India's DPDP Act 2023: The Complete Compliance Guide for Indian Businesses

What is the DPDP Act 2023?

The Digital Personal Data Protection Act, 2023 is India's first comprehensive privacy law governing the processing of digital personal data. Notified on 11 August 2023 and operationalised through the Draft DPDP Rules 2025, the Act fundamentally changes how Indian and foreign organisations must handle personal data of Indian residents.

Unlike sectoral regulations like the RBI guidelines or SEBI rules that addressed narrow slices of data privacy, the DPDP Act creates a single national framework covering banks, fintechs, e-commerce, healthcare, education, government, SaaS companies, and any business that collects, stores or processes Indian residents' personal data, whether or not the business itself is based in India.

The law replaces the older Information Technology (Reasonable Security Practices) Rules, 2011 and aligns Indian privacy law more closely with global frameworks like the EU GDPR, although with important differences in scope, enforcement structure and remedies. For Indian businesses, this means privacy compliance is no longer a checkbox tied to sector-specific regulators. It is a board-level legal obligation with enforcement risk attached.

DPDP Act Penalties: How Much Are We Talking?

The DPDP Act has teeth. The Data Protection Board of India can impose administrative penalties through a tiered structure, with the headline number being INR 250 crore per instance of breach for failing to take reasonable security safeguards. This is the highest data protection penalty in any Indian privacy framework to date.

The penalty regime is structured around the severity and nature of the violation, with specific maximums for different obligations. Importantly, these are administrative fines imposed by the Data Protection Board, separate from any civil claims that affected individuals (data principals) may pursue.

• INR 250 crore, failure to take reasonable security safeguards (Section 8)
• INR 200 crore, failure of additional Significant Data Fiduciary obligations
• INR 200 crore, failure to notify a data breach to the Board and affected data principals
• INR 150 crore, non-compliance with obligations related to children's data
• INR 50 crore, non-compliance with other provisions of the Act

Who Is a Data Fiduciary and What Are Your Obligations?

The DPDP Act defines two primary roles. The Data Fiduciary is the organisation that determines the purpose and means of processing personal data, broadly equivalent to the EU GDPR's "Data Controller". The Data Principal is the natural person whose data is being processed.

A Data Fiduciary may engage a Data Processor (similar to GDPR's processor concept) to process data on its behalf, but the Data Fiduciary remains accountable. Outsourcing processing does not outsource liability.

Core Data Fiduciary Obligations

Every Data Fiduciary must satisfy six core obligations under the Act: (1) process personal data only for a lawful purpose for which consent has been given or for legitimate uses defined by the Act; (2) collect only data necessary for that purpose (data minimisation); (3) maintain accuracy and completeness of personal data; (4) implement reasonable security safeguards to prevent personal data breach; (5) notify breaches to the Board and affected data principals; and (6) erase personal data when the purpose is no longer served or when consent is withdrawn.

Significant Data Fiduciary (SDF): The Higher Bar

The Central Government may notify certain Data Fiduciaries as Significant Data Fiduciaries (SDFs) based on factors including volume and sensitivity of personal data processed, risk to data principal rights, potential impact on sovereignty and integrity of India, risk to electoral democracy, security of the State and public order.

SDFs face significantly higher compliance obligations beyond the baseline Data Fiduciary requirements:

• Appointment of a Data Protection Officer (DPO) based in India
• Designation of an independent data auditor who must conduct periodic data protection audits
• Mandatory Data Protection Impact Assessments (DPIA) for high-risk processing
• Periodic review of data protection compliance and reporting to the Board
• Additional measures the Central Government may prescribe by rules, including possible cross-border data localisation

Consent: The Foundation of DPDP Compliance

Consent is the primary lawful basis for processing personal data under the DPDP Act. The bar is higher than what many Indian businesses are used to, consent must be free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action.

A pre-ticked checkbox, a buried "I accept" in 80 pages of terms and conditions, or bundled consent for unrelated purposes does not meet the DPDP standard. Each processing purpose needs its own clear consent point.

