Resources
Plain-language guides to the law the readiness check is built on, and to doing the work. They are digests, not the law itself; each links to the official text, which always prevails.
The law
- The DPDP Act, 2023
The Act chapter by chapter: the three roles, the duties, the rights, the Board and the penalty table.
- The DPDP Rules, 2025
Notices, security safeguards, breach reporting, children’s data, grievances and when each part applies.
- Key dates
When each part of the law takes effect, and what it means for a business.
- FAQs
Short answers on who the Act applies to, consent, employees, DPOs, penalties, breaches and certification.
Doing the work
- Readiness guide
A practical order of work, from naming an owner to keeping evidence current, and what each step produces.
- Evidence guide
The five evidence levels, examples of each, what a reviewer looks for, and what not to upload.
- Remediation guide
How to order and run the work of closing gaps: severity, prerequisites, the law’s dates and closing on evidence.
- How results work
Severity rules, control states, the three result states and the score, and what none of them claims.
By sector
- Industry guides
Eight sectors, each with its data flows, vendors, risks, checks, evidence, remediation and reports, and a worked case of who is who.
Official sources
These links leave this site. Where our guides and the official text differ, the official text is right.
- The Digital Personal Data Protection Act, 2023
India Code, Act No. 22 of 2023.
- The Digital Personal Data Protection Rules, 2025
G.S.R. 846(E) of 13 November 2025, published by the Ministry of Electronics and Information Technology (PDF).
- The e-Gazette of India
Original notifications, including the commencement notification and any amendment or corrigendum.