A beginner-friendly guide to India's Digital Personal Data Protection (DPDP) Act. Learn what it is, why it matters, and what startups and businesses need to know.
Imagine you sign up for a new shopping app. You enter your name, email, phone number, delivery address, and payment information.
What happens to that information after you click Sign Up? Who can see it? How long is it stored? Can it be shared? Can you ask the company to delete it?
These are exactly the questions India's Digital Personal Data Protection (DPDP) Act, 2023 is designed to address.
If you've wondered what the DPDP Act is — or why every startup, SaaS company, e-commerce business, and mobile app should understand it — this guide explains it in plain English.
Go deeper: What is the DPDP Act? (detailed guide) · FAQs · Free readiness check · DPDPKit
The law: India’s rules for how organisations handle digital personal data — names, emails, phone numbers, account details, employee records, and more.
Who it affects: Any business that collects personal data digitally — SaaS, e-commerce, apps, fintech, HR tools, agencies. B2B included.
Your role: Your company is usually the Data Fiduciary — you decide why and how data is processed.
Three things you must do:
Key dates:
| Milestone | Date |
|---|---|
| DPDP Rules, 2025 notified | 13 November 2025 |
| Data Protection Board operational | From 13 November 2025 |
| Full compliance mandatory | 13 May 2027 |
Penalties: Up to ₹250 crore per serious violation — but the goal is responsible data handling, not punishing honest businesses improving their practices. See penalties explained.
Cheapest start: Free 50-question readiness check → DPDPKit templates (₹4,999) → CA review → 90-day timeline.
The Digital Personal Data Protection (DPDP) Act, 2023 is India's law for protecting digital personal data.
Simply put:
It explains how businesses should responsibly collect, use, store, share, and delete people's personal information.
The DPDP Rules, 2025 — notified on 13 November 2025 — add operational detail: how notices work, consent mechanics, breach reporting, and more. Think of the Act as the rules of the road; the Rules are the signs and speed limits.
Almost everything happens online — shopping, banking, food delivery, education, healthcare, AI tools, newsletters. Every activity involves sharing personal information.
Without clear rules, people had little control over how their data was used. The DPDP Act creates a balance between:
Say you own a fitness app. When someone creates an account, you ask for name, email, phone, age, weight, and fitness goals.
That information belongs to the customer (the Data Principal). Your company (the Data Fiduciary) is responsible for managing it appropriately.
The DPDP Act encourages you to ask:
Privacy becomes part of good product design — not just a legal checkbox.
The Act applies to organisations that process digital personal data — including B2B startups.
Examples: SaaS companies, e-commerce websites, mobile apps, healthcare platforms, fintech, HR software, AI startups, marketing agencies, EdTech platforms.
If your business collects names, emails, phone numbers, employee records, or customer accounts, you should understand how DPDP relates to your operations.
Personal data is information that identifies an individual:
Generally not personal data on their own: anonymous aggregated statistics that cannot identify anyone, or public weather reports.
The person whose data is processed — customer, employee, website visitor, job applicant. Think of them as the owner of the personal information.
The organisation deciding why and how data is processed — your startup, an e-commerce company, a hospital. Think of them as responsible for handling the data.
A company processing data on your behalf — cloud hosting, payroll software, CRM, email providers. You remain accountable; they need DPAs (Data Processing Agreements).
For more terms, see What is the DPDP Act?.
If someone subscribes to a newsletter, you probably only need an email — not passport number or date of birth.
Tell users what you collect, why, and how it will be used — in plain language, not legal jargon.
Strong passwords, MFA, access controls, secure backups, software updates. Privacy and security work together.
If information is no longer needed, delete or anonymise it. Document retention periods in a Data Retention Schedule.
Prepare processes for access, correction, erasure, and consent withdrawal. Appoint a Grievance Officer and publish their contact details.
Depending on applicable provisions, Data Principals may:
Businesses should log requests in a Rights Request Register.
Most startups benefit from:
DPDPKit includes all of the above as templates plus an 8-tab workbook — ₹4,999.
Full list: Essential DPDP documents.
False. Startups process personal data too. The Board accepts complaints regardless of company size.
A contact form collects personal data. You still need a Privacy Policy, notice, and Grievance Officer.
Your policy must reflect your data practices. Copied GDPR templates miss India-specific requirements.
Privacy involves product, engineering, HR, operations, security, and leadership.
Privacy programs must evolve as products, vendors, and regulations change — through May 2027 and beyond.
More myths answered: DPDP Act FAQs.
Beyond compliance, good privacy practices help:
Ask yourself:
If you answered no to several items, work through the full compliance checklist or take the free readiness check.
The legal text is technical, but the core ideas are straightforward: be transparent, collect responsibly, protect data, respect individuals, maintain governance.
No. Any organisation processing digital personal data should consider its obligations.
No. Many begin with spreadsheets and templates. See the cost guide.
Yes in small organisations — one named owner plus cross-functional help from product and engineering.
No. Privacy builds trust, improves operations, and supports enterprise sales. Penalties are one risk among many.
Not sure where your business stands?
Free DPDP readiness check — 50 questions, about 2 minutes, instant score with your top three gaps.
Instead of creating every document from scratch, DPDPKit includes:
₹4,999 — compare to ₹3–5 lakh consulting for the same document layer on a standard SMB stack. See cost guide.
The Digital Personal Data Protection Act is ultimately about trust. People trust businesses with personal data every day. DPDP encourages organisations to handle that trust through transparency, security, and clear governance.
You don't need to become a privacy expert overnight. Start by understanding what data you collect, why, and how it's protected. Small, consistent improvements make a significant difference before 13 May 2027.
Your learning path:
This guide is for informational purposes only and does not constitute legal advice.
Written by
Founder, UXLaunch Lab
11+ years across fintech, Web3, and SaaS. Shipped RoleGrowth — an AI-powered career platform — end-to-end in 8 weeks.
Frequently asked questions
Learn everything about India's Digital Personal Data Protection (DPDP) Act, including key concepts, compliance requirements, penalties, FAQs, and a practical checklist.
Read articleUnderstand the DPDP Rules 2025 with this practical guide for Indian startups and businesses. Learn key requirements, compliance steps, FAQs, and best practices.
Read articleLearn about DPDP Act penalties, how financial penalties are determined, common compliance mistakes, and practical steps businesses can take to reduce privacy risks.
Read article