What enforcement looks like before the first DPDP penalty.
A plain-language tracker of the regimes that already govern personal data in India — the IT Act framework, CERT-In directions and sector regulators — alongside the GDPR patterns that show how a mature data-protection regulator behaves. Editorial, not legal advice; updated progressively.
This page summarises publicly known regulatory frameworks in general terms. It does not cite individual cases or penalty amounts, and it is not legal advice. Confirm specifics with counsel.
Ask a SpecialistDPDP is arriving into a system that already asks for evidence.
Organisations sometimes read “no penalties yet” as “no obligations yet”. The frameworks below are enforced today, and each already expects the records a DPDP programme produces.
The IT Act framework for sensitive personal data
Before DPDP, India’s data-protection duties sat in the Information Technology Act and its rules on sensitive personal data — requiring reasonable security practices, privacy policies, consent for sensitive data and a basis for compensation when negligence causes loss. Those duties continue to be referenced in disputes and contracts.
CERT-In incident-reporting directions
CERT-In’s directions require covered organisations to report specified cyber incidents within a short, fixed window and to retain logs for a defined period. A personal-data breach is almost always also a reportable cyber incident, so the DPDP breach playbook and the CERT-In playbook must be the same document.
RBI supervision of banks, NBFCs and fintechs
KYC directions, outsourcing and digital-lending guidelines, and cyber-security frameworks give RBI inspectors reason to ask for consent records, data-sharing registers and vendor controls today. Supervisory findings and penalties in these areas are public and recurring.
IRDAI and SEBI frameworks
Insurers and market intermediaries operate under information-security, record-keeping and outsourcing rules that overlap heavily with DPDP’s security, retention and processor obligations. Both regulators run inspection cycles that test them.
Consumer-protection and sector-specific rules
E-commerce rules, telecom and health-sector expectations add notice, consent and complaint-handling duties for specific industries — and consumer forums already hear complaints about misuse of personal data.
Contractual enforcement by enterprise buyers
The fastest-growing enforcement channel is procurement. Banks, insurers and hospitals now require DPDP-aligned processing terms, sub-processor lists and security evidence from every vendor — and drop vendors who cannot produce them.
What a mature regulator penalises — and what it means for DPDP.
Europe has several years of enforcement history under a law that DPDP resembles in structure. The patterns are instructive even where the details differ.
What GDPR enforcement has repeatedly targeted
- Consent that was bundled, pre-ticked or not freely given — especially for advertising and profiling.
- Insufficient security safeguards revealed by a breach, and late or incomplete breach notification.
- Processing children’s data without adequate age checks or parental consent.
- Retaining data indefinitely, or beyond the stated purpose.
- Failing to honour access, erasure and objection requests within the required time.
- Transfers and vendor arrangements without proper safeguards or contracts.
The DPDP parallel
- Free, specific, informed consent with easy withdrawal; no bundling.
- Reasonable security safeguards; breach notification to the Board and affected individuals.
- Verifiable parental consent; no tracking or targeted advertising directed at children.
- Erasure when the purpose is served or consent is withdrawn, unless law requires retention.
- Data principal rights to access, correction, erasure and grievance redressal.
- Fiduciary accountability for processors under contract.
GDPR and DPDP differ in scope, legal bases and penalty structures. The comparison is about enforcement behaviour, not legal equivalence.
Phased, not overnight.
The Act was passed in 2023; its rules and institutions are being brought into force in stages. Dates are set by government notification and can change — treat the sequence, not any specific date, as the planning input.
Act enacted
The Digital Personal Data Protection Act, 2023 receives assent, establishing the obligations and the Data Protection Board.
Rules notified
Detailed rules on notice, consent managers, breach notification, children’s data and the Board’s functioning are notified, with staggered effective dates.
Institutions operational
The Board and consent-manager registration come into operation; organisations’ transition windows begin to close.
Full enforcement
Substantive obligations and penalties apply. Organisations with a working consent log, rights process and breach playbook answer complaints from records; others reconstruct.
The organisations that fare best under any new regulator are the ones with evidence already in hand. Find out where your gaps are before someone else does.
Run the Gap AssessmentEditorial, general, and updated as the regime evolves.
We add entries when a rule is notified, a regulator publishes guidance, or a public enforcement pattern becomes clear. We do not publish individual case details, penalty figures or speculation. If you need a sector-specific reading, that is a conversation with a specialist and your counsel.
About this tracker
Know your gaps before the regulator does.
Ten minutes, seven compliance areas, an immediate prioritised action list.