Regulayer™  /  The 156 laws  /  Privacy law

India · DPDP Act, 2023

Data-fiduciary records & breach intimation.

Applies to: Data fiduciaries processing Indian personal data. Built · Consent Manager registration 13 Nov 2026 · major obligations 13 May 2027

What the signed record shows

Processing records, consent signals, breach detail, and notice records.

The proof is a signed, tamper-evident record. Anyone can check it, without an account, and nothing has to leave the building to make it. Evidence, not a promise.

Citation: Act No. 22 of 2023 ss. 5/6/8/11/27; DPDP Rules 2025

In the same family

GDPR · Article 22Safeguards on automated decisionsHIPAA · Security RuleAudit controls over ePHIIllinois · BIPABiometric consent & handling

What to do about it

A signed record of which AI you used and what you checked, sealed to the exact file you deliver, made on your own machine and checkable free by anyone you send it to.

Or verify a real record →

Part of the Regulayer™ proof catalogue: 156 laws and standards, one sealed engine. This page is a product description, not legal advice.

What the statute requires, section by section

Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). Provisions addressed:

s. 8
General obligations of a Data Fiduciary: 8(5) reasonable security safeguards; 8(6) intimation of a personal data breach to the Data Protection Board and each affected Data Principal; 8(7) erasure on withdrawal / purpose completion.
s. 6
Consent (free, specific, informed, unconditional, unambiguous; right to withdraw).
s. 5
Notice (itemized content of the notice given to the Data Principal).
s. 11
Right of a Data Principal to access information about personal data.
s. 27
Powers of the Data Protection Board (inquiry into breaches; remedial measures; penalties). The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), notified 13 November 2025) commence in three tranches under Rule 1(2): Rules 1, 2 and 17 to 21 on publication; Rule 4, Consent Manager registration, on 13 November 2026; and Rules 3, 5 to 16, 22 and 23, the major operational obligations, on 13 May 2027. Minimum log retention is 1 year.

Taken from the Regulayer™ entry for this instrument, which is built against the primary text.