A working reference for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, written for the person who has to implement them, not for a court. Every claim here names the section it comes from.
The Rules gave the Act operational shape and the Board came into existence. From this point the enforcement machinery exists.
Registration opens for Consent Managers, the Board-registered intermediaries defined at Sec 6(7)–(9) and Rule 4. TruPriv is not one of them.
Consent, notice, rights, breach notification, children's data and Significant Data Fiduciary obligations all become enforceable, with penalties attached.
These are ceilings, not tariffs. The Board determines the amount on the facts. The point is the order of magnitude, and that each figure attaches to a specific obligation you can either evidence or not.
This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
The DPDP Act contains no Article 30-style obligation to maintain records of processing activities. Anyone telling you otherwise is selling from a GDPR script. What is true: Sec 11(1)(a)–(b) gives every Data Principal the right to a summary of their personal data and the identities of everyone it has been shared with, and Sec 10 imposes audits on Significant Data Fiduciaries. Neither is answerable without a maintained record.
A DPIA is not mandatory for every business. It is mandatory for those notified as Significant Data Fiduciaries under Sec 10. If you have not been notified, a DPIA is good practice and a useful way to find out what you actually process — but it is not an obligation the Act places on you.
