DPDP Act 2023: What Indian Businesses Should Do Now

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how organisations collect, use, store and share digital personal data. The DPDP Rules, 2025 were notified in November 2025 with a phased rollout, and most obligations for businesses are scheduled to apply about 18 months after notification. That makes now the right time to prepare. This guide summarises what the law expects from ordinary businesses — it is not legal advice, so confirm details with counsel and the official notifications.

1. Key terms

• Data Principal: the individual whose personal data is processed — a customer, employee or website visitor.
• Data Fiduciary: the business that decides why and how personal data is processed.
• Data Processor: a vendor that processes data on the fiduciary’s behalf, such as a cloud, payroll or CRM provider.
• Data Protection Board of India: the body that handles breaches, complaints and penalties.

2. Core obligations for businesses

• Lawful basis and consent: process personal data with clear, informed consent or for specified legitimate uses. Consent requests should be in plain language, itemised and as easy to withdraw as to give.
• Notice: tell people what data you collect, why, and how they can exercise their rights or complain.
• Purpose and storage limits: collect only what you need and erase data when the purpose is served, unless law requires retention.
• Security safeguards: reasonable measures such as encryption, access control, logging and backups to prevent breaches.
• Breach notification: inform affected individuals and the Data Protection Board when a personal data breach occurs, within the timelines set by the Rules.
• Grievance redressal: provide a contact for questions and complaints and respond within the prescribed time.
• Children’s data: verifiable parental consent is needed for processing personal data of children, with restrictions on tracking and targeted advertising.

3. Rights of individuals

Individuals can access a summary of their data, ask for correction, completion or erasure, nominate someone to exercise rights on their behalf, and seek grievance redressal. Your processes and software should make these requests easy to handle and track.

4. A practical preparation plan

1. Map your data: list what personal data you collect (forms, CRM, HR, accounts, CCTV), where it is stored, who can access it and which