What is the DPDP Act and who does it apply to?

The Digital Personal Data Protection Act 2023 (DPDP Act) is India's primary data protection legislation. It applies to any entity that processes the digital personal data of Indian residents, whether inside India or outside. This includes software companies companies, D2C brands, healthtech, fintech, and edtech platforms that collect or process personal data such as names, contact details, health records, or financial information.

What are the key consent requirements under the DPDP Act?

Under the DPDP Act, consent must be free, specific, informed, unconditional, and unambiguous. It must be obtained through a clear affirmative action. The consent notice must specify the personal data being collected, the purpose of processing, and the Data Principal's rights. Consent for different purposes must be granular — you cannot bundle unrelated processing into a single consent. Data Principals must be able to withdraw consent easily at any time.

What obligations does a Data Fiduciary have under the DPDP Act?

A Data Fiduciary must: (1) obtain valid consent before processing personal data; (2) use data only for the specified purpose; (3) ensure data accuracy and completeness; (4) implement appropriate technical and organisational security measures; (5) notify the Data Protection Board and affected Data Principals of personal data breaches; (6) erase personal data when the purpose is served or consent is withdrawn; and (7) establish a grievance redressal mechanism. Significant Data Fiduciaries have additional obligations including Data Protection Impact Assessments and periodic audits.

What are Data Principal rights under the DPDP Act?

Data Principals (individuals whose data is processed) have the right to: access information about their personal data being processed; correct inaccurate or incomplete data; erase personal data when it is no longer needed for the specified purpose or when consent is withdrawn; nominate another individual to exercise their rights in case of death or incapacity; and file grievances with the Data Fiduciary and, if unresolved, with the Data Protection Board.

What are the breach notification requirements under the DPDP Act?

In the event of a personal data breach, a Data Fiduciary must notify the Data Protection Board of India and each affected Data Principal. The notification must describe the nature of the breach, the personal data affected, the likely consequences, and the remedial measures being taken. The DPDP Rules are expected to specify the timeline and format for notification. Organisations should have an incident response plan ready to meet these obligations.

What penalties apply for DPDP Act violations?

The DPDP Act provides for financial penalties up to INR 250 crore for specified breaches such as failure to notify a data breach, and up to INR 50 crore for violations of obligations related to children's data. The Data Protection Board can impose penalties after due inquiry. Penalties are not the only risk — reputational damage, loss of customer trust, and contractual liabilities are equally significant for Indian digital businesses.

Do I need to appoint a Data Protection Officer under the DPDP Act?

Only Significant Data Fiduciaries — entities designated by the Central Government based on the volume and sensitivity of data processed, potential risk to data subjects, and national security implications — are required to appoint a Data Protection Officer based in India. However, all Data Fiduciaries must establish a grievance redressal mechanism and appoint a point of contact for Data Principals.

How do I start becoming DPDP-compliant?

Start with a data mapping exercise to understand what personal data you collect, why, and where it flows. Then audit your consent flows against the Act's requirements, review your vendor agreements for data processor clauses, build a Data Principal rights request process, and prepare a breach response plan. AICloudStrategist offers a 15-day fixed-fee DPDP Starter Review that delivers an audit-grade evidence pack covering all these areas.

Checklist

DPDP compliance checklist for Indian digital businesses.

Use this as a readiness checklist before a customer, investor, partner, or internal stakeholder asks how your business handles personal data.

1. Personal data inventory

List the personal data collected through website forms, app signup, checkout, support, analytics, CRM, WhatsApp, email marketing, payments, logistics, and product usage processes.

2. Purpose and notice mapping

For each data category, document why it is collected, where the user is informed, and whether the privacy notice matches actual operations.

3. Consent and withdrawal flow

Record where consent is captured, how withdrawal is handled, and which systems need to reflect consent status.

4. Vendor and processor register

Maintain a register for hosting, CRM, analytics, payment gateways, email tools, support desks, agencies, logistics providers, and any other processor.

5. User rights and grievance process

Define how access, correction, deletion, grievance, and escalation requests are received, owned, logged, and resolved.

6. Breach readiness

Assign owners for incident triage, evidence preservation, internal escalation, customer communication, and external reporting decisions.

7. Evidence pack

Keep screenshots, policy links, vendor records, process notes, training records, incident playbooks, and remediation plans in a single evidence workspace.

Run the PolicyKart readiness assessment