Frequently asked questions
Short answers to the questions we are asked most. Each points to the section of the law or the page with more detail. The official text always prevails.
The law
Does the DPDP Act apply to a small business?
Yes, if it processes personal data of individuals in digital form, or on paper that is later digitised. The Act has no turnover threshold. The government can exempt notified classes of fiduciaries, including startups, from some duties (s. 17(3)); check whether any exemption has been notified before relying on one.
When do the duties apply?
Parts of the Act and the Rules applied from 13 November 2025, mainly those setting up the Data Protection Board. Most duties on businesses, including notices, consent, security, breach reporting, retention and children’s data, apply from 13 May 2027. Key dates has the detail.
Do we need consent for everything?
No. Consent is one basis. The Act also lists legitimate uses that need no consent, including data a person gives you for a specific purpose, employment-related processing, and medical emergencies (s. 7). Marketing and anything beyond what the person expects usually needs consent.
Does it cover employee data?
Yes. Employees are Data Principals. Processing for employment purposes is a legitimate use under s. 7, so consent is often not the basis, but the other duties, such as security, erasure and grievance redressal, still apply. The rights to a summary and to correction under ss. 11 and 12 cover data processed on consent or volunteered under s. 7(a), so they may not reach all employment data. Under legal review: How ss. 11 and 12 apply to employment data processed under s. 7(i) should be confirmed.
Do we need a Data Protection Officer?
Only a fiduciary notified as a Significant Data Fiduciary must appoint a Data Protection Officer based in India (s. 10). Every other fiduciary must publish the business contact of a person who can answer questions about its processing.
Is health or financial data treated differently?
The Act does not create special categories of personal data. It expects safeguards that match the harm a breach could cause, and sector regulators’ rules continue to apply alongside it.
What are the penalties?
The Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failures on breach reporting or children’s data, and up to ₹50 crore for other breaches. These are maximums; the Board must keep a penalty proportionate. Its powers to inquire and impose penalties apply from 13 May 2027. The penalty table.
How quickly must a breach be reported?
To each affected person and to the Board without delay, with a detailed report to the Board within 72 hours of becoming aware, or a longer period if the Board allows it on request. There is no minimum size below which a breach need not be reported.
Can we store data outside India?
Yes, unless the government restricts the destination country by notification (s. 16). Stricter sector rules, such as those on storing payment data in India, continue to apply.
Is there a DPDP certification?
The Act does not set up a certification scheme. ReversePath does not certify anyone, and no result or report here is a certificate, a government approval or a statement that an organisation complies with the Act.
ReversePath
Is this legal advice?
No. ReversePath is guidance and a way to organise the work. It does not replace a lawyer, a security specialist or your chartered accountant, and you should have a lawyer review anything you rely on.
Where do my answers go in the free check?
They stay in your browser. Nothing is sent to us unless you create an account and save the result, or choose to share it when you ask for help.
Does ReversePath use AI to produce results?
No. Every result is worked out from your answers by fixed rules that are published in How results work. The same answers always give the same result.
What do Self-Assessed, Evidence-Supported and Expert-Verified mean?
Self-Assessed means the result rests on your answers alone. Evidence-Supported means every control you answered as in place has current evidence at the level it needs. Expert-Verified means a named, qualified reviewer checked the evidence and accepted controls. If the reviewer accepted only some of the controls you answered as in place, the result says so in its name, for example Expert-Verified for 4 of 12 controls, and the rest remain self-assessed. The result always states the reviewer, the date and which controls were accepted.
Our sector is not listed. Can we still use it?
Yes. Choose “Other business” in the readiness check to answer the common questions every organisation needs to answer.
Are the prices final?
Not yet. Paid products are priced while we test them with early customers, and some show “Price on request”. The price on your order is the price you pay. Pricing.
Who wrote the questions?
They are written from the text of the Act and the Rules, organised into 20 modules shared by every sector, with sector questions added. The question banks are drafts awaiting review by a qualified data-protection lawyer, and every result says so.