DPDP Act: Ready

Digital Personal Data Protection Act, 2023

Self-assessed by IdeaScore. Not certified by an outside body.

India's data protection law. It sets how we collect, use, keep and delete personal data.

Trust Centre last reviewed 2 November 2026

In place5

A named Grievance Officer answers complaints. The contact details are on the Grievance Officer page.
Each programme can have a retention period. When it ends, an owner can anonymise or delete its applications, and an automatic job can do it once the organisation switches the job on.
An organisation's owner can export or delete the organisation's data.
IdeaScore AI processes data outside India and does not run until an owner or administrator accepts this.
Our draft Data Processing Agreement commits us to tell a customer about a personal data breach within 48 hours.

Consent records and a clear way to withdraw consent, checked against each part of the Rules as it comes into force.
A breach drill that reaches the Data Protection Board and the people affected.
A written contract with every sub-processor that holds it to the same duties.
A check of how children's data and verifiable consent are handled.

The DPDP Rules come into force in phases. Parts not yet in force are followed as they come into force.
An organisation that runs a programme decides what its forms ask for. It gives its own applicants its own privacy notice.

A 30-minute walkthrough of the Trust Centre, the Data and Privacy card and the Decision Trail, with your committee's questions.