The Digital Personal Data Protection Act, 2023 and its Rules set duties for every organisation that processes digital personal data: valid consent, clear notices, security safeguards and breach reporting. Everyday employee handling of personal data is where most of those duties are met or missed.
Our DPDP programme has two levels: Essentials for all staff and Compliance Pro for legal, privacy and compliance teams. The guide below explains the employee training gap most companies have not closed.
Quick answer
The DPDP Act 2023 makes every Data Fiduciary responsible for lawful processing, clear notices, valid consent, reasonable security safeguards and breach intimation. The Act does not name a training duty, but it requires appropriate organisational measures, and those duties are carried out by staff who handle personal data every day, so all such staff need to understand them.
DPDP Act Training courses
DPDP Essentials
Foundational course on the Digital Personal Data Protection Act 2023 - rights, obligations, and how it affects everyday work.
DPDP Compliance Pro
Advanced DPDP Act course for compliance, legal, and IT teams covering data governance frameworks, cross-border transfers, and consent architectures.
What the law requires
Digital Personal Data Protection Act, 2023: duties of Data Fiduciaries (sections 4 to 8)
Under section 4 of the Digital Personal Data Protection Act, 2023, personal data may be processed only for a lawful purpose, either with the consent of the Data Principal or for one of the "certain legitimate uses" listed in section 7. Section 7(i) covers processing for employment purposes and for safeguarding the employer from loss or liability, which is relevant to HR and internal investigations.
Section 5 requires a notice that accompanies or precedes every request for consent, setting out the personal data and purpose, how the person can exercise their rights and how to complain to the Data Protection Board. The notice must be available in English or any language in the Eighth Schedule to the Constitution. Section 6(1) says consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and limited to the data necessary for the specified purpose.
Section 8 sets the general obligations. The Data Fiduciary stays responsible for processing done on its behalf by a Data Processor (s.8(1)) and may use a processor only under a valid contract (s.8(2)). It must implement appropriate technical and organisational measures (s.8(4)), protect personal data by taking reasonable security safeguards to prevent a personal data breach (s.8(5)), and, if a breach occurs, inform the Board and each affected Data Principal (s.8(6)). It must erase data when consent is withdrawn or the purpose is no longer served, unless the law requires retention (s.8(7)), publish contact details of a Data Protection Officer or a person who can answer questions (s.8(9)), and run an effective grievance mechanism (s.8(10)).
Significant Data Fiduciaries (section 10)
Under section 10(1), the Central Government may notify a Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciaries, based on factors including the volume and sensitivity of personal data, risk to the rights of Data Principals and security of the State. A Significant Data Fiduciary must appoint a Data Protection Officer who is based in India and responsible to the Board of Directors, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and periodic audits (s.10(2)).
Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025)
MeitY notified the Digital Personal Data Protection Rules, 2025 in the Gazette of India on 13 November 2025. Rule 1 phases their commencement: Rules 1, 2 and 17 to 21 (mainly the Data Protection Board) came into force on publication; Rule 4 (Consent Managers) comes into force one year after publication, on 13 November 2026; and Rules 3, 5 to 16, 22 and 23, which contain most Data Fiduciary obligations, come into force eighteen months after publication, on 13 May 2027.
Rule 6 sets the minimum "reasonable security safeguards" behind section 8(5): measures such as encryption, masking or tokenisation, access controls, logging and monitoring to detect unauthorised access, backups for continued processing, retention of those logs and personal data for one year unless another law requires otherwise, security clauses in contracts with Data Processors, and "appropriate technical and organisational measures".
Rule 7 sets out breach intimation under section 8(6). On becoming aware of a breach, the Data Fiduciary must inform each affected Data Principal without delay, in plain language, describing the breach, its likely consequences, mitigation steps and a contact person. It must inform the Board without delay and then, within seventy-two hours of becoming aware (or a longer period the Board allows on written request), give a detailed report covering causes, mitigation, remedial measures and the intimations sent to individuals.
Rule 13 requires a Significant Data Fiduciary to carry out a Data Protection Impact Assessment and an audit once in every twelve months and to have the assessor report significant observations to the Board. Rule 14(3) requires a published grievance response period not exceeding ninety days.
Who must be trained and how often
Neither the Act nor the Rules sets a training frequency or names a mandatory audience. The legal hook is section 8(4) and Rule 6(1)(g): a Data Fiduciary must have appropriate organisational measures, and it is difficult to show those measures work if the people who collect, access or share personal data have never been told how.
Common practice, not a legal requirement, is to train all staff who handle personal data at induction and then once a year, with deeper role-based training for the privacy, legal, IT and security teams who design consent flows, handle rights requests and run breach response. Organisations usually schedule a refresher whenever internal policies change, which for most will be in the run-up to 13 May 2027.
