For CXOs, IT and security leaders, and their teams
DPDP Explained
From policy to practice: a guide to the Digital Personal Data Protection Act and Rules for Indian businesses.
What the law requires, the security and breach-reporting duties that fall on IT and security teams, and the order in which to act, with checklists, templates and an evidence pack you can use straight away.
What’s inside
Understanding the Act and Rules
What the law covers, who is accountable, what it requires and how it is enforced.
Protecting personal data and responding to breaches
Security safeguards, backup and recovery, logging, and how to report a breach.
Building your compliance roadmap
A readiness score, checklists, templates, an evidence pack and a yearly calendar.
DPDP by industry
BFSI, healthcare, manufacturing, IT/ITES, education, retail and logistics.
CxO summary
The key facts, seven questions to ask your IT head, and the order of action.
From the CxO summary
Five facts for leaders
Liability stays with you. You are accountable for personal data handled by your vendors, cloud providers and MSPs.
Every breach is reportable. Notify the Board and every affected individual without delay, and send the Board a detailed report within 72 hours.
You must prove consent. If consent is questioned, the burden is on you to show that notice was given and consent obtained.
Backups and logs are named safeguards. The Rules require the ability to keep processing after a compromise, and logs kept for at least one year.
Penalties reach ₹250 crore for inadequate security and ₹200 crore for failing to report a breach, for breaches the Board finds significant.
Who it’s for
CXOs and boards
The obligations, the penalties and the questions to ask, so data protection can be owned at board level.
IT and security leaders
The safeguards, logging, recovery and breach-reporting duties that fall on your teams, with the evidence to show for them.
The teams doing the work
Checklists, templates and a yearly calendar to carry out the work and keep it current.
About this handbook
DPDP Explained is built on the official texts of the Act and Rules, and on the questions business and technology leaders raised with us at Vembu Meet sessions across India. It sets out what the law requires in plain language, with the tools teams need to act on it.
This handbook gives general information on the DPDP Act, 2023 and the DPDP Rules, 2025. It is not legal advice.
