours.
Find a DPDP expert
DPDP consultants, privacy lawyers and auditors across India
{{ e.init }}
{{ e.n }}
{{ e.r }}
verified{{ e.badge }}
{{ e.city }}· {{ e.type }}
★ {{ e.rating }}
rating
{{ e.jobs }}
DPDP projects
{{ e.resp }}
response
Illustrative profiles shown for launch preview.
Verification & badges
Every badge is earned, checked and re-checked
There is no government-issued DPDP certificate for consultants. Our badges are platform credentials that tell you how deeply an expert has been vetted. Badges are reviewed every 12 months.
{{ b.i }}
{{ b.t }}
{{ b.s }}
- check{{ x }}
Free DPDP readiness assessment
How ready are you? Ten questions, instant gap report.
{{ q.n }}
{{ q.t }}
YOUR RESULT · {{ answered }}/10 ANSWERED
{{ quizScore }}/ 100
{{ band }}
PRIORITY GAPS
Answer the questions to see which gaps to close first.
- {{ g.i }}{{ g.t }}
→ {{ g.s }}
DPDP penalty calculator
What could a single incident cost you?
DPDP penalties are fixed caps per instance, not a percentage of turnover. One breach can trigger several heads at once. Select what applies to estimate maximum exposure.
MAXIMUM COMBINED EXPOSURE
₹{{ penTotal }} Cr
≈ ₹{{ penTotalWords }} across {{ penCount }} head(s)
THE BOARD WEIGHS (SECTION 33)
- Nature, gravity and duration of the breach
- Type and nature of personal data affected
- Repetitive nature of the breach
- Gain made or loss avoided
- Mitigation steps taken and their timeliness
- Proportionality and effect on the entity
Illustrative only. Actual penalties are determined by the Data Protection Board after inquiry.
DPDP vs GDPR
GDPR-compliant is not DPDP-compliant
Global companies often assume their GDPR programme covers India. These are the differences that require changes.
For DPDP experts
Your DPDP practice, with a steady pipeline
Independent consultants, law firms, audit firms and privacy-tech vendors can list on DPDP.expert. Get verified once, then respond to qualified requirements from businesses that are ready to hire.
{{ p.i }}
{{ p.t }}
{{ p.d }}
Resources
DPDP guides from practitioners
Glossary
DPDP terms, defined plainly
- {{ g.t }}
- {{ g.d }}
FAQ
DPDP Act: frequently asked questions
Can't find your answer? Post a question and a verified expert will reply.
{{ f.a }}
{{ f.a }}
Countdown to full enforcement
Every DPDP obligation applies from 13 May 2027.
{{ c.v }}
{{ c.l }}
A typical mid-size DPDP programme takes about 28 weeks, from first assessment to audit-ready evidence. {{ bufferLine }}
{{ p.i }}{{ p.w }}
{{ p.t }}
{{ p.d }}
{{ p.by }}