The DPDP Act: What Every Business Handling Indian Personal Data Must Do
India’s Digital Personal Data Protection Act changes how companies collect, use and protect personal data. The obligations in plain language, and the practical steps to become ready.
The Digital Personal Data Protection Act 2023 gives India a comprehensive personal data law for the first time. For businesses that handle personal data of individuals in India, whether customers, employees or users, it introduces obligations that look familiar to anyone who has worked with the GDPR and that carry substantial penalties for non compliance.
Who it applies to
The Act applies to the processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. International firms with Indian customers or Indian employees are in scope even without a local entity.
The core obligations
Lawful basis and consent. Personal data may be processed only for a lawful purpose with the individual’s consent or for certain legitimate uses defined in the Act. Consent must be free, specific, informed and unambiguous, given through a clear affirmative action.
Notice. Before or at the time of seeking consent, individuals must receive a notice describing what data is collected, for what purpose, how they can exercise their rights and how to complain.
Purpose limitation and data minimisation. Collect only what the purpose requires. Use it only for that purpose. Delete it when the purpose is served.
Security safeguards. Reasonable security measures to prevent breaches, and notification to the regulator and affected individuals if a breach occurs.
Individual rights. Access, correction, erasure, grievance redressal and the right to nominate someone to exercise rights on one’s behalf.
Children’s data. Verifiable parental consent and restrictions on tracking and targeted advertising for individuals under eighteen.
Significant data fiduciaries. Larger or higher risk processors may be designated and face additional obligations including a data protection officer and independent audits.
Becoming ready
The practical path has five steps.
- Map your processing. What personal data do you hold, where did it come from, why do you hold it, where is it stored and who can access it?
- Fix the lawful basis. For each processing activity, identify consent or a legitimate use, and redesign consent flows where necessary.
- Write the notices. Plain language, specific, available at the point of collection.
- Build the rights process. A way for individuals to request access, correction or erasure, and a team that answers within the required time.
- Strengthen security and breach response. Access controls, retention schedules and a written procedure for what happens when something goes wrong.
Governance is the foundation
Companies that already have a data governance framework, with clear ownership, a policy structure and a map against applicable regulation, find DPDP readiness a matter of extension. Companies without one find it a scramble. This is one reason governance design belongs early in any data programme.
The business impact
Beyond avoiding penalties, DPDP readiness builds trust with customers and partners, satisfies international counterparties who increasingly ask about it in due diligence, and forces a discipline around data that improves quality for every other purpose. It is compliance work that pays back in decision quality.
Apply this to your business
Talk it through with the people who wrote it.
Tell us the decision behind your question and we will tell you honestly whether we are the right fit.
