Is DPDP training mandatory? What the Act and Rules expect from employers

Short answer: not by name. Neither the DPDP Act nor the DPDP Rules sets out a training course that every employer must run. But the Digital Personal Data Protection Act, 2023 does require every Data Fiduciary to take reasonable security safeguards and “appropriate technical and organisational measures”, and Rule 6 of the DPDP Rules, 2025 repeats that duty. Training your people, and keeping records that prove it, is the most practical way to show you have met it. Commercial banks, insurers, SEBI-regulated entities and some NBFCs already face explicit security training rules from their regulators.

Below: what the law says, where sector rules go further, who to train, how often, and what to record. Where we interpret rather than quote the law, we say so.

What does the DPDP Act say about training?

Nothing directly. The word “training” does not appear in the Act. Instead, section 8 places broad duties on every Data Fiduciary (the organisation that decides why and how personal data is processed) that are hard to meet without it:

• Section 8(1): you are responsible for complying with the Act for processing done by you or on your behalf by a Data Processor, whatever your contracts say.
• Section 8(4): you must “implement appropriate technical and organisational measures to ensure effective observance” of the Act and the Rules.
• Section 8(5): you must protect personal data in your possession or control, including data your processors handle, “by taking reasonable security safeguards to prevent personal data breach”.
• Section 8(6): if a breach happens, you must inform the Data Protection Board and each affected person.

These duties carry the Act’s largest penalties. Under the Schedule, failing to take reasonable security safeguards can attract up to ₹250 crore, and failing to notify a breach up to ₹200 crore. These are ceilings, not fixed fines: under section 33, the Board penalises only after an inquiry finds a significant breach, weighing factors such as the breach’s nature and duration and whether you acted promptly and effectively to limit the damage.

Being small does not take you outside the security duty. Section 17(3) lets the government exempt notified Data Fiduciaries, including startups, from some provisions, but sections 8(4) and 8(5) are not among them. Even the wider exemptions in section 17(1) leave sections 8(1) and 8(5) in place.

By contrast, Article 39 of Europe’s GDPR lists “awareness-raising and training of staff” among a Data Protection Officer’s tasks. India’s Act has no such wording.

Do the DPDP Rules, 2025 mention training?

Not by name either. The Rules were notified on 13 November 2025 (G.S.R. 846(E)). Rule 6 lists what reasonable security safeguards must include “at the minimum”:

1. data security measures such as encryption, obfuscation, masking or virtual tokens;
2. access control over the computer resources used by you and your processors;
3. visibility of access through logs, monitoring and review, so unauthorised access can be detected, investigated and fixed;
4. measures such as backups so processing can continue if data is compromised;
5. keeping those logs and the related personal data for one year, unless another law requires otherwise;
6. security clauses in your contracts with Data Processors; and
7. “appropriate technical and organisational measures to ensure effective observance of security safeguards”.

The last item, Rule 6(1)(g), is where training fits. It does not mention training, and it sets no syllabus or frequency. The same phrase appears in Rule 14(3), which requires a published grievance response period of no more than 90 days, backed by technical and organisational measures.

Rule 7 adds the breach clock. Once you become aware of a breach, you must inform affected people and the Board without delay, then send the Board a detailed report within 72 hours. That report must cover, among other things, the reasons that led to the breach and “any findings regarding the person who caused the breach”.

When do these duties apply?

Not yet. Under the government’s commencement notification, section 8 of the Act and Rules 6, 7 and 14 come into force 18 months after the Rules were notified, which most commentators put at 13 May 2027. In January 2026, MeitY sought industry views on shortening some timelines, so check MeitY’s website for the current position before you plan around a date.

Why do employers treat training as required anyway?

This section is our interpretation, not the text of the law.

• Safeguards fail through people. Rule 6 asks for access control, logging and encryption. A shared password, a lab report forwarded on WhatsApp or a KYC scan left in a Downloads folder gets round all three. “Organisational measures” covers how people behave, and the usual way to shape behaviour is a written policy plus training.
• Your staff start the breach clock. The 72-hour report runs from when you become aware of a breach. If a sales executive does not recognise a misdirected email as a breach, or does not know whom to tell, the deadline can be close before anyone senior hears about it.
• You will need evidence. If the Board inquires into a breach, you will want to show what you did beforehand. A training plan, completion records and quiz results can be produced; “everyone knows the rules” cannot.

Training alone does not make you compliant. It works alongside technical controls, policies, processor contracts and a breach response plan. Without it, though, the people side of Rule 6 is hard to prove.

What does the law say, and what does it mean for training?

The right-hand column is our reading, not the law’s wording.

Which sector rules already require training?

If RBI, SEBI or IRDAI regulates you, check your sector’s cyber security rules first: several already require training in plain words. None is a DPDP rule as such, but a DPDP module can run within the same programme.

• Commercial banks (RBI). RBI’s Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 for commercial banks, issued on 31 July 2026, make cybersecurity awareness programmes mandatory for all new recruits. They also require annual training for lower and middle management, and for all Board members and senior management (paragraphs 203 and 204). Separate versions were issued the same day for other entities, such as small finance banks and urban co-operative banks; check the one that applies to you.
• NBFCs (RBI). The NBFC version requires base-layer NBFCs with assets of ₹500 crore and above to run an ongoing information security training and awareness programme for all users. They must measure its effectiveness through periodic assessments and keep an up-to-date record of every user’s training status (paragraphs 35 and 36).
• SEBI-regulated entities. SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) of 20 August 2024 requires mandatory awareness programmes for employees and a dedicated programme for Board members. It lists the cybersecurity training programme as an annual activity for all regulated entities.
• Insurers and intermediaries (IRDAI). The IRDAI Information and Cyber Security Guidelines, 2026, dated 6 April 2026, require training and awareness programmes for all employees, contractors and relevant third-party users. Each organisation must define how often staff attend, track attendance and keep the history and versions of its training content.
• Most organisations (CERT-In). CERT-In’s directions of 28 April 2022 do not mandate training, but they require body corporates and others to report listed cyber incidents, including data breaches and data leaks, within six hours of noticing them. Staff must escalate quickly.
• ISO/IEC 27001. A voluntary standard, not law. For certified organisations, Annex A control 6.3, “Information security awareness, education and training”, covers job-relevant training for staff and relevant outside parties.

Who in your organisation should be trained?

The Act does not list roles. In our view, train anyone who can see, change, export or delete personal data, plus those who decide how it is handled:

• front-line staff who collect data, such as reception, sales, customer support, collections and admissions;
• HR and payroll teams, because employee records are personal data under the Act too;
• IT staff, system administrators and developers, who need deeper modules on access control, logging and secure handling;
• managers and the leadership team, who approve purposes, vendors and budgets;
• your breach response team and whoever answers Data Principals’ questions (the Data Protection Officer, for a Significant Data Fiduciary);
• new joiners, at induction and before they get system access; and
• vendors and contractors who act as your Data Processors, through your contracts with them.

Not everyone needs the same depth. A short module for all staff, with longer role-based paths for high-risk roles, keeps training proportionate.

How often should employees be trained?

The DPDP Act and Rules do not set a frequency. Good practice, and the benchmark in regulated sectors, looks like this:

• At induction, before anyone gets access to personal data. RBI’s directions for commercial banks make awareness training mandatory for new recruits.
• An annual refresher for all staff. SEBI’s framework and RBI’s bank directions both set annual training cycles.
• When something changes, such as a new role, a new system, a breach or near miss, or a change in the law. The start of the main DPDP obligations in May 2027 is one such trigger.

Short refreshers through the year, such as a five-minute scenario on a misdirected email, keep the annual course from being a one-off. Test understanding with a quiz, not attendance alone.

What training records should you keep?

If the Board, an auditor, a client or a regulator asks you to show your organisational measures, this is the file you will reach for. The checklist draws on what IRDAI and RBI already require of their regulated entities; for everyone else it is good practice.

• A training policy or plan setting out who must complete which module, and how often.
• A map of roles to modules, showing why each group gets the content it does.
• Course content with version numbers and dates, showing what people were taught at the time.
• Individual completion records showing name, employee ID, module, version, date and time.
• Assessment or quiz scores, and how you followed up with people who did not pass.
• Signed policy acknowledgements or attestations, especially from induction.
• A list of overdue learners, with the reminders and escalations sent.
• Records of Board and senior management briefings.
• Training clauses in your processor contracts, and any evidence vendors have shared.
• Notes from breach drills or tabletop exercises, and what changed as a result.
• A review log showing when content was last updated, and why.

One caution: training records are themselves personal data about your employees. Keep them for a defined period that suits your audit needs, protect them like any other personnel record, and tell staff how they are used.

Is there an official DPDP certification for employees?

No. Neither the DPDP Act nor the DPDP Rules, 2025 creates a certification, an approved-course list or an accreditation scheme for staff training. Be wary of any provider that calls its course “government-approved” or “DPDP certified”.

Completion certificates are still useful. A certificate records that a named learner finished a specific course on a specific date and passed its assessment, which makes it evidence of training for your audit file. It is not a government certification, and on its own it does not show that your organisation complies with the Act.

How can AuditDPDP help?

AuditDPDP, run by Xcodefix Global in Coimbatore, provides role-based DPDP Act awareness training for Indian organisations through e-learning and live workshops. Every completion is time-stamped, and you can download certificates and training logs for your audit file. We are an independent provider, not affiliated with MeitY or the Data Protection Board of India.

See how the training is tailored to your industry and to the applications your teams use, or talk to us about a training plan for your organisation.

This article explains the law in general terms and is not legal advice. For decisions about your own obligations, consult a qualified lawyer.