India’s Digital Personal Data Protection (DPDP) Act, 2023, establishes a comprehensive framework for how businesses collect, process, store, and share personal data of Indian citizens. Every organization that handles personal data — from large enterprises to small businesses and startups — must comply with its provisions or face significant financial penalties.
What Is the DPDP Act and Who Does It Apply To?
The DPDP Act applies to any organization (called a “Data Fiduciary”) that processes digital personal data of individuals in India. This includes:
- Indian businesses of all sizes that collect customer, employee, or user data.
- Foreign companies that offer goods or services to individuals in India or profile them.
- Both online and offline data — the Act covers data collected digitally and data that is digitized after offline collection.
Certain exemptions exist for personal use, publicly available data, and specific government functions, but most commercial organizations fall under its scope.
What Are the Key Obligations Under the DPDP Act?
The Act establishes several core obligations for Data Fiduciaries:
- Lawful purpose: Personal data must be processed only for a lawful purpose, either with consent or for “certain legitimate uses” defined in the Act.
- Informed consent: Consent must be free, specific, informed, unconditional, and unambiguous. The consent notice must be clear, in plain language, and available in English and all 22 languages of the Eighth Schedule.
- Purpose limitation: Data collected for one purpose cannot be used for an unrelated purpose without fresh consent.
- Data minimization: Collect only the data that is necessary for the stated purpose.
- Accuracy: Ensure data is accurate, complete, and up to date, especially when it affects decisions about the Data Principal or is shared with other organizations.
- Storage limitation: Retain personal data only for as long as necessary to fulfill the purpose. Delete it once the purpose is served or consent is withdrawn.
- Security safeguards: Implement reasonable security measures to prevent unauthorized access, use, modification, disclosure, or destruction of personal data.
- Breach notification: Notify the Data Protection Board and affected individuals in the event of a personal data breach.
What Rights Do Data Principals (Individuals) Have?
The DPDP Act grants individuals (called “Data Principals”) several rights:
- Right to access: Obtain a summary of their personal data being processed and the processing activities.
- Right to correction and erasure: Request correction of inaccurate data or erasure of data that is no longer necessary.
- Right to grievance redressal: Every Data Fiduciary must provide a grievance mechanism, and individuals can escalate to the Data Protection Board.
- Right to withdraw consent: Individuals can withdraw consent at any time, and the withdrawal must be as easy as giving consent.
- Right to nominate: Individuals can nominate someone to exercise their data rights in case of death or incapacity.
Compliance Checklist for Indian Businesses
Use this checklist to assess and work toward DPDP Act compliance:
| Area | Action Item | Priority |
|---|---|---|
| Data mapping | Document all personal data you collect, where it is stored, who accesses it, and how long it is retained | High |
| Consent mechanism | Implement clear, granular consent forms with plain-language notices; allow easy withdrawal | High |
| Privacy policy | Update your privacy policy to reflect DPDP Act requirements, including purpose, retention period, and rights | High |
| Data Principal rights | Build processes to handle access, correction, erasure, and consent withdrawal requests within the required timeframe | High |
| Security measures | Implement encryption, access controls, audit logs, and incident response procedures | High |
| Breach notification | Establish a process to detect breaches and notify the Board and affected individuals promptly | High |
| Vendor management | Review contracts with Data Processors (vendors) to ensure they comply with the Act | Medium |
| Children’s data | If you process data of children (under 18), obtain verifiable parental consent; do not track or target ads at children | Medium |
| Cross-border transfers | Verify that any countries you transfer data to are not on the government’s restricted list | Medium |
| Grievance officer | Appoint a grievance officer and publish their contact details on your website | Medium |
| Employee training | Train staff who handle personal data on DPDP Act obligations and internal procedures | Medium |
| Data retention policy | Define and enforce retention periods; delete data when the purpose is fulfilled or consent withdrawn | Medium |
What Are the Penalties for Non-Compliance?
The DPDP Act prescribes financial penalties of up to ₹250 crore per instance for the most serious violations, such as failure to implement security safeguards that results in a data breach. Even smaller violations can attract penalties of up to ₹50-150 crore. These penalties are imposed by the Data Protection Board of India after an adjudication process.
Frequently Asked Questions
When does the DPDP Act come into full effect?
The Act received Presidential assent in August 2023, but specific provisions will be enforced through rules notified by the central government in a phased manner. Businesses should begin compliance preparation now, as the rules can be notified at any time and may include short compliance deadlines.
Does the DPDP Act apply to small businesses and startups?
Yes. The Act applies to all Data Fiduciaries regardless of size. However, the government may exempt certain categories of Data Fiduciaries (such as startups) from some obligations through rules. Until such exemptions are notified, all businesses should assume the Act applies to them.
How is the DPDP Act different from GDPR?
While inspired by GDPR, the DPDP Act has key differences: it does not include a right to data portability, it requires consent in 23 languages, it has specific provisions for children’s data (under 18, not 16), and it uses a different penalty structure. It also does not require a Data Protection Officer for all fiduciaries — only “Significant Data Fiduciaries” designated by the government must appoint one.
Can we use cookie consent tools to comply with the DPDP Act?
Cookie consent tools like CookieYes or Complianz help with website-level consent management, but DPDP Act compliance requires much more — data mapping, security safeguards, breach response, and operational processes. Cookie consent is one component, not the complete solution.
