Comparison · DPDP and SPDI
DPDP Act versus the 2011 SPDI Rules: what changed
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
The SPDI Rules under Section 43A of the IT Act covered only sensitive personal data, required a privacy policy and reasonable security practices, and gave individuals a compensation claim. Section 44 of the DPDP Act removes Section 43A. The new regime covers all personal data, replaces the policy with an itemised notice, sets a statutory consent standard, adds breach clocks and a regulator, and replaces compensation with penalties.
Why the old policy fails the new test
A policy written for the SPDI Rules describes categories and practices. Rule 3 requires an itemised notice for each consent. The scanner tests a site’s notice for the DPDP concepts; eight of twenty advisor sites still carried a 2011-era policy and nothing else.
What survives
CERT-In’s incident reporting directions continue under the IT Act alongside Rule 7. Sectoral rules from the RBI, SEBI and IRDAI continue under Section 38 and Section 16(2). The ISO 27001 habit is useful evidence of Rule 6 safeguards, though it is no longer a safe harbour.
Side by side
| Point | SPDI Rules 2011 | DPDP Act 2023 |
|---|---|---|
| Data covered | Sensitive personal data: passwords, financial, health, sexual orientation, biometrics | All digital personal data (s.2, s.3) |
| Legal basis | Section 43A of the IT Act, now omitted by s.44 | A standalone Act and the DPDP Rules 2025 |
| Notice | A privacy policy on the website | An itemised notice with or before each consent request (s.5, Rule 3) |
| Consent | Required for collecting sensitive data, in writing | Statutory standard: free, specific, informed, unconditional, unambiguous, affirmative (s.6) |
| Security | Reasonable security practices, ISO 27001 as one route | Reasonable safeguards with a Rule 6 minimum: encryption, access control, one-year logs, backups |
| Breach | Report to CERT-In under separate directions | Individuals and Board without delay; report within 72 hours (s.8(6), Rule 7) |
| Grievance | Grievance officer, response within one month | Published contact, mechanism, response within stated period up to 90 days (s.8(9), 8(10), s.13, Rule 14) |
| Children | No specific rule | Under eighteen, verifiable parental consent, no tracking or targeting (s.9) |
| Enforcement | Compensation claims before an adjudicating officer | Data Protection Board; penalties up to Rs 250 crore; no compensation (s.33, Schedule) |
Questions people ask
- Is the SPDI compliance we did wasted?
- No. The security practices and the grievance officer carry forward. The policy, the consent flow and the breach procedure need rebuilding to the new standard.
- Do we still report incidents to CERT-In?
- Yes, under CERT-In’s directions, in addition to Rule 7 intimation to the Board and affected individuals.
- Can a customer still claim compensation?
- Not under the DPDP Act. Section 44 omits Section 43A; enforcement is by penalty to the Board.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.