Notice Requirements (Section 6)

Every consent must be preceded by a clear, plain-language notice telling the data principal: (a) the personal data items being collected; (b) the specified purpose for which it is being processed; (c) the manner of withdrawing consent and the manner of grievance redressal; and (d) the right to complain to the Data Protection Board.

The notice must be available in English and all 22 official Indian languages listed in the Eighth Schedule of the Constitution. This is a major operational shift for businesses that previously operated only in English.

Data Principal Rights

Every data principal has the right to: access a summary of personal data being processed and the identity of all Data Fiduciaries and Data Processors with whom it has been shared; correction of inaccurate or misleading data; completion of incomplete data; updating of outdated data; erasure of personal data that is no longer necessary; grievance redressal through a readily available mechanism with statutory response timelines; and nomination of another individual to exercise the principal's rights in case of death or incapacity.

Personal Data Breach: 72-Hour Reality

A personal data breach under the DPDP Act includes any unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data. The definition is broad, well beyond traditional ransomware or hack scenarios.

Every breach must be reported to the Data Protection Board and to each affected data principal, in the manner and within the timeline that the rules prescribe. The Draft DPDP Rules indicate a notification to the Board within a short window of becoming aware of the breach, with detailed information including the nature, scope, and steps taken.

Indian businesses that have operated under the older CERT-In incident reporting framework are now subject to a far more rigorous regime under DPDP. Both frameworks operate in parallel; a breach involving personal data triggers DPDP notification to the Board PLUS CERT-In reporting under the older IT Act framework.

Step-by-Step DPDP Compliance Roadmap

DPDP compliance is achievable. Here is the practical roadmap we use with our clients, which typically takes 3-6 months for a mid-sized Indian enterprise:

Phase 1 (Weeks 1-3): Data Mapping & Discovery

Identify every place personal data flows through your organisation: marketing CRMs, customer onboarding, HR systems, vendor management, support tickets, analytics tools, log files, backups. Document the data items, the lawful basis, retention periods, who has access, and downstream sharing with processors and third parties.

This phase typically reveals 3-5x more personal data than the team initially expects. That is normal, and exactly why this phase is non-negotiable.

Phase 2 (Weeks 4-6): Gap Analysis Against DPDP & ISO 27001

Run a structured gap assessment against the DPDP Act obligations and, in parallel, against the ISO 27001:2022 Annex A controls. The two frameworks share roughly 60% of controls. Doing both together saves significant cost and effort versus running them sequentially.

Phase 3 (Weeks 7-16): Remediation

Implement consent management platforms (CMPs), data subject rights workflows, breach response playbooks, retention policy and deletion tooling, vendor due diligence updates, and the DPIA process for any high-risk processing. Update all notices and consent flows to plain-language Section 6 compliance.

Phase 4 (Weeks 17-20): Audit & Sign-Off

Run an internal audit to test the implemented controls, fix any findings, get management sign-off, and (for SDFs) bring in an independent data auditor. Document everything. Your board needs the evidence pack ready before any regulator query.

DPDP Act vs GDPR: Key Differences

For Indian businesses that already have EU GDPR compliance, the DPDP Act is largely a subset with a few important departures. For businesses starting fresh, the DPDP Act is generally simpler to navigate.

• Scope: DPDP covers only digital personal data (or non-digital data subsequently digitised). GDPR covers all forms of personal data.
• Sensitive data: DPDP does not (yet) define a separate category of sensitive personal data, unlike GDPR's special categories.
• Penalties: DPDP has per-instance ceiling-based penalties (INR 250 crore max). GDPR uses percentage of global turnover (up to 4%).
• Lawful basis: DPDP relies heavily on consent plus a closed list of "legitimate uses". GDPR has 6 lawful bases including legitimate interest.
• Data Protection Officer: DPDP requires a DPO only for SDFs. GDPR requires DPOs for a wider set of organisations including most large-scale processors of sensitive data.
• Cross-border transfer: DPDP allows transfers except to countries notified by Central Government as restricted. GDPR uses adequacy decisions and Standard Contractual Clauses.