Learn everything about India's Digital Personal Data Protection (DPDP) Act, including key concepts, compliance requirements, penalties, FAQs, and a practical checklist.
The Digital Personal Data Protection (DPDP) Act, 2023 is India's primary law governing how organizations collect, use, store, share, and delete digital personal data.
Its objective is to protect the privacy of individuals while enabling organizations to process personal data for lawful purposes.
If your business collects customer details, employee information, website enquiries, payment information, or any other personal data digitally, the DPDP Act is likely relevant to your operations.
The DPDP Rules, 2025 were notified on 13 November 2025. The Data Protection Board is operational, and full compliance is mandatory by 13 May 2027.
Related guides: DPDP explained simply (beginners) · DPDP compliance checklist · Ultimate DPDP compliance guide (2026) · Deadline-focused startup guide · Free readiness check · DPDPKit
India has become one of the world's largest digital economies. Every day, millions of people share personal information through mobile apps, websites, banking platforms, e-commerce stores, healthcare applications, education platforms, digital payments, and government portals.
Before the DPDP Act, privacy obligations were spread across multiple regulations and sector-specific rules. The DPDP Act establishes a dedicated legal framework for digital personal data.
Its goals include:
The Act applies to organizations that process digital personal data in circumstances covered by the law — including B2B startups, not just consumer apps.
Examples of businesses in scope:
If your business collects names, email addresses, phone numbers, customer accounts, employee records, payment information, or website enquiries, you should evaluate your DPDP obligations.
Quick self-check: Take the free 50-question DPDP readiness check →
Personal data is information that relates to an identifiable individual.
Examples include:
Businesses should understand what personal data they collect — across all systems, not just the website — before designing compliance processes.
The individual whose personal data is processed — customers, employees, vendors, job applicants, and website users.
An organization that determines why and how personal data is processed. Most startups and businesses collecting customer information are Data Fiduciaries.
A third party that processes data on behalf of a Data Fiduciary — cloud hosting, CRM platforms, payroll software, customer support tools, email marketing platforms, payment gateways.
Data Fiduciaries remain accountable for processor compliance. DPAs (Data Processing Agreements) are essential.
Where consent is the lawful basis, it must be:
Users should understand exactly why their information is being collected — not buried in Terms of Service.
A named person appointed by the Data Fiduciary to handle data-related complaints from Data Principals. Contact details must be published in your privacy policy.
The Government may designate certain organizations as Significant Data Fiduciaries based on factors such as volume and sensitivity of data processed. SDFs face additional compliance obligations. Not every startup will qualify, but you should assess your status.
While implementation depends on your business, these principles provide a useful foundation.
Collect personal data only for legitimate and clearly communicated purposes. Avoid collecting information "just in case."
Collect only what your business genuinely needs. If a newsletter signup only requires an email address, asking for date of birth may be unnecessary.
Take reasonable steps to keep personal data accurate and updated where appropriate.
Protect personal data using appropriate technical and organizational measures — access controls, encryption in transit, secure backups, MFA, and employee awareness.
Avoid retaining personal data longer than necessary. Create documented retention schedules and deletion triggers.
Demonstrate responsible data handling through policies, registers, documented processes, and a compliance workbook that tracks progress.
The Act gives Data Principals greater control over their personal data. Depending on applicable provisions, individuals may have the right to:
Businesses should establish workflows to respond to these requests efficiently and log them in a rights request register.
Organizations processing personal data should implement practices such as:
Explain what information is collected, why it is collected, how it is used, how long it is retained, Data Principal rights, and Grievance Officer contact details.
Where consent is the basis for processing, ensure users understand what they are agreeing to. Avoid vague or bundled consent requests.
Security measures should reflect the sensitivity of the information — encryption, secure hosting, role-based access, logging, and regular software updates.
Maintain a vendor inventory, review how third parties handle personal data, and execute DPAs before sharing data with processors.
Prepare workflows for access, correction, erasure, and consent withdrawal. Define response timelines and assign an owner.
In the event of a personal data breach, notify affected Data Principals without undue delay where required, intimate the Data Protection Board without delay, and file a detailed report within 72 hours.
