Digital Personal Data Protection Act, 2023
Make data protection understandable.
Make readiness actionable.
CYBER CIBIL helps Indian businesses read the DPDP Act without jargon, see what it means for their sector, and build readiness step by step — before the main duties commence on 13 May 2027.
Check your
Cyber CIBIL Report
Find the gaps. See the priorities. Move forward.
Get my FREE report →No sign-up · Answers stay in your browserUnderstand the exposure
Five categories. Clear consequences.
Explore the statutory maximum for each category. Select a colored segment or a category to see what it means.
Category maximums, not automatic fines or sector-specific rates. The Board determines penalties after an inquiry. Ring segments represent categories, not proportions or cumulative exposure. Full penalties explorer →
What we do
Compliance help that starts with understanding
CYBER CIBIL provides advisory, technical assessment, and governance workflows to help Indian enterprises navigate the Digital Personal Data Protection Act with complete clarity.
Understand the Act
The DPDP Act, without the jargon
Twelve clickable explainers — who it covers, consent and legitimate uses, notices, rights, security safeguards, breach response, children's data and more. Every legal claim linked to its official source.
Who the Act covers
Digital personal data, in India and beyond — and what stays outside the Act.
Read the explainerConsent & legitimate uses
When you need consent, when you don't, and what valid consent requires.
Read the explainerRights & safeguards
Access, correction, erasure, grievance redressal — and the safeguards behind them.
Read the explainerChildren & SDFs
The strictest rules in the Act — under-18 data and Significant Data Fiduciaries.
Read the explainerSector explorer
What does DPDP mean for your sector?
Typical data flows, an illustrative failure scenario, the duty it touches and its statutory maximum penalty category — for six sectors. Sector examples are illustrative; the Act sets no sector-specific penalty rates.
🏦 BFSI
KYC and onboarding data, retention beyond purpose, bureau and processor flows.
Explore BFSI →🩺 Healthcare
Patient records, diagnostics access control and breach-notification paths.
Explore healthcare →🛒 E-commerce
Consent withdrawal that actually propagates, retention and deemed erasure.
Explore e-commerce →🎓 Education / EdTech
Under-18 users, verifiable parental consent, and the tracking ban.
Explore education →☁️ SaaS
Fiduciary vs processor roles, tenant chains and breach-notification duties.
Explore SaaS →💼 HR
Which workforce uses are legitimate, retention of exit records, vendor leaks.
Explore HR →Proof, when it exists
Client proof
Case studies and enterprise compliance milestones are shared under mutual non-disclosure and published here only with explicit permission.
We publish only real, permissioned proof — no invented clients, certifications, testimonials or regulatory endorsements, ever.
Start this week
Start where the law starts: with understanding.
Walk the Act, map your sector, run the self-assessment — then book a readiness call and turn the checklist into a plan.