Written for the person who has to implement it. Exact sections, exact Rules, the maximum penalty attached to each, and an honest note on which part of Safexa addresses it — including where nothing does. Nothing here is legal advice; all of it is checkable against the bare Act and Rules.
The Act received assent in August 2023 but almost none of it commenced. The Rules, notified on 13 November 2025, set the actual clock — and it runs in three stages.
From that date, notice, consent, Data Principal rights, security safeguards, breach reporting, retention and children's data are live and enforceable.
Sections cite the Act; Rules cite the DPDP Rules, 2025. Penalties are the maxima in the Schedule — they are per contravention and cumulative.
| Section / Rule | What it requires | Max penalty | Safexa |
|---|
Not exhaustive and not legal advice. It covers the obligations that fall on a Data Fiduciary in ordinary commercial processing; State processing under Section 17, exemptions under Section 7, and the Consent Manager regime under Rule 4 are out of scope here.
Nobody in India is. Registration under Rule 4 does not open until 13 November 2026, and the Board has to grant it. A Consent Manager is also a fundamentally different animal: accountable to the Data Principal rather than to you, required to run a consumer app, unable to read the data it brokers, and barred from simultaneously acting as your Data Processor.
It does not. Section 16 is a negative-list regime — transfer is permitted except to countries the Central Government restricts. Localisation obligations are real, but they come from IRDAI, RBI and your own board policy. A vendor who cites DPDP for it has not read Section 16.
A keyed hash whose secret sits in the same system is pseudonymous, not anonymous — it remains personal data on a strict reading. Real erasure means destroying the key that can re-link the record. Ask any vendor what specifically they destroy, and where that key lives.
Those are the conversations worth having before anyone signs anything.
Or email safexa@teknowxa.com directly — a person reads it.