A practical compliance program often includes:
| Document | Purpose |
|---|---|
| Privacy Policy | Explain data handling practices to the public |
| Itemised Consent Notice | Inform users before collecting data; obtain valid consent |
| Employee Privacy Notice | Cover employee and HR data processing |
| Data Inventory | Identify what personal data is held and where |
| Vendor Register | Track third-party processors and DPA status |
| Data Processing Agreement | Define processor responsibilities and safeguards |
| Data Retention Schedule | Specify retention periods and deletion triggers |
| Rights Request Register | Record and track Data Principal requests |
| Data Breach Response Plan | Prepare for incidents including Board reporting |
| Grievance Officer Appointment | Formalise the named contact for complaints |
| Compliance Workbook | Monitor gap assessment and implementation progress |
DPDPKit includes all of the above as templates plus an 8-tab workbook — ₹4,999, instant download.
For a full implementation walkthrough, see the Ultimate DPDP Compliance Guide (2026).
A focused 3-week starting point for early-stage teams. Larger or more complex stacks may need 8–12 weeks — DPDPKit includes a 90-day roadmap for that.
Non-compliance carries significant financial risk. The Data Protection Board has been operational since 13 November 2025.
| Violation type | Maximum penalty |
|---|---|
| General contraventions | Up to ₹250 crore |
| Breach of obligations re: children's data | Up to ₹200 crore |
| Failure to implement reasonable security | Up to ₹250 crore |
| Failure to notify Board of breach | Up to ₹200 crore |
Penalties depend on the nature and gravity of the violation. The Board is already accepting complaints — enforcement risk is not limited to the May 2027 deadline.
Businesses frequently:
Building structured processes early helps avoid these issues. See the full compliance checklist in our pillar guide.
Compliance supports more than legal readiness. It can also help organizations:
| DPDP | GDPR | |
|---|---|---|
| Jurisdiction | India | European Union (+ EEA) |
| Scope | Digital personal data | Broader personal data scope |
| Child threshold | Under 18 | Under 16 (member states may lower to 13) |
| Grievance Officer / DPO | Grievance Officer mandatory | DPO required in certain cases |
| Breach reporting | Board intimation + 72-hour detailed report | 72 hours to DPA where applicable |
| Legal framework | India's digital ecosystem | Established EU privacy regulation |
Organizations operating internationally may need to comply with both. A GDPR privacy policy alone is not sufficient for DPDP.
For a deeper comparison, see the DPDP vs GDPR section in our pillar guide.
If your organization processes digital personal data in situations covered by the Act, you should assess and implement the obligations that apply to your business.
Yes. Many startups process customer, employee, or website visitor data and should evaluate their compliance responsibilities.
Business size alone does not determine applicability. The key consideration is whether and how personal data is processed.
Common documents include a Privacy Policy, consent notices, data inventory, vendor register, rights request register, retention schedule, breach SOP, Grievance Officer appointment, and DPAs for processors. Exact requirements depend on your operations.
No. Your Privacy Policy should accurately reflect your own data collection, processing, storage, and retention practices.
No. The Act is relevant wherever your organization processes digital personal data — internal systems, HR processes, customer support platforms, mobile apps, and cloud services.
Unsure whether your business is ready?
Take our free DPDP readiness check — 50 questions, about 2 minutes, instant score with your top three gaps. No signup required.
If you want a practical starting point instead of creating every document from scratch, DPDPKit includes:
₹4,999 — instant download after payment.
The DPDP Act represents an important step in strengthening privacy and responsible data handling in India's digital economy. For startups and growing businesses, compliance should not be viewed as a one-time legal exercise, but as an opportunity to build customer trust, improve internal processes, and establish a strong foundation for future growth.
Rather than waiting until the 13 May 2027 deadline becomes urgent, assess your current practices now, document how personal data is handled, and implement practical governance measures over time.
Next steps:
This guide is for informational purposes only and does not constitute legal advice. Have your counsel or CA review your customised documents before you rely on them.
Written by
Founder, UXLaunch Lab
11+ years across fintech, Web3, and SaaS. Shipped RoleGrowth — an AI-powered career platform — end-to-end in 8 weeks.
Frequently asked questions
Understand the DPDP Rules 2025 with this practical guide for Indian startups and businesses. Learn key requirements, compliance steps, FAQs, and best practices.
Read articleLearn about DPDP Act penalties, how financial penalties are determined, common compliance mistakes, and practical steps businesses can take to reduce privacy risks.
Read articleLearn a practical DPDP compliance timeline for startups and businesses. Follow this 90-day roadmap to prepare your organization for India's data protection law.
Read article