LEXACORE · STATUTORY COMPLIANCE COMMAND CENTER
DPDP Act 2023 Compliance Guide
India's Digital Personal Data Protection Act, 2023 explained for corporate boards, in-house counsel, CISOs, and tech leaders. Complete roadmap, penalty matrix, and self-audit tools.
Enterprise DPDP Readiness Score
Statutory Penalty Schedule (The Schedule)
Adjudicated by the Data Protection Board of India (DPBI) based on breach severity, duration, and volume of affected records.
Failure to take reasonable security safeguards to prevent personal data breach under subsection (5) of Section 8.
Failure to notify the Data Protection Board of India and affected Data Principals in the event of a personal data breach.
Non-compliance with additional obligations in relation to children — behavioral tracking, targeted ads, or lack of verifiable parental consent.
Failure to appoint an India-resident DPO, conduct periodic Data Protection Impact Assessments (DPIA), or retain an independent auditor.
Key Fiduciary Obligations (Chapter II)
Every entity determining the purpose and means of processing personal data in India must adhere to these core mandates.
Notice Preceding Consent
Every request for consent must be accompanied or preceded by a notice stating the itemized personal data collected and the specific purpose of processing.
Consent Architecture
Consent must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. Withdrawal must be as easy as giving consent.
Data Erasure & Retention
A Data Fiduciary must erase personal data upon withdrawal of consent or as soon as it is reasonable to assume the specified purpose is fulfilled.
11 Chapters of the DPDP Act 2023
Complete statutory navigation through the legislative framework enacted by the Indian Parliament.
Preliminary
Definitions of Data Fiduciary, Data Principal, Consent Manager, and territorial scope.
Obligations of Data Fiduciary
Grounds for processing, notice requirements, security safeguards, and SDF rules.
Rights & Duties of Data Principal
Right to access summary, correction, grievance redressal, and nominee designation.
Special Provisions & Exemptions
State security, law enforcement, research, and startup exemptions.
Data Protection Board of India
Establishment, composition, inquiry procedures, and summons powers of the DPBI.
Powers of the Board
Inquiries, urgent interim directions, inspection of computers, and penalties.
Appeal & Alternate Dispute
Appeals to Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days.
Penalties & Adjudication
Adjudication principles, mitigating factors, and maximum monetary penalties.
Finance, Accounts & Audit
Budgetary allocation, accounts, and audits of the Data Protection Board.
Miscellaneous
Protection of action taken in good faith, bar of civil court jurisdiction.
Rule Making & Amendments
Central Government rule-making powers, IT Act 2000 Section 43A omissions.