DPDP Act PDF: where to download the Act, the Rules 2025, and everything in between

Download the official PDFs

Go straight to the source. These are the government-published versions — always prefer these over a random third-party upload, because unofficial copies can be outdated or altered.

The Act itself — the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023):

The subordinate rules — the Digital Personal Data Protection Rules, 2025 (notified 14 November 2025):

A tip: the Act and the Rules are two separate documents. You almost always need both — the Act sets the principles and the Rules tell you how to actually comply. See how they fit together in our guide to the DPDP Rules 2025.

“DPDP Act 2025” and “DPDP Act 2026” — clearing up the confusion

This trips up almost everyone, so let's settle it. There is no such thing as the “DPDP Act 2025” or the “DPDP Act 2026.” India has exactly one data protection statute, and it's the Digital Personal Data Protection Act, 2023 — passed by Parliament and given Presidential assent on 11 August 2023. The year in the name is 2023, and it hasn't changed.

So why do people search for 2025 and 2026? Two reasons:

• "DPDP 2025" almost always means the DPDP Rules, 2025 — the subordinate legislation that was notified on 14 November 2025. The Rules are new; the Act is not.
• "DPDP 2026" usually reflects when the law bites for businesses — several key obligations phase in through 2026 and into 2027 — rather than a new Act. There is no separate 2026 statute.

Bottom line: download the Act of 2023 and the Rules of 2025, and you have the complete, current legal package. If you see a “DPDP Act 2026 PDF” floating around, treat it with suspicion.

Bare Act, Act-and-Rules, or a summary — which PDF do you need?

The version you want depends on why you're reading it:

• The Bare Act — the raw statutory text of the DPDP Act, 2023, section by section, with no commentary. This is what lawyers and compliance teams cite. The India Code and MeitY links above are the bare act.
• The Act and Rules together — the Act (2023) plus the Rules (2025). This is the combination you need for actual compliance work, because the Rules contain the operational detail (consent notices, security, breach timelines) the Act only gestures at.
• A summary PDF — a plain-English digest of what the law requires. Great for briefing a board or a non-legal team. Our own guides below are written to serve exactly this purpose, and you can save any of them as a PDF from your browser.

If you only have time for one thing, read the bare Act once for the principles, then work from the Rules and a good checklist for the day-to-day. Our DPDP compliance checklist is built for that.

DPDP Act gazette notification — the dates that matter

“Gazette notification” is just the formal act of publishing a law in the Gazette of India, which is what makes it official. Here's the timeline in plain terms:

• 11 August 2023 — the DPDP Act, 2023 receives Presidential assent and is published in the Gazette. The Act exists in law from this point, but most of it wasn't yet in force.
• 14 November 2025 — MeitY notifies the DPDP Rules, 2025 in the Gazette, and brings the commencement provisions of the Act into force. This is the date the compliance clock genuinely starts.
• 14 November 2026 — the next phase: Consent Manager registration and the Data Protection Board's oversight of them take effect (about 12 months after notification).
• Around 14 May 2027 — the big one: notice-and-consent, breach reporting, security safeguards, children's-data rules, Significant Data Fiduciary obligations and cross-border transfer rules all take full effect (about 18 months after notification).

For the full breakdown of what happens when, see our DPDP Act enforcement date & timeline guide.

What's inside the DPDP Act, 2023 (a 60-second summary of the PDF)

If you're about to open the PDF, here's the map. The Act is short by data-law standards and organised around a few big ideas:

• Consent and notice — you need a clear, specific, informed consent to process someone's personal data, and a notice that explains what and why.
• Data Principal rights — individuals can access, correct, and erase their data, and nominate someone to act for them.
• Data Fiduciary duties — whoever decides how and why data is processed must protect it, keep it accurate, delete it when done, and report breaches.
• Significant Data Fiduciaries — larger or higher-risk organisations get extra duties: a Data Protection Officer in India, impact assessments and independent audits.
• The Data Protection Board of India — a digital-first regulator that handles complaints and imposes penalties.
• Penalties — financial penalties up to ₹250 crore for the most serious failures (more below).

What's inside the DPDP Rules, 2025

The Rules are where the Act becomes operational. In the PDF you'll find the detail on:

• the form and content of consent notices, including India's scheduled languages;
• how Consent Managers register and operate;
• what "reasonable security safeguards" actually means — encryption, access control, logging, backups;
• breach-notification obligations and timelines to the Board and affected individuals;
• data retention and erasure defaults;
• verifiable parental consent for children's data;
• the extra obligations that fall on Significant Data Fiduciaries.

We break all of this down in the DPDP Rules 2025 guide.

What it'll cost you to get it wrong

One reason people download the Act is to check the penalties — and they're serious. The Schedule sets financial penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for breach-notification and children's-data failures, and up to ₹150 crore for Significant Data Fiduciary lapses. The full breakdown is in our DPDP Act penalties guide.

Does the DPDP Act apply to you?

Before you spend a weekend with the PDF, it's worth checking whether — and how — the law reaches your organisation. It applies to digital personal data processed in India, and to processing outside India that offers goods or services to people in India, with some exemptions. Our who does the DPDP Act apply to guide walks through the scope, and if you operate AI systems, the AI regulation in India landscape shows how DPDP sits alongside MeitY and RBI rules.

How AramGRC helps

Reading the PDF is the easy part; turning it into compliance is the work. AramGRC maps your data flows and systems against the DPDP Act and the 2025 Rules, finds the gaps, and gives you a prioritised, India-ready roadmap to close them before enforcement — so you're not scrambling in 2027. It also connects cleanly to your wider AI governance programme.