DPDP Act Compliance: India's Data Protection Law in Practice

It is a free-to-learn course on India's Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified on 13 November 2025. It covers who the law applies to, consent and legitimate uses, notices, rights, children's data, security and breach response with CERT-In's six-hour rule, retention, processors, transfers, Significant Data Fiduciary duties, the Data Protection Board and penalties, and how to build a compliance programme.

In three stages counted from 13 November 2025: the definitions, the Data Protection Board and rule-making provisions started that day; the Consent Manager provisions start on 13 November 2026; and the main duties, including notice, consent, security safeguards, breach notice, children's data and rights, start on 13 May 2027. A proposal to shorten the timeline was discussed in 2026, so check the e-Gazette for any amendment.

Compliance officers, IT and information security staff, HR, legal and operations teams, founders, consultants and graduates who want to work as privacy or data protection officers in India. No legal background is needed.

No. It explains the DPDP Act, the DPDP Rules 2025 and related directions in plain language for practical compliance work, with dates and penalties checked against the official texts in October 2026. For a decision about your own organisation, take advice from a qualified lawyer and check the current notifications.

About 14 hours of video and around 19 hours in total with notes, worked problems and practice tasks, at your own pace. Every module, the notes, the project and the final assessment are free to learn.

A verifiable certificate of completion from EDWartens, issued when you finish the modules and pass the 15-question final at 60 percent. It has a unique number, a QR code and a public verification page showing the course, the modules covered and your score. It is not a government or Data Protection Board certification.

The Schedule sets maximums by type of breach: up to 250 crore rupees for failing to take reasonable security safeguards, up to 200 crore for failing to notify a breach, up to 200 crore for breaching the children's data duties, up to 150 crore for Significant Data Fiduciary duties, and up to 50 crore for other breaches. The Data Protection Board sets the actual amount after an inquiry, weighing factors such as gravity, mitigation and proportionality.

It builds the working knowledge used by data protection officers, privacy analysts, compliance executives and information security staff who will run DPDP programmes as the main duties start in May 2027. Pair it with the ISO 27001 ISMS course if your role also covers information security management.

Yes. Learning costs ₹0 in India: every module, the written notes, the practice tasks and the final assessment, with no card and no trial period. The only paid item is the optional EDWartens Certificate of Completion, ₹499 including GST for this beginner course, paid in rupees through Razorpay, and only if you want it after passing the final assessment.