Digital Personal Data Protection (DPDP)

The Digital Personal Data Protection Act (DPDP Act) 2023 establishes a legal framework for processing digital personal data, reinforcing privacy as a fundamental right. Supplemented by DPDP Rules 2025, it shifts the focus from compliance to strategic opportunity, emphasising governance, consent integrity, and robust security frameworks.

As data volumes surge and AI adoption accelerates, DPDP compliance is key to building trust and ensuring organisational readiness for a privacy-first future. This is being accelerated by growing regulatory expectations around consent management, data minimisation, breach response, cross-border data transfers and customer rights. Across sectors such as banking, consumer markets, media, aviation, hospitality, healthcare, technology and GCCs, organisations are re-evaluating data governance frameworks, modernising privacy controls and adopting privacy-by-design principles. As data ecosystems become increasingly interconnected, the focus is shifting from compliance readiness to building sustainable, trust-led digital operations.

business

Data privacy and governance

Strengthening accountability, transparency and responsible data management

security

Consent and customer trust

Embedding customer-centric privacy practices across digital interactions

phonelink_lock

Compliance and operational readiness

Aligning business processes, technology and governance with evolving regulatory requirements

At the same time, DPDP implementation is increasingly being shaped by sector-specific business and operational priorities.

Customer data protection

Strengthening governance and data management frameworks
Consent management and transparency

Improving customer control and trust
Privacy-by-design approaches

Integrating data protection into business processes and technology systems
Sector-specific privacy frameworks

Supporting compliance across banking, aviation, hospitality, healthcare, media and consumer markets

Cross-border data governance

Enabling compliant operations across globally integrated organisations and GCCs
Data security and breach preparedness

Improving resilience and incident response capabilities
Technology-enabled privacy management

Supporting scalable compliance and operational efficiency

DPDPA compliance is a transformation journey, not a last-minute fix.

With 13 May 2027 on the horizon, the clock is already ticking.

--

Latest insights

The DPDP Rules 2025 serves as a crucial extension to the DPDP Act 2023, providing operational clarity for entities processing digital personal data

Compliance evolves into a strategic edge, building trust, resilience, and customer empowerment in banking

Aviation milestones reflect not just expansion but promises deeper connectivity and a far more complex domestic and international network

DPDPA demands strong vendor oversight, data minimisation, clear consent, rapid breach response and protection across IoT and smart rooms

The DPDP Act and Rules 2025 elevates personal data to board-visible governance, introducing India’s first enforceable framework for privacy

Driving growth with DPDP trends

Data privacy and cybersecurity in an evolving AI landscape
Digital Personal Data Protection Act 2025
DPDPA Rules are foundational for Digital India
Digital Personal Data Protection Act (DPDPA) - Obligations to opportunities
DPDP pushes automakers towards 'privacy-by-design' architechture

Sony Anthony
Rupak Nagarajan

Sony Anthony

Partner and Head of Department – Cyber Defence and Incident Response

KPMG in India

mail

As the DPDP Act begins to take effect, organisations are starting to look beyond compliance and focus more deeply on accountability, governance, and trust in how data is managed.

The line between vulnerability discovery and weaponisation has collapsed exponentially. If the security posture still relies on manual triage and weekly patch cycles, you're treating an AI-speed problem with a human-speed solution.

The metric for success is no longer how fast we find exposure, it's how rapidly we translate that intelligence into actionable, risk-based resilience

Rupak Nagarajan

Partner, Cyber Strategy & Govn
KPMG in India

The DPDP Act marks a fundamental shift in how organisations think about handling personal data. The conversation is moving beyond compliance towards building trust, strengthening governance and responsible innovation.

For businesses navigating an increasingly digital ecosystem, privacy is becoming a strategic differentiator that provides competitive advantage.

Akhilesh Tuteja
Atul Gupta
Nitin Shah

Akhilesh Tuteja

Partner & National Leader, Clients and Markets

KPMG in India

mail

While the large corporations in India may be ready for the new DPDP rules, the ecosystem of partners, vendors, suppliers, etc. may not be ready - this is one of the significant holes in the entire readiness for our country. Smaller organisations have a lower level of understanding to start with, and also sometimes implementation of DPDP rules.

