DPDP Act 2023: What Businesses Must Do

Does the DPDP Act apply to my business?

Almost certainly yes, if you handle information about identifiable individuals in digital form. The Act applies to personal data collected in digital form, and to personal data collected on paper and later digitised (section 3). A visitor register scanned into a PDF, a handwritten patient file typed into clinic software, or a stack of loan application forms entered into Excel all fall inside it. Size does not matter. There is no turnover threshold, and a ten-person firm has the same basic duties as a listed company.

The Act also reaches businesses outside India that process personal data in connection with offering goods or services to people in India. An overseas SaaS company selling to Indian customers, or an Indian company using a foreign cloud provider, is inside its scope. The foreign provider is usually your ‘data processor’ and you remain the ‘data fiduciary’ who answers for the data.

Three things fall outside. Data processed by an individual for personal or domestic purposes is excluded. So is personal data the person has made public themselves, or that someone was legally obliged to publish. And the Act covers only data about living individuals that identifies them; truly anonymised data is not personal data. Be careful with that last point, because data that can be re-linked to a person with a little effort is still personal data.

When do the DPDP obligations start?

The DPDP Rules 2025 were notified on 13 November 2025 and brought the Act into force in three stages. The provisions setting up the Data Protection Board took effect at once. The registration of consent managers starts one year later, in November 2026. The main obligations on businesses, which are the notice, consent, security, breach intimation, erasure, children's data and user rights provisions, take effect eighteen months after notification, that is in May 2027.

In early 2026 there were reports that the government was considering shortening the eighteen-month period, especially for significant data fiduciaries. As of October 2026, no such change has been notified, and a Removal of Difficulties Order issued in October 2026 made only two small wording corrections to sections 9 and 10. Check the latest Gazette notifications before you fix your own internal deadline, and plan to be ready well before May 2027 rather than on the last day.

Until then, the old regime continues. Section 43A of the IT Act and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 still require a privacy policy and reasonable security practices for sensitive data such as passwords, financial information, health records and biometrics, and allow affected people to claim compensation. CERT-In's April 2022 directions still require specified cyber incidents to be reported within six hours and ICT logs to be kept for 180 days in India. When the DPDP duties commence, section 43A is omitted by section 44(2) of the DPDP Act.

DPDP timeline: what applies when

The month in each row is what the Rules provide as of October 2026. If the government changes the schedule by notification, the later notification governs.

Who is a data fiduciary, a data processor and a data principal?

The data fiduciary is the business that decides why and how personal data is processed. The data principal is the person the data is about (for a child, the parent or lawful guardian acts for them). A data processor is anyone who processes data on the fiduciary's behalf: your payroll vendor, cloud host, CRM provider, call centre, courier partner or marketing agency. The fiduciary stays responsible for what the processor does with the data (section 8(1)), which is why the contract with each vendor matters.

One business is often both. A payroll company is a processor for its clients' employee data and a fiduciary for its own staff data. A hospital is a fiduciary for its patients and may share data with a diagnostic lab that is a separate fiduciary in its own right. Sorting out who is who for each data flow is the first real step, because it decides who gives the notice, who takes consent and who answers the customer's complaint.

The government can also notify a business as a significant data fiduciary, based on the volume and sensitivity of the data, the risk to people's rights and wider factors such as security of the State. That label brings extra duties, discussed below. It is not something a business declares for itself.

How to make your business DPDP compliant: the steps

This is the order that works in practice. Each step produces a document you can later show the Data Protection Board if a complaint is made.

1. Map the personal data you hold

   List every place personal data comes in and goes: website forms, apps, billing, HR, CCTV, WhatsApp, email, vendors. For each, note what data, whose, for what purpose, where it is stored, who can see it and who receives it. A spreadsheet is enough to begin; what matters is that it is complete.

2. Fix a lawful basis for each purpose

   For each purpose, decide whether you rely on consent or on a legitimate use under section 7, such as employment. Drop purposes you cannot justify, and drop data fields you do not need for the purpose. Collecting less is the cheapest compliance there is.

