IT services / software
The Act separates the business that decides how data is used (the fiduciary) from the one that processes it on its behalf (the processor).
- Section 2(i) and 2(k)
A Data Fiduciary decides the purpose and means of processing. A Data Processor processes personal data on behalf of a Data Fiduciary.
- Section 8(1)
The fiduciary remains responsible for processing done on its behalf by a processor, whatever any agreement says.
- Section 8(2)
A processor may be engaged for activities related to offering goods or services only under a valid contract.
- Section 8(7)(b)
When erasure is due, the fiduciary must cause its processor to erase the personal data that was made available to it.
- Section 6(6), illustration
When a person withdraws consent, the fiduciary must stop processing and cause its processors to stop. The Act's example: a telecom provider and the processor that emails its bills.
- Section 3(b)
The Act also applies to processing outside India if it is connected with offering goods or services to people in India.
- CERTIN-COOPERATIONCooperate with CERT-In requests
Provide information and assistance to CERT-In when ordered. Non-compliance 'may attract' penal action under s.70B(7) of the IT Act, to be exercised reasonably and for deliberate non-compliance (Directions and FAQ). Penalty amounts reported by commentary are not confirmed here.
Information Technology Act, 2000 - India Code - CERTIN-LOGS-180Enable ICT logs and keep them for a rolling 180 days in India
Enable logs of all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction, producing them to CERT-In on request or with an incident report. The FAQ allows copies abroad if producible in reasonable time and lists example log types (firewall, web, database, mail, VPN, application, events).
Read the official text - CERTIN-NTPSynchronise system clocks to NIC/NPL time sources
Synchronise ICT clocks with the NTP servers of NIC or NPL, or servers traceable to them. The FAQ permits other accurate sources that conform to NPL/NIC time; keep the time zone recorded.
Read the official text - CERTIN-POCDesignate a Point of Contact and notify CERT-In
Designate a Point of Contact to interface with CERT-In and send details to CERT-In (info@cert-in.org.in); keep them current. CERT-In orders for information or assistance are sent to this contact and must be complied with in the stated time and format.
Read the official text - CERTIN-PROVIDER-RECORDSExtra records for data centres, VPS, cloud and public VPN providers
Data centres, virtual private server, cloud service and VPN service providers must keep prescribed subscriber details for 5 years after cancellation. 'VPN service' means internet-proxy-like services offered to the public, not enterprise VPNs (FAQ). Not applicable to ordinary businesses that merely use cloud or VPN.
Read the official text - CERTIN-REPORT-6HReport listed cyber incidents to CERT-In within 6 hours
Report incidents of the types listed in Annexure I (for example ransomware, data breach, data leak, unauthorised access, DDoS, website defacement, phishing, attacks on cloud or e-commerce applications) to CERT-In within 6 hours of noticing them or being notified. Partial information may be sent first and supplemented later (FAQ). The duty cannot be passed to a vendor.
Read the official text
- Section 5(1)
A request for consent must be accompanied or preceded by a notice saying what personal data is processed and why, how the person can exercise their rights, and how to complain to the Board.
- Section 6(1)
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose.
- Section 6(4)
A person can withdraw consent at any time, and withdrawing must be as easy as giving it.
- Section 6(10)
If asked in a proceeding, the business must be able to prove that notice was given and consent obtained as the Act requires.
- Section 7(i)
Processing for employment purposes is one of the Act's certain legitimate uses, so it does not need consent.
- Section 8(1) and 8(2)
The business stays responsible for processing done on its behalf, and may engage a processor only under a valid contract.
- Section 8(5) and 8(6)
It must take reasonable security safeguards to prevent a personal data breach, and must inform the Board and each affected person if one happens, in the prescribed form and manner.
- Section 8(7)
It must erase personal data when consent is withdrawn or when the purpose is no longer being served, unless law requires it to be kept.
- Section 8(9) and 8(10)
It must publish business contact details of a person who can answer questions about the processing, and have an effective way to resolve complaints.
- Section 9(1) to 9(3)
Before processing a child's data (a child is under 18) it must get verifiable parental consent, and it must not track or behaviourally monitor children or direct targeted advertising at them.
- Section 1(2) and the commencement note in the India Code copy
Provisions take effect on dates the Government notifies. By notification G.S.R. 843(E) of 13 November 2025, sections 3 to 5, 6(1) to 6(8), 6(10) and 7 to 17 take effect eighteen months after 13 November 2025; section 6(9) (Consent Managers) one year after; and sections 2, 18 to 26 and 35 to 43 on 13 November 2025.
Source: The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) — Gazette of India (e-Gazette), India Code. Official text read on 2026-10-20. We read the official text of the Act. The DPDP Rules, 2025 have not yet been checked against the official text, so nothing here relies on them. This is information, not legal advice, and it has not been reviewed by counsel. Read the Act itself.
This page describes what the law says. It does not say whether your business is compliant. What is DPDP?
See where your business stands.
Start with the free DPDP website scan, or talk to a specialist about getting DPDP-ready.