It's not the notice, it's not the consent, it's not about getting your system right, it's about getting your ecosystem right. Because larger organisations will take several months just to educate their ecosystem partners what it is, why is it important, even before they start to put the first process in.

Atul Gupta

Partner and Head - Digital Trust and Cyber

KPMG in India

mail

DPDPA rules build on the pragmatic approach adopted while publishing the act, which is evident from the additional considerations for significant data fiduciaries and prioritising identified industry segments. These rules will enable addressing the wider issue that the citizens and consumers face today of mass data proliferation across digital channels and need of adequate protection around digital data. Having a data protection board shall lead to stronger enforcement and will go a long way in addressing the vision as part of Digital India and Viksit Bharat.

Nitin Shah

Partner, DT-Cyber Strategy and Govn
KPMG in India

The Digital Personal Data Protection Act empowers India Inc to put customers at the heart of digital transformation. By giving individuals greater control over what data is processed, why it’s processed, and how outcomes are delivered, organisations can build trust as the foundation for innovation and growth.

Akhilesh Tuteja

Partner & National Leader, Clients and Markets

KPMG in India

mail

One of the things India has been proud of is the speed, the ability to innovate and drive outcomes using digital technologies. One of the key challenges around this digital revolution is how do we protect personal data. The DPDPA Rules are foundational for us to become Digital India and continue the journey of acceleration on how we bring digital into our everyday life.

Manoj Kumar Vijai

Non-Executive Chairman, Office Managing Partner - Mumbai

KPMG in India

mail

The ongoing wave of digital transformation has exposed new gaps in security structures, intensifying the complexities of data protection and regulatory adherence. At the CIO Meet, we explored how enterprises must gear up for India's DPDPA rollout.

Though compliance has been a familiar theme, its strategies are constantly redefined by evolving technology. Modern data protection demands an advanced, nuanced approach shaped by innovation and digital evolution. This shift encourages businesses to expand their perspective, moving from strict regulatory adherence to uncovering broader advantages.

“DPDPA introduces a structured approach to personal data protection. It represents more than fulfilling requirements-it is about reshaping how we manage, store, and process sensitive information. Navigating this complex terrain requires robust controls that integrate behavioral insights. This balance not only safeguards key assets but also strengthens trust across stakeholder groups. To manage this challenging environment, organisations should establish strong controls while considering human behavior. This is key to protecting assets and maintaining trust among stakeholders."

Jeffry Jacob

Partner and National Sector Leader - Automotive, Industry Group Leader - Chemicals

KPMG in India

mail

While the large corporations in India may be ready for the new DPDP rules, the ecosystem of partners, vendors, suppliers, etc. may not be ready - this is one of the significant holes in the entire readiness for our country. Smaller organisations have a lower level of understanding to start with, and also sometimes implementation of DPDP rules.

It's not the notice, it's not the consent, it's not about getting your system right, it's about getting your ecosystem right. Because larger organisations will take several months just to educate their ecosystem partners what it is, why is it important, even before they start to put the first process in.

Hear from the experts

The webinar goes beyond legal interpretation to focus on practical execution, helping GCC leaders, risk professionals, and privacy teams translate regulatory expectations into scalable, business-aligned operating models.

Watch now

While the large corporations in India may be ready for the new DPDP rules, the ecosystem of partners, vendors, suppliers may not be ready, this is one of the significant holes in the entire readiness for our country.

Listen on The Core

Akhilesh Tuteja in conversation with Business Standard on the new DPDP Rules.

Watch on Business Standard

Akhilesh Tuteja shares his insights on the new DPDP rules 2025 with The Core.

Watch on The Core

Akhilesh Tuteja shares his insights on the Data Protection Act in India.

Watch on CNBC TV18

Explore our DPDP insights

The DPDP Rules, 2025 bring sharper expectations around breach reporting, forensic readiness, and data protection accountability

The DPDP Act, 2023 aligns with the universal privacy principles and adds India specific expectations around clarity, purpose discipline and accountable governance