ICN — Integrated Cyber Nexus CYBER CIBIL

Digital Personal Data Protection Act, 2023

Make data protection understandable.
Make readiness actionable.

CYBER CIBIL helps Indian businesses read the DPDP Act without jargon, see what it means for their sector, and build readiness step by step — before the main duties commence on 13 May 2027.

Explore the DPDP Act
Legal content verified against official sources — last verified 25 September 2026 Main duties & penalties: 13 May 2027
FREE READINESS REPORT

Check your
Cyber CIBIL Report

Find the gaps. See the priorities. Move forward.

Get my FREE report →No sign-up · Answers stay in your browser
Time to prepare: … until the DPDP Act's main duties and penalty regime commence on 13 May 2027. The Board and Rules machinery is already in force. See the phased timeline.
A practical path to readiness

What we do

Compliance help that starts with understanding

CYBER CIBIL provides advisory, technical assessment, and governance workflows to help Indian enterprises navigate the Digital Personal Data Protection Act with complete clarity.

Understand the Act

The DPDP Act, without the jargon

Twelve clickable explainers — who it covers, consent and legitimate uses, notices, rights, security safeguards, breach response, children's data and more. Every legal claim linked to its official source.

Who the Act covers

Digital personal data, in India and beyond — and what stays outside the Act.

Read the explainer

Consent & legitimate uses

When you need consent, when you don't, and what valid consent requires.

Read the explainer

Rights & safeguards

Access, correction, erasure, grievance redressal — and the safeguards behind them.

Read the explainer

Children & SDFs

The strictest rules in the Act — under-18 data and Significant Data Fiduciaries.

Read the explainer

Sector explorer

What does DPDP mean for your sector?

Typical data flows, an illustrative failure scenario, the duty it touches and its statutory maximum penalty category — for six sectors. Sector examples are illustrative; the Act sets no sector-specific penalty rates.

🏦 BFSI

KYC and onboarding data, retention beyond purpose, bureau and processor flows.

Explore BFSI →

🩺 Healthcare

Patient records, diagnostics access control and breach-notification paths.

Explore healthcare →

🛒 E-commerce

Consent withdrawal that actually propagates, retention and deemed erasure.

Explore e-commerce →

🎓 Education / EdTech

Under-18 users, verifiable parental consent, and the tracking ban.

Explore education →

☁️ SaaS

Fiduciary vs processor roles, tenant chains and breach-notification duties.

Explore SaaS →

💼 HR

Which workforce uses are legitimate, retention of exit records, vendor leaks.

Explore HR →

Penalties, honestly told

₹250 crore to ₹50 crore — maximums, not predictions

The Act's Schedule sets statutory maximums for five categories of violation. The Board determines any penalty after an inquiry — nothing is automatic, and a breach alone is not proof of failure.

₹250 cr

Security safeguards failure

 ₹200 cr

Breach-notification failure

 ₹200 cr

Children's-data breach

 ₹150 cr

SDF-obligations breach

 ₹50 cr

Any other breach
The DPDP Act does not set separate penalty rates for each sector. These are statutory maximums for violation categories, not predicted or automatic fines. Open the penalties explorer.

Proof, when it exists

Client proof

Case studies and enterprise compliance milestones are shared under mutual non-disclosure and published here only with explicit permission.

We publish only real, permissioned proof — no invented clients, certifications, testimonials or regulatory endorsements, ever.

Start this week

Start where the law starts: with understanding.

Walk the Act, map your sector, run the self-assessment — then book a readiness call and turn the checklist into a plan.

Book a Readiness Call Take the self-assessment