With ₹250 crore penalties looming, the DPDP Act 2023 changes how data is handled. Learn the roadmap to meet the 2027 deadline and protect your business.

The Digital Personal Data Protection Act of 2023 is a watershed moment for India, shifting privacy from a legal annoyance to a systemic business risk where accountability cannot be outsourced and penalties for a single breach can reach ₹250 crore.
The implementation follows a phased roadmap that began on November 13, 2025, with the establishment of the Data Protection Board of India. The next major milestone occurs in November 2026, when the "Consent Manager" framework goes live, allowing intermediaries to help users manage permissions. The final "Big Bang" deadline is May 13, 2027, at which point all core conduct rules, including itemized notice requirements and the 72-hour breach notification window, become fully enforceable.
A Data Fiduciary is the entity that decides the "why" and "how" of data processing, determining its purpose and means. A Data Processor is a third party that handles data only on the instructions of the Fiduciary. Crucially, under the Act, accountability cannot be outsourced; the Data Fiduciary remains primarily liable for any security breaches or violations, even if they occur at the Processor level, and can face penalties of up to ₹250 crore.
The Act mandates that consent must be free, specific, informed, unconditional, and unambiguous, requiring a "clear affirmative action" from the individual. This means pre-ticked boxes and bundled consent—where multiple permissions are grouped under one button—are no longer permitted. Additionally, privacy notices must be "itemized" in plain language and made available in English and all 22 official languages listed in the Indian Constitution.
In India, anyone under the age of 18 is considered a child under the DPDP Act. Data Fiduciaries must obtain "verifiable parental consent" before processing a child's data and are strictly prohibited from engaging in tracking, behavioral monitoring, or targeted advertising directed at children. Violating these protections is considered a high-tier offense, with potential fines reaching up to ₹200 crore.
The government can designate certain entities as Significant Data Fiduciaries based on the volume of data they process or the risks they pose to the state or democracy. These organizations face stricter governance requirements, including the mandatory appointment of an India-based Data Protection Officer who reports to the Board, the hiring of an independent data auditor, and the regular performance of Data Protection Impact Assessments (DPIAs) to evaluate risks associated with their processing and algorithms.
From Columbia University alumni built in San Francisco
"Instead of endless scrolling, I just hit play on BeFreed. It saves me so much time."
"I never knew where to start with nonfiction—BeFreed’s book lists turned into podcasts gave me a clear path."
"Perfect balance between learning and entertainment. Finished ‘Thinking, Fast and Slow’ on my commute this week."
"Crazy how much I learned while walking the dog. BeFreed = small habits → big gains."
"Reading used to feel like a chore. Now it’s just part of my lifestyle."
"Feels effortless compared to reading. I’ve finished 6 books this month already."
"BeFreed turned my guilty doomscrolling into something that feels productive and inspiring."
"BeFreed turned my commute into learning time. 20-min podcasts are perfect for finishing books I never had time for."
"BeFreed replaced my podcast queue. Imagine Spotify for books — that’s it. 🙌"
"It is great for me to learn something from the book without reading it."
"The themed book list podcasts help me connect ideas across authors—like a guided audio journey."
"Makes me feel smarter every time before going to work"
From Columbia University alumni built in San Francisco