3. Rewrite notices and consent flows

   Draft a notice that meets Rule 3 for each main touchpoint: website, app, store counter, onboarding of employees. Replace pre-ticked boxes and bundled consents with a separate, clear choice for each purpose, and build an equally easy way to withdraw consent.

4. Sign proper contracts with processors

   Every vendor that touches personal data needs a written contract covering purpose limits, security, breach reporting to you, sub-processors, return or deletion of data at the end, and audit rights. Section 8(2) says you may engage a processor only under a valid contract.

5. Put security safeguards in place

   Encryption or masking, access controls, logging and monitoring, backups and a tested way to restore them. Rule 6 sets out the minimum, including keeping logs for at least one year. Write down what you have done; an unwritten control is hard to prove.

6. Prepare a breach response plan

   Decide who decides, who informs the Board and the affected people, who files with CERT-In, and who speaks to the police. Keep draft intimation letters ready. The 72-hour window is short when nobody knows whose job it is.

7. Set retention periods and deletion

   For each category of data, fix how long you keep it, based on the purpose and on other laws that require retention. Build actual deletion, including from backups and from vendors, not just a policy line.

8. Open a channel for rights and grievances

   Publish the contact details of the person who answers data questions, and give a working way to ask for a summary of data, correction, erasure, withdrawal of consent and nomination. Track every request and the reply date.

9. Train staff and review every year

   The sales executive exporting a lead list to a personal Gmail account is the usual breach, not a hacker. Short, repeated training and a yearly review of the data map keep the paperwork true.

What must a DPDP privacy notice contain?

A DPDP notice must be understandable on its own, without the person having to read some other document, and must be given in clear and plain language. Rule 3 requires it to give an itemised description of the personal data being collected and the specific purpose for each item, with a description of the goods, services or uses that the processing enables. It must also explain how the person can withdraw consent (as easily as they gave it), how to exercise their rights, and how to complain to the Data Protection Board.

The person can ask for the notice in English or in any of the 22 languages in the Eighth Schedule to the Constitution (section 5(3)). A business serving customers in Ghaziabad or Noida mostly in Hindi should have a Hindi version ready, not just a translated link that nobody tested.

What a notice is not: a twelve-page privacy policy copied from a foreign website and linked in the footer. You will still have a privacy policy, but the notice must sit at the point of collection, list what you actually take and say why. Section 6(10) puts the burden of proving that notice was given and consent was obtained on the business. Keep the version history of every notice and the logs that show who saw which version.

When do I need consent, and when can I rely on legitimate use?

Consent is the default basis, and under section 6 it must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. A consent that says ‘we may use your data for any purpose including marketing and sharing with partners’ fails on almost every count. So does making a service depend on agreeing to processing that the service does not need. Withdrawal must be as easy as giving consent, and once consent is withdrawn you must stop processing within a reasonable time and get your processors to stop too.

Section 7 lists legitimate uses where consent is not needed. The ones that matter most to businesses are: data the person voluntarily gave for a specified purpose without objecting to its use for that purpose (a customer who shares an address so the parcel can be delivered); compliance with any law or court order; medical emergencies and disasters; and employment, which covers processing for employment purposes or to protect the employer from loss or liability, such as preventing corporate espionage, keeping trade secrets confidential and providing benefits to employees.

The employment ground is wide but not unlimited. It supports payroll, attendance, background checks proportionate to the role, and monitoring of company systems for security. It does not obviously support collecting an employee's family health history for a wellness app run by a third party, or tracking personal phones after hours. Where you are unsure, the safer route is a separate consent for the extra purpose, and a review of your employment agreement clauses so the contract and the notice say the same thing.

Can I keep using customer data I collected before the Act?

Yes, but if it was collected on consent before the Act, you must give those people a DPDP notice as soon as reasonably practicable (section 5(2)). You may continue processing until the person withdraws consent. In practice this means an email or SMS campaign to your existing customer base, with a link to the notice and a simple way to withdraw, sent before the May 2027 start date.

