---
title: "DPDP Act FAQ: Common Questions Answered Simply | dpdpr.in"
description: "Answers to the most common DPDP Act and DPDP Rules questions: who is covered, consent, children's data, breach reporting, penalties and deadlines."
url: "https://dpdpr.in/faq/"
canonical: "https://dpdpr.in/faq/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# DPDP Act FAQ

## What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's law on how digital personal data may be processed. It received Presidential assent on 11 August 2023. The DPDP Rules, 2025 add the details.

## Is the DPDP Act in force?

Partly. Under notification G.S.R. 843(E) dated 13 November 2025, the definitions and the provisions on the Data Protection Board came into force on 13 November 2025. Consent Manager registration starts on 13 November 2026. Most obligations on Data Fiduciaries, and the rights of Data Principals, start on 13 May 2027. See the [deadlines page](https://dpdpr.in/deadlines/).

## Who has to comply?

Any person who decides the purpose and means of processing digital personal data (a Data Fiduciary), in India, or outside India when processing is connected to offering goods or services to people in India. See [section 3](https://dpdpr.in/act/section-3/).

## Does the Act apply to data I post publicly?

No. The Act does not apply to personal data that the person herself makes publicly available, or that someone is legally required to make public. See [section 3](https://dpdpr.in/act/section-3/).

## What is a Data Principal?

The individual to whom the personal data relates. For a child, it includes the parents or lawful guardian. See [section 2](https://dpdpr.in/act/section-2/).

## What is a Consent Manager?

A person registered with the Board who acts as a single point of contact to help a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. See [section 2](https://dpdpr.in/act/section-2/), [section 6](https://dpdpr.in/act/section-6/) and [rule 4](https://dpdpr.in/rules/rule-4/).

## Who is a child under the Act?

An individual who has not completed eighteen years of age. See [section 2](https://dpdpr.in/act/section-2/).

## How quickly must a company report a breach?

From 13 May 2027, a Data Fiduciary must inform each affected Data Principal and the Board without delay, and send the Board a detailed report within seventy-two hours, unless the Board allows more time. See [rule 7](https://dpdpr.in/rules/rule-7/).

## What are the maximum penalties?

Up to two hundred and fifty crore rupees for failing to take reasonable security safeguards, as listed in the Schedule to the Act. See the [penalties guide](https://dpdpr.in/guides/penalties/).

## Can I get compensation under the Act?

The Act provides for penalties imposed by the Board, which go to the Consolidated Fund of India. It does not provide for compensation to individuals. See [section 34](https://dpdpr.in/act/section-34/).

## How do I complain?

First use the grievance redressal system of the Data Fiduciary or Consent Manager. Only after that can you approach the Board. See [section 13](https://dpdpr.in/act/section-13/). The Board's complaint functions start on 13 May 2027.

## How long does a company have to answer my grievance?

A reasonable period not exceeding ninety days, under rule 14(3). See [rule 14](https://dpdpr.in/rules/rule-14/).

## Can my data be sent abroad?

Yes, unless the Government restricts transfer to a country by notification, subject to requirements under rule 15 and any stricter sector law. See [section 16](https://dpdpr.in/act/section-16/).

## Has the Data Protection Board been appointed?

The Board was established by G.S.R. 844(E) dated 13 November 2025. As of the latest official sources we found, the Chairperson and Members had not been appointed. See the [Board page](https://dpdpr.in/board/).

## Is this website official?

No. dpdpr.in is an independent reference. It is not affiliated with the Government of India, MeitY or the Data Protection Board. It is not legal advice.