The Digital Personal Data Protection (DPDP) Act, 2023 is India’s landmark data privacy law that regulates how businesses collect, process, store, and share personal data of Indian residents, with penalties up to ₹250 crore for violations. For Indian businesses that also serve EU customers or handle EU residents’ data, GDPR (General Data Protection Regulation) compliance is simultaneously required. This guide breaks down both frameworks, their differences, and the practical steps Indian businesses must take to achieve compliance.
Last updated October 2026
What Is the DPDP Act and When Did It Take Effect?
The Digital Personal Data Protection Act was passed by the Indian Parliament in August 2023 and its provisions are being enforced in phases from 2025-2026. The Act applies to any organization processing digital personal data of individuals in India, regardless of where the organization is located. It also applies to processing outside India if it relates to offering goods or services to individuals in India.
Key terminology under the DPDP Act:
- Data Principal — the individual whose data is being processed (equivalent to GDPR’s “data subject”).
- Data Fiduciary — the entity that determines the purpose and means of data processing (equivalent to GDPR’s “data controller”).
- Data Processor — the entity that processes data on behalf of the Data Fiduciary.
- Consent Manager — a registered entity that helps Data Principals manage their consent.
- Significant Data Fiduciary — large organizations designated by the government with additional obligations.
How Does the DPDP Act Compare to GDPR?
| Aspect | DPDP Act (India) | GDPR (EU) |
|---|---|---|
| Scope | Digital personal data only | All personal data (digital + physical) |
| Legal bases for processing | Consent + legitimate uses | 6 legal bases including legitimate interest |
| Consent requirements | Free, specific, informed, unambiguous | Free, specific, informed, unambiguous |
| Children’s data | Below 18; verifiable parental consent | Below 16 (member states may lower to 13) |
| Cross-border transfers | Allowed except to notified countries | Restricted; requires adequacy or safeguards |
| Right to erasure | Yes | Yes |
| Right to portability | Not explicitly provided | Yes |
| Maximum penalty | ₹250 crore per incident | €20M or 4% global turnover |
| DPO requirement | Only for Significant Data Fiduciaries | Required for public authorities and certain processors |
What Must Indian Businesses Do to Comply with the DPDP Act?
Step 1 — Data Mapping and Inventory
Document all personal data your business collects: what data, from whom, for what purpose, where it is stored, who has access, and how long it is retained. Common data points for Indian businesses: name, email, phone number, Aadhaar number, PAN, UPI ID, address, purchase history, and browsing behavior.
Step 2 — Implement Consent Management
Obtain clear, affirmative consent before collecting personal data. Consent requests must be in plain language (available in English and scheduled Indian languages). Provide equally easy mechanisms to withdraw consent. Use a Consent Management Platform (CMP) like CookieYes, OneTrust, or Termly to manage website cookie consent.
Step 3 — Update Privacy Policy
Your privacy policy must clearly state: what data is collected, purpose of collection, how data is processed and stored, third parties with whom data is shared, retention periods, and how Data Principals can exercise their rights (access, correction, erasure). Keep the language simple — avoid legal jargon.
Step 4 — Implement Data Security Measures
The DPDP Act requires “reasonable security safeguards.” Implement: encryption of personal data at rest and in transit, access controls with role-based permissions, regular security audits, incident detection and response capabilities, and employee training on data handling.
Step 5 — Establish Breach Notification Process
Notify the Data Protection Board of India and affected Data Principals of any personal data breach. While specific timelines are being finalized through rules, prepare for a 72-hour notification window (aligned with GDPR best practice). Maintain an incident response plan with templates and escalation procedures.
Step 6 — Vendor and Third-Party Management
Review all third-party services that process personal data on your behalf: payment gateways (Razorpay, PayU), email providers (Mailchimp, SendGrid), analytics (Google Analytics, Hotjar), CRM systems, and cloud hosting. Execute Data Processing Agreements with each vendor specifying data handling obligations.
DPDP Act Penalties and Enforcement
| Violation | Maximum Penalty |
|---|---|
| Failure to take reasonable security measures leading to breach | ₹250 crore |
| Failure to notify Data Protection Board and affected individuals of breach | ₹200 crore |
| Non-compliance with obligations regarding children’s data | ₹200 crore |
| Non-compliance with additional obligations (Significant Data Fiduciary) | ₹150 crore |
| Other violations | ₹50 crore |
Frequently Asked Questions
Does the DPDP Act apply to small businesses and startups?
Yes. The DPDP Act applies to all entities processing digital personal data of Indian individuals, regardless of size. However, the government may exempt certain categories of startups through notifications. Until such exemptions are formally issued, all businesses should assume compliance is required.
Do I need both GDPR and DPDP Act compliance if I serve Indian and EU customers?
Yes. GDPR applies if you offer goods or services to EU residents or monitor their behavior. DPDP Act applies if you process personal data of Indian residents. Many compliance measures overlap (consent management, security measures, breach notification), so building a framework that satisfies both is efficient. Start with GDPR compliance (more stringent) and add DPDP-specific requirements.
What is a Consent Manager under the DPDP Act?
A Consent Manager is a registered entity that acts as a single point for Data Principals to manage their consent across multiple Data Fiduciaries. Think of it as a centralized dashboard where individuals can view and revoke consents given to various companies. The Data Protection Board will register and regulate these entities. Businesses can either become registered Consent Managers or integrate with third-party Consent Managers.
How should Indian businesses handle Aadhaar and PAN data under DPDP?
Aadhaar and PAN numbers are personal data under the DPDP Act and require explicit consent for collection. Collect these only when legally required (KYC compliance, tax filings). Store them encrypted, restrict access to authorized personnel only, and delete them when the legal requirement expires. Never use Aadhaar/PAN for purposes beyond their original collection reason.
What is the role of the Data Protection Board of India?
The Data Protection Board (DPB) is the regulatory body established under the DPDP Act. It handles complaints from Data Principals, investigates non-compliance, imposes penalties, and issues guidelines. The Board operates as a digital office, accepting complaints and conducting proceedings electronically. Businesses should monitor DPB notifications for updated compliance guidelines and rules.
