DPDP vs the Old SPDI Rules: What Actually Changed

The Digital Personal Data Protection Act 2023 (DPDP) replaces the narrower, older SPDI Rules under the IT Act with a broader law covering all personal data, stronger consent mechanics, and far higher penalties - though its substantive obligations only become enforceable from 13 May 2027.

Key facts at a glance

• The old SPDI Rules covered only "sensitive personal data" (passwords, financial data, health data, biometrics); DPDP covers all personal data.
• DPDP's Consent Manager registration framework (Rule 4) becomes operational 13 November 2026.
• DPDP's full substantive obligations become enforceable 13 May 2027, with no stated grace period after that date.
• DPDP penalties can reach up to Rs 250 crore per instance for failing to implement reasonable security safeguards.
• The Data Protection Board of India provisions under DPDP took effect immediately upon notification.
• SPDI Rules obligations were narrower and did not include a dedicated regulator like the Data Protection Board.
• DPDP introduces data-principal rights (access, correction, erasure) that the SPDI Rules did not provide in comparable form.

Why SPDI Existed and What It Actually Required

The SPDI Rules (Sensitive Personal Data or Information Rules), notified under the Information Technology Act, were India's main data-protection instrument before DPDP. They applied narrowly: only to "sensitive personal data" such as passwords, financial information, health records, biometric data and sexual orientation, and only to body corporates. Businesses needed a privacy policy, had to obtain written consent before collecting sensitive data, and had baseline security-practice obligations, but the framework had no dedicated regulator and comparatively limited enforcement teeth.

What DPDP Changes

DPDP is a purpose-built data-protection law, not an IT Act appendage. It covers all personal data (not just "sensitive" categories), applies to any entity - "data fiduciary" - that determines the purpose and means of processing personal data of individuals in India, and establishes the Data Protection Board of India as a dedicated enforcement body. It introduces defined data-principal rights, a structured consent architecture including registered Consent Managers, mandatory breach notification, and a much higher penalty ceiling.

Side-by-Side Comparison

What This Means for a Business That Was Already SPDI-Compliant

Being SPDI-compliant is a reasonable starting point but not sufficient under DPDP. A business that only had a privacy policy and consent capture for sensitive data now needs to map all personal data it processes (not just sensitive categories), build a compliant consent and notice flow, prepare for breach notification obligations, and be ready for a materially higher penalty exposure if security safeguards are inadequate.

The Compliance Runway You Actually Have

Because full DPDP obligations become enforceable only from 13 May 2027, and the Consent Manager framework activates 13 November 2026, businesses have a defined window to close gaps rather than facing an overnight requirement. That runway is a planning advantage, not a reason to delay - security safeguards, consent flows and data mapping typically take longer to implement properly than businesses expect.

If you are not sure how your current data practices compare to DPDP requirements, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.

Sources

• Ministry of Electronics and Information Technology, DPDP Act and Rules - meity.gov.in
• Data Protection Board of India
• Ministry of Electronics and Information Technology, IT Act and SPDI Rules - meity.gov.in

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.