This is also the moment to clean the database. Old lead lists of uncertain origin, numbers bought from data brokers, and records of customers who have not dealt with you for years are a liability with no matching benefit. If you cannot say where a list came from and what the person was told, the honest answer is usually to delete it. A smaller, clean list is worth more than a large one you cannot defend before the Board.

The DPDP provisions businesses deal with most

What security safeguards does the DPDP Act expect?

Section 8(5) requires reasonable security safeguards to prevent a personal data breach, and Rule 6 lists the minimum. These include protecting data by encryption, obfuscation, masking or virtual tokens; controlling access to computer resources; keeping logs and monitoring access so that unauthorised use can be detected, investigated and remedied; backups and measures to keep processing going if data is compromised; and keeping the relevant logs and personal data for at least one year for detecting and investigating breaches. The same safeguards must be written into your contracts with processors.

The word ‘reasonable’ gives some room. A neighbourhood clinic is not expected to run a security operations centre. It is expected to have unique logins rather than a shared password, to restrict who can open patient records, to encrypt laptops, to back up the database and to know who accessed what. A fintech or a hospital chain is judged by a higher standard because the data and the scale are different.

The penalty for failing to take reasonable security safeguards is the highest in the Schedule, up to ₹250 crore. It is triggered by the failure to take safeguards, not by the breach as such. That distinction matters: a business that suffers a breach despite sensible, documented controls is in a far better position before the Board than one that had none. Documentation is therefore part of the security itself.

What must a business do after a data breach?

On becoming aware of a personal data breach, a business must inform each affected person without delay, and inform the Data Protection Board without delay, followed by a detailed report within 72 hours (Rule 7), or within a longer period the Board allows on request. The intimation to affected people must be in plain language and explain what happened, the likely consequences, what the business is doing about it, the steps the person can take to protect themselves, and a contact for questions.

The 72-hour report to the Board covers the facts and circumstances, the reasons for the breach, the mitigation measures, any findings about the person responsible, the steps taken to prevent a repeat, and the intimations sent to affected people. Every breach of personal data must be reported; there is no minimum size and no exemption for ‘minor’ incidents. That is a big change from the habit of quietly fixing a problem and moving on.

Other reporting duties run in parallel. CERT-In must be informed of specified cyber incidents within six hours. Sector regulators such as RBI, SEBI or IRDAI have their own reporting rules for regulated entities. If data was stolen, extortion was attempted or an employee walked off with a database, a complaint to the cyber police station and an FIR are usually needed as well, and evidence must be preserved properly. The post on electronic evidence and the Section 63 BSA certificate explains how logs and system records are later proved in court.

How long can a business keep personal data?

Only as long as the purpose needs it, unless another law requires you to keep it longer. Section 8(7) requires erasure when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, and the processor must erase too. For large e-commerce, online gaming and social media platforms above user thresholds set in the Rules, the Rules fix a period of three years of inactivity, after which data must be erased with 48 hours' notice to the person.

Other laws pull in the opposite direction, and they win where they apply. Books of account must be kept for eight financial years under section 128(5) of the Companies Act 2013. Tax, labour, KYC and sector rules impose their own periods. Rule 8 also requires certain logs and related personal data to be kept for at least one year. The answer is a retention schedule that lists each category of data, the legal reason for the period and the trigger for deletion. Without it, staff keep everything forever, which is the opposite of what the Act wants.

What if my business handles children's data?

For anyone under 18, you need the verifiable consent of a parent or lawful guardian before processing their personal data (section 9). Rule 10 requires the business to check that the person giving consent is an identifiable adult, using reliable identity and age details already available to it or provided by the parent, or a virtual token such as one issued through DigiLocker. A checkbox saying ‘I am above 18’ will not do.

Section 9 also bars processing that is likely to harm a child's well-being, and tracking, behavioural monitoring or targeted advertising directed at children. Schools, coaching centres, edtech apps, gaming platforms and children's clothing brands need to look at this closely. The Rules exempt some processing, for example by educational institutions, clinical establishments and child-care centres for specified purposes such as safety and tracking of a child's location during transport, but the exemptions are tied to those purposes and do not cover marketing.

What extra duties apply to a significant data fiduciary?