| Audience | Suggested depth | Common practice frequency |
|---|---|---|
| All employees and contractors with access to personal data | Essentials: what personal data is, notice and consent, safe handling, spotting and reporting a breach | Induction plus annual refresher |
| HR, payroll, customer service, sales and marketing | Essentials plus role-specific scenarios (employee records, customer requests, marketing consent) | Induction plus annual refresher |
| DPO, legal, compliance, IT and security teams | Compliance Pro: Rules 6, 7 and 13, rights requests, processor contracts, breach reporting to the Board | Annual, and when the Rules or internal policies change |
Penalties and consequences
Under section 33, the Data Protection Board may impose a monetary penalty specified in the Schedule after an inquiry finds a significant breach, having regard to factors such as the nature, gravity and duration of the breach and any mitigation taken. The Schedule sets these maximums:
| Breach | Provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | Section 8(5); Schedule item 1 | Up to ₹250 crore |
| Failure to notify the Board or affected Data Principals of a personal data breach | Section 8(6); Schedule item 2 | Up to ₹200 crore |
| Breach of additional obligations for children's data | Section 9; Schedule item 3 | Up to ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary | Section 10; Schedule item 4 | Up to ₹150 crore |
| Breach of a voluntary undertaking accepted by the Board | Section 32; Schedule item 6 | Up to the amount applicable to the original breach |
| Breach of any other provision of the Act or Rules | Schedule item 7 | Up to ₹50 crore |
| Breach of the duties of a Data Principal | Section 15; Schedule item 5 | Up to ₹10,000 |
Penalties are per the Schedule to the Act and are maximums; the Board decides the amount under section 33(2).
What good DPDP Act training covers
- What counts as personal data and digital personal data, with examples from the learner's own role
- The two lawful grounds under section 4: consent and the legitimate uses in section 7, including employment
- What a valid notice and valid consent look like (sections 5 and 6), and what to do when consent is withdrawn
- Purpose limitation and erasure: why data should not be kept "just in case" (section 8(7))
- Everyday security safeguards from Rule 6: access control, encryption, logging, secure sharing and backups
- How to recognise a personal data breach and report it internally at once, given the 72-hour Board reporting window in Rule 7
- Data Principal rights (access, correction, erasure, grievance redressal, nomination) and how to route a request
- Working with vendors: the Data Fiduciary stays responsible for its Data Processors (section 8(1) and (2))
- Extra care with children's data and data of persons with a lawful guardian (section 9)
- For senior teams: Significant Data Fiduciary duties, DPIAs and annual audits (section 10 and Rule 13)
- The phased commencement dates and what changes on 13 May 2027
Our courses for this topic
| Course | Audience | Duration | Language | Format |
|---|---|---|---|---|
| DPDP Essentials | All Staff | 30 min | English | SCORM eLearning |
| DPDP Compliance Pro | Legal & Compliance | 30 min | English | SCORM eLearning |
Laws & standards covered
- Digital Personal Data Protection Act 2023 (India)
- MeitY Implementation Guidelines
- Digital Personal Data Protection Act 2023
- MeitY Draft Rules 2025
- GDPR (comparative framework)
Who it's for
- All employees
- Customer-facing teams
- HR and payroll teams
- IT and system administrators
- Chief Privacy Officers and DPOs
- Legal and compliance teams
- IT architects and engineers
- Senior management in data-intensive businesses
Guides & insights
Frequently asked questions
Does the DPDP Act legally require employee training?
No section of the Act or Rules uses the word "training". However, section 8(4) and Rule 6(1)(g) require appropriate organisational measures, and training is one of the most common ways organisations show those measures exist and work.
When do the main DPDP obligations start to apply?
Under Rule 1 of the DPDP Rules 2025, the rules on notice, security safeguards, breach intimation, retention, children's data, Significant Data Fiduciaries and Data Principal rights come into force on 13 May 2027, eighteen months after the 13 November 2025 notification. Consent Manager rules start on 13 November 2026.
How fast do we have to report a personal data breach?
Rule 7 requires intimation to the Board and to affected individuals without delay, followed by a detailed report to the Board within 72 hours of becoming aware, unless the Board allows longer on a written request. If the incident is also a cyber incident under the CERT-In Directions of 28 April 2022, CERT-In has a separate 6-hour reporting window.
Does the DPDP Act cover employee personal data?
Yes. Employee data is digital personal data when processed in digital form. Section 7(i) lets an employer process it without consent for employment purposes, but the security, breach and other section 8 duties still apply.
We are not a Significant Data Fiduciary. Do we still need a Data Protection Officer?
The duty to appoint a DPO under section 10(2) applies only to notified Significant Data Fiduciaries. Every Data Fiduciary must still publish contact details of a person who can answer questions about its processing (section 8(9) and Rule 9).
Who should take Essentials and who should take Compliance Pro?
[DPDP Essentials](/courses/dpdp-essentials) suits anyone who handles personal data in their job. [DPDP Compliance Pro](/courses/dpdp-compliance-pro) is for DPOs, legal, compliance and IT teams who design processes, handle rights requests and run breach response.
Which DPDP Act Training courses does Compliance at Workplace offer?
DPDP Essentials (30 min, for All Staff); DPDP Compliance Pro (30 min, for Legal & Compliance).
Which laws and standards does DPDP Act Training cover?
Digital Personal Data Protection Act 2023 (India); MeitY Implementation Guidelines; Digital Personal Data Protection Act 2023; MeitY Draft Rules 2025; GDPR (comparative framework).
Who should take DPDP Act Training?
All employees, Customer-facing teams, HR and payroll teams, IT and system administrators, Chief Privacy Officers and DPOs, Legal and compliance teams, IT architects and engineers, Senior management in data-intensive businesses.
Can the DPDP Act Training be customised to our organisation?
Yes. Every course can be customised to your policies, branding and industry scenarios, and delivered on your LMS as SCORM or on our Compliance Central platform.
Sources
- Digital Personal Data Protection Act, 2023 (Gazette of India, published by MeitY)
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025 (MeitY)
- Digital Personal Data Protection Act, 2023 on India Code
- CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022
Last updated by the Compliance at Workplace Editorial Team.