DPDP Act 2023: What Businesses in India Need to Do
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law on the processing of digital personal data. It applies to organizations that collect or handle the personal data of individuals in India. The DPDP Rules were notified in November 2025, and the duties come into force in phases over about 18 months. Check the official notifications for the exact dates that apply to you.
Key terms
- Data Principal: the individual whose personal data is processed.
- Data Fiduciary: the organization that decides why and how the data is processed.
- Data Processor: a company that processes data on behalf of a Data Fiduciary.
- Significant Data Fiduciary: a Data Fiduciary designated by the government, with extra duties.
Main duties for organizations
- Notice and consent: tell people what data you collect and why, in clear language, and get consent that is free, specific and informed. People must be able to withdraw consent as easily as they gave it.
- Purpose limitation: use the data only for the purpose you stated.
- Data accuracy and retention: keep data accurate, and erase it when it is no longer needed for its purpose or required by law.
- Security safeguards: take reasonable technical and organizational measures to protect personal data.
- Breach reporting: report a personal data breach to the Data Protection Board of India and to the people affected.
- Children's data: obtain verifiable parental consent before processing the personal data of a child.
Rights of individuals
People have the right to get a summary of their data and how it is used, to ask for correction and erasure, to have a grievance resolved and to nominate another person to exercise their rights if they cannot. Organizations need a simple way to receive and answer these requests within the time the Rules allow.
Extra duties for Significant Data Fiduciaries
Organizations designated as Significant Data Fiduciaries must appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic data protection impact assessments.
Penalties
The Act sets financial penalties for breaches. The highest penalty, up to INR 250 crore, applies to failing to take reasonable security safeguards to prevent a personal data breach.
Practical steps to prepare
- List the personal data you hold, where it comes from, where it is stored and who can access it.
- Review your privacy notices and consent screens, and update them to be clear and easy to withdraw.
- Set retention periods and a safe way to delete data.
- Put security controls in place, such as access control, encryption and logging.
- Write a breach response plan and test it.
- Create a process for access, correction and erasure requests and for complaints.
- Review the contracts you have with vendors that process data for you.
Final thoughts
The DPDP Act is a law, so there is no certificate that proves compliance. Organizations show compliance through the way they handle data and the records they keep. Starting with a data inventory and a gap review is the quickest way to see where you stand.