A business notified as a significant data fiduciary must appoint a Data Protection Officer based in India who reports to the board of directors, appoint an independent data auditor, and carry out a data protection impact assessment and a data audit periodically (section 10). Rule 13 makes both the assessment and the audit yearly, with the significant findings reported to the Board. It also requires due diligence that algorithmic software used to process personal data does not risk people's rights, and lets the government require certain categories of data to stay within India.

Most small and mid-sized businesses will not be notified. But if you run a platform with a large Indian user base, handle health or financial data at scale, or process data for profiling, plan as if you might be. Appointing a responsible officer and running a first impact assessment is good practice even without the label, and it is the work the Board will look for first when a complaint arrives.

DPDP penalties: what each breach can cost

These are the maximum amounts in the Schedule to the Act. The Board fixes the actual penalty after an inquiry, looking at the nature, gravity and duration of the breach, the type of data, whether it was repeated, any gain or loss avoided, mitigation, and the effect on the business (section 33).

Who enforces the DPDP Act, and can a customer sue for compensation?

The Data Protection Board of India enforces the Act. It works as a digital office: complaints, hearings and orders are handled online. It acts on a complaint by an affected person, on a reference from the government or a court, or on a breach intimation from the business itself. It can inquire, issue directions, accept a voluntary undertaking from the business (which can close the matter on agreed terms) and impose penalties. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days, and from there to the Supreme Court.

Penalties under the DPDP Act go to the government, not to the affected person, and section 39 bars civil courts from matters the Board is empowered to decide. That is a real difference from section 43A of the IT Act, which allowed compensation claims. It does not mean customers have no other route: a consumer complaint for deficiency in service, a civil claim on contract or a criminal complaint for data theft may still be available on the facts. A business should assume that a breach will produce complaints in more than one forum.

Documents your business should have ready

If a complaint reaches the Board, these are the papers that show what you did. Most can be short; they must be true.

The vendor and confidentiality terms are where most businesses are weakest. Our posts on drafting and enforcing NDAs and on e-signed and click-through contracts cover how to make those terms hold up.

Common DPDP mistakes businesses are making now

The first is treating DPDP as an IT project. The IT team can encrypt a database, but it cannot decide if you may use the data for marketing, what your vendor contract should say, or how long the law requires you to keep salary records. Those are legal and business decisions, and they come first.

The second is copying a template notice that lists every possible purpose ‘just in case’. A notice that does not match what you actually do is worse than a short honest one, because it proves you did not think about purpose limitation. The third is forgetting the offline-to-digital route: paper forms scanned to a shared drive are covered. The fourth is ignoring vendors. When Advocate B.K. Singh reviews a company's DPDP position, the vendor contracts are usually where the largest gap sits, because the business has handed customer data to five or six processors on standard terms that say nothing about security, breach reporting or deletion.

What to do this month

With the main duties due in May 2027, these are the tasks that should be done or started now.

• Name one person responsible for DPDP work and give them authority across departments
• Start the data map with HR, sales, accounts and IT in the same room
• List every vendor that receives personal data and pull out their contracts
• Identify any processing of children's data and how parental consent is obtained
• Stop using purchased or unexplained lead lists
• Check that every staff member has an individual login to systems with personal data
• Write down who decides and who reports if there is a breach tomorrow
• Fix a date to review notices and consent flows before the end of the year

Where a lawyer helps, and where you can manage alone

A careful business can do the data map, the staff training and much of the security work internally, with its IT team or vendor. Legal help is most useful at four points: deciding the lawful basis for each purpose and drafting the notices; rewriting vendor, employee and customer contracts; setting the retention schedule against other laws; and handling a breach, where the intimations to the Board and to customers, the CERT-In report and any police complaint must be consistent with each other and with what can be proved later.

Advocate B.K. Singh's background in computer science (MCA) alongside law helps when the question is partly technical, such as what a log actually shows or whether masked data can be re-identified. Our firm handles this as part of its corporate law consultancy and commercial contracts work. If you want your notices, contracts or breach plan reviewed before May 2027, you can send the papers through our online enquiry form and we will tell you what needs to change first.