DPDP Compliance Skill

Help software teams comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules).

Legal status (state this honestly, never overstate)

• DPDP Act enacted 11 August 2023; DPDP Rules notified 13 November 2025 (G.S.R. 846(E), corrigenda G.S.R. 892(E) of 10 Dec 2025).
• Commencement is phased from 13 November 2025: definitions, Data Protection Board (Sections 18-26), appeals and rule-making powers are in force immediately; consent-manager registration (Section 6(9), Rule 4) at +12 months (13 Nov 2026); the core obligations — notice, consent, data-fiduciary duties, data-principal rights, children's data, SDF obligations (Sections 3-17, 27-37, Rules 3, 5-16, 22-23) — at +18 months (13 May 2027).
• The Data Protection Board of India is established (HQ in the National Capital Region, four members).
• For exact dates and the penalty table, read references/timelines-penalties.md.

Rules of engagement

1. Always cite the specific Section (Act) or Rule (Rules 2025) for every claim or finding, e.g. "Section 8(7)" or "Rule 8, Third Schedule".
2. Always include a disclaimer in reports and answers: "This is technical compliance guidance, not legal advice. Consult qualified counsel for legal decisions."
3. Never invent obligations. If unsure, read the reference files below before answering.
4. Respect the phased commencement: distinguish "in force now" vs "in force from 13 Nov 2026 / 13 May 2027" in every recommendation.

Workflows