India’s data protection law says what companies may do with your personal data, what you can ask of them, and what happens when they get it wrong. This is the whole thing on one page, with the section or rule number next to every point.
The Act gives everyone a name. Once you know these seven, the rest reads easily. For a child, or a person with a disability, the parent or lawful guardian acts as the Data Principal (s.2(j)).
Swipe the diagram sideways to see all of it.
If you are a person: what you can ask for
These rights start on 13 May 2027. Each blue section or rule number opens the official PDF at that page.
Know what they holdA summary of your data, what is being done with it, and who else it was shared with.s.11
Fix itHave wrong data corrected, and incomplete or old data completed or updated.s.12
Have it deletedAsk for erasure. The company must also delete when you withdraw consent or the purpose is over, with a 48-hour warning, unless the law makes it keep the data.s.12, s.8(7), Rule 8
Say no laterWithdrawing consent must be as easy as giving it.s.6(4)
ComplainUse the company’s grievance process first. It must answer within 90 days. If you are not satisfied, go to the Data Protection Board.s.13, Rule 14
Name someoneNominate a person to use your rights for you if you die or cannot act.s.14
Under 18?A company needs a parent’s or guardian’s verifiable consent before using a child’s data, and cannot track, monitor behaviour or aim targeted ads at children.s.9
Your own dutiesDon’t impersonate anyone, hide facts from official documents, or file false or frivolous complaints. The cap for breaking these is ₹10,000.s.15
If you run a company: what you must do
Ten duties, in the order most teams meet them. All apply from 13 May 2027.
Tell people firstA notice before you ask for consent: what data, why, how to withdraw, how to complain. People can choose English or any of the 22 scheduled languages.s.5, Rule 3
Get real consentFree, specific, informed, a clear yes, limited to what you need. You must be able to prove it.s.6
Or have a listed reason“Legitimate uses” such as data a person volunteered for a stated purpose, employment, medical emergencies and legal orders.s.7
Contracts with processorsOnly under a valid contract. You stay responsible for what they do.s.8(1)-(2)
Lock it downEncryption or masking, access controls, logs and monitoring, backups, and logs kept for a year.s.8(5), Rule 6
Report breachesTell the Board and each affected person without delay, then a detailed report to the Board within 72 hours.s.8(6), Rule 7
Delete when doneErase when consent is withdrawn or the purpose is served, warning the person 48 hours before.s.8(7), Rule 8
Say who to contactPublish contact details for a person who can answer questions, and run a grievance process that answers within 90 days.s.8(9)-(10), Rules 9, 14
Extra care for childrenUnder 18: verifiable parental consent. No tracking, behavioural monitoring or targeted ads aimed at children, with some listed exemptions.s.9, Rules 10-12
If you are bigSignificant Data Fiduciaries need an India-based data protection officer, an independent auditor, and an impact assessment and audit every 12 months.s.10, Rule 13
Dates and penalties
13 Nov 2025StartedThe Act’s definitions and the Board’s set-up rules came into force. No penalties yet.
13 Nov 202614 daysConsent manager rules start (Rule 4). Still no penalties.
13 May 2027195 daysThe main duties and the penalties start: security safeguards, breach reporting, children’s data.
Counting down to midnight (India time) at the start of each date. Without JavaScript, days are counted from 30 Oct 2026, when this page was last built.
Penalties apply from 13 May 2027. They are ceilings the Board sets case by case, from ₹250 crore for failing to keep data secure, ₹200 crore for not reporting a breach or mishandling children’s data, and ₹150 crore for a Significant Data Fiduciary’s extra duties, down to ₹50 crore for anything else.
Yes, if it processes personal data in connection with offering goods or services to people in India (s.3(b)).
Does it cover paper records?
It covers digital personal data, including data collected on paper and digitised later (s.3(a)). Paper records that are never digitised are outside it.
What is left out?
Use by an individual for personal or domestic purposes, and data a person has made public themselves (s.3(c)). The Government can also exempt State bodies, and some classes of company, startups included, from some duties (s.17). Check the notifications before relying on an exemption.
Who decides a breach is serious enough to fine?
The Data Protection Board. After an inquiry it can impose a penalty from the Schedule if it finds a breach “significant”, weighing things like how serious and how long it was, the type of data, and what the company did to limit harm (s.33).
Can a company appeal a penalty?
Yes, to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (s.29).
Does it replace CERT-In reporting?
No. The 6-hour CERT-In and sector rules are separate. How they stack up is on the four clocks.