DPDP Act 2023: What Indian Businesses Need to Know About Data Privacy
By DPDP Compliance 16-10-2026 3
If your business keeps a customer list, a payroll sheet, or even a WhatsApp group of regular buyers, you already handle personal data. The Digital Personal Data Protection Act, 2023, usually called the DPDP Act, sets the rules for that data in India. For businesses, achieving DPDP Compliance means understanding these rules and building privacy practices into everyday operations.
The President gave assent to the Act on 11 August 2023. The government notified the Digital Personal Data Protection Rules, 2025, in November 2025, establishing a phased timeline for implementation.
This guide explains what the law covers, who it affects, what DPDP Compliance involves, and how Indian businesses can prepare.
What the DPDP Act Covers
The Act governs digital personal data. That includes personal data collected online, as well as data collected offline and later stored digitally.
Its reach extends beyond Indian borders. The Act applies to processing inside India. It also applies to processing outside India when that processing relates to offering goods or services to people in India.
For example, a software company based abroad can still fall under the Act if it serves Indian customers. Understanding this scope is the first step towards effective DPDP Compliance.
Who's Who Under the Law
The Act defines several roles. Knowing where you fit tells you which duties apply to your business.
Data Principal: The person the data belongs to, including customers, employees, and website visitors.
Data Fiduciary: Anyone who decides why and how personal data is processed. Most businesses fall into this category.
Data Processor: A party that processes data on behalf of a fiduciary, such as a cloud hosting provider or payroll vendor.
Consent Manager: A registered entity that helps individuals give, review, and withdraw consent through one platform.
Significant Data Fiduciary: A fiduciary designated by the government based on factors such as the volume and sensitivity of the data it handles.
Identifying your role helps you determine which DPDP Compliance requirements apply to your organisation.
When Do DPDP Compliance Requirements Take Effect?
The Act and Rules follow a phased implementation timeline. Some institutional provisions took effect earlier, while many operational obligations have a later commencement date.
The main requirements relating to notice, consent, security safeguards, breach reporting, and individual rights are scheduled to take effect 18 months after the November 2025 notification, around May 2027. Consent Manager registration provisions have a separate timeline.
Businesses should verify the applicable commencement dates against official government notifications and assess which existing legal requirements continue to apply during the transition.
Eighteen months might sound generous. It stops feeling generous once you try to map where all your customer data actually lives.
What Businesses Need to Do for DPDP Compliance
The Act and Rules require businesses to take several concrete steps.
Give a clear notice. Explain what personal data you collect, why you collect it, and how individuals can exercise their rights.
Obtain valid consent. Where consent is the legal basis, it must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. A pre-ticked box does not meet that standard.
Use data for the stated purpose. Process personal data consistently with the applicable legal basis and delete it when the purpose ends, unless retention is legally required or another permitted basis applies.
Protect personal data. Maintain appropriate security safeguards, including measures such as encryption, access controls, and monitoring, as applicable under the Rules.
Prepare for breach reporting. Establish a process to investigate incidents and notify the Data Protection Board of India and affected individuals in accordance with the applicable Rules and timelines.
Respect individual rights. Provide processes for requests relating to access to information about personal data, correction, erasure, grievance redressal, and nomination, as applicable under the Act.
Protect children's data. Meet applicable requirements for verifiable parental consent and restrictions on tracking, behavioural monitoring, and targeted advertising directed at children, subject to statutory exceptions.
Offer a grievance channel. Make it easy for individuals to raise privacy complaints and establish a process for handling them.
These measures form the foundation of a practical DPDP Compliance programme.
DPDP Act 2023 Penalties
The Schedule to the Act establishes maximum penalties for different categories of non-compliance.
Up to ₹250 crore for failing to maintain reasonable security safeguards to prevent personal data breaches.
Up to ₹200 crore for failing to notify a personal data breach as required.
Up to ₹200 crore for breaching obligations relating to children's data.
Up to ₹150 crore for a Significant Data Fiduciary failing to meet specified additional obligations.
Up to ₹50 crore for breaching other provisions of the Act or Rules.
The Data Protection Board imposes penalties through the prescribed inquiry process, including an opportunity for the organisation to be heard. Actual penalties depend on the circumstances and applicable statutory factors.
The practical lesson is straightforward: investing in DPDP Compliance before a problem occurs can help reduce legal, operational, and reputational risks.
Two DPDP Compliance Myths Worth Clearing Up
Myth 1: Small businesses are exempt.
The Act does not automatically exempt a business simply because it is small. Applicability depends on the data and processing involved. The government may grant specified exemptions to certain categories, including eligible startups where officially notified, but businesses should not assume an exemption applies without checking the relevant notification.
Myth 2: Only technology companies need to worry.
A clinic with patient records, a school with parent phone numbers, a shop with a customer WhatsApp list, and a manufacturer with employee files may all process personal data. DPDP Compliance is therefore relevant to businesses across industries, not just technology companies.
How to Start Your DPDP Compliance Journey
Begin with these six practical steps.
- Map your data. List the personal data you collect, where it is stored, why it is needed, and who can access it.
- Audit your consent and notices. Update forms and privacy notices using clear language that customers and employees can understand.
- Review vendor contracts. Check that agreements with data processors address relevant data protection and security responsibilities.
- Strengthen security and prepare a breach response plan. Decide who investigates incidents, who handles notifications, and who communicates with affected individuals.
- Create a rights-request process. Assign responsibility for handling requests and establish workable procedures and timelines.
- Train your team. Explain how employees should collect, access, share, retain, and delete personal data.
These steps provide a structured starting point for DPDP Compliance, whether you run a small business or a large organisation.
Start Your DPDP Compliance Work Now, Not in 2027
The phased implementation schedule gives businesses time to prepare, but waiting until the last minute can create unnecessary pressure. Begin by mapping personal data, reviewing existing privacy practices, and identifying gaps against the applicable requirements.
Treat DPDP Compliance as an ongoing business process rather than a one-time paperwork exercise. Regular reviews, staff training, vendor oversight, and clear accountability can make compliance more manageable as the relevant provisions take effect.
FAQs:
1. Does the DPDP Act apply to foreign companies?
Yes. It can apply to foreign companies processing personal data in connection with offering goods or services to individuals in India.
2. When do the main DPDP Compliance obligations take effect?
Many major operational provisions are scheduled to commence 18 months after the November 2025 notification, around May 2027. Always verify the relevant official commencement notifications.
3. What is the maximum penalty under the DPDP Act 2023?
The maximum penalty listed in the Schedule is up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches.
4. How can a business begin DPDP Compliance?
Start by mapping personal data, reviewing privacy notices and consent mechanisms, assessing security safeguards, checking vendor contracts, establishing grievance and rights-request processes, and training employees.
Tags : DPDP Act DPDP Compliance
