India's Digital Personal Data Protection Act makes every organisation that handles personal data accountable for it. C24Fiduci helps you map your data, manage consent, answer requests, handle breaches and train your people, with the evidence ready when the Board asks.
Passed by Parliament in August 2023, the Digital Personal Data Protection Act sets the rules for how organisations collect, use, store and share the digital personal data of people in India. The DPDP Rules were notified on 13 November 2025.
The person the data is about: your customers, employees and users.
Decides why and how data is used. That's most businesses, and the duties sit here.
Processes data on the Fiduciary's behalf, such as a payroll or cloud vendor.
Enforces the law, investigates breaches and imposes penalties.
If your business decides how personal data is used, you are a Data Fiduciary, and you stay accountable even when a vendor does the processing.
Per instance, for failing to take reasonable security safeguards to prevent a breach.
To the Data Protection Board, plus prompt notice to every affected person.
Reputational damage lasts far longer than any fine.
From the first data map to the last erasure request.
Record what personal data you hold, why you hold it, where it flows and which processors touch it.
Purpose limitation & minimisationClear notices, consent records for every purpose, and withdrawal as easy as giving consent.
Notice & consentAccess, correction, erasure and grievance requests, each tracked against its deadline.
Rights of Data PrincipalsLog incidents, run the 72-hour clock, and prepare the Board report and user notices.
Breach notificationRetention periods per purpose, with reminders to delete data once the purpose is served.
Retention & erasureDPDP lessons and phishing simulations from Ciqur24's C24Aware, so your people become your first line of defence.
Reasonable security safeguardsConsent records, request logs, breach reports, training completion and a full audit log, all in one place.
What the law is, why it matters, and how C24Fiduci helps you comply.
If you process digital personal data of people in India, or process data outside India to offer goods or services to people in India, it very likely applies. Most businesses are Data Fiduciaries.
The DPDP Rules were notified on 13 November 2025 with a phased roll-out. Most obligations, including notice, consent, security safeguards, breach reporting and Data Principal rights, apply from 13 May 2027.
You must inform the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours of becoming aware of the breach.
C24Aware is Ciqur24's security awareness and phishing simulation platform. Its DPDP training and completion records feed into C24Fiduci as evidence of staff training.
No. C24Fiduci helps you run and evidence your DPDP compliance programme. Please consult your legal team on your full obligations.
See C24Fiduci on your own data flows in a free 30-minute demo.
Book a free demo