The Digital Personal Data Protection (DPDP) Act 2023 is India’s first comprehensive data privacy law. Passed by Parliament in August 2023, it establishes how businesses must collect, process, store, and delete personal data of Indian citizens. Non-compliance can attract penalties up to ₹250 crore per violation.
Who Does the DPDP Act Apply To?
The Act applies to every organisation — called a “Data Fiduciary” — that processes digital personal data of individuals in India, regardless of where the organisation is based. If your website collects names, email addresses, phone numbers, or any other personal data from Indian users, you are covered. This includes startups, SMEs, large enterprises, and foreign companies serving Indian customers.
Key Definitions You Need to Know
Data Principal: The individual whose data is being processed — your customer, employee, or user. Data Fiduciary: The organisation that determines the purpose and means of processing — your business. Data Processor: An entity that processes data on behalf of the fiduciary — your cloud provider, CRM vendor, or analytics tool. Consent Manager: A registered entity that helps data principals manage their consent preferences.
The Seven Key Requirements
1. Lawful purpose and consent: You must have a clear, lawful purpose for collecting data and obtain free, specific, informed consent before processing. Consent requests must be in plain language — no buried clauses in lengthy terms of service.
2. Purpose limitation: Data collected for one purpose cannot be repurposed without fresh consent. If someone gives you their email for a newsletter, you cannot use it for cold sales outreach.
3. Data minimisation: Collect only the data you actually need. If a contact form only requires name and email, do not ask for date of birth and Aadhaar number.
4. Accuracy: Keep personal data accurate and up to date. Provide mechanisms for users to correct their information.
5. Storage limitation: Do not retain data longer than necessary. Define retention periods for each data category and delete data when the purpose is fulfilled.
6. Security safeguards: Implement reasonable security measures — encryption, access controls, regular audits — to protect personal data from breaches.
7. Breach notification: Report data breaches to the Data Protection Board and affected individuals without delay.
Rights of Data Principals
Under the DPDP Act, individuals have the right to access their data, correct inaccurate data, erase data that is no longer needed, and nominate someone to exercise these rights on their behalf. Your business must provide a clear, accessible mechanism to honour these requests — typically a privacy dashboard or a dedicated email address with defined response timelines.
Penalties for Non-Compliance
The Act prescribes significant penalties: up to ₹250 crore for failing to protect against data breaches, ₹200 crore for failing to notify about breaches, and ₹150 crore for non-compliance with obligations regarding children’s data. These are not just theoretical — the Data Protection Board will have investigative and enforcement powers.
Steps to Get Compliant
Start with a data audit — map what personal data you collect, where it is stored, who has access, and how long you retain it. Update your privacy policy to meet DPDP Act requirements. Implement a consent management platform on your website. Review and update contracts with data processors (cloud vendors, analytics tools, CRM providers). Train your team on data handling practices. Establish a breach response procedure. Consider appointing a Data Protection Officer if your processing volume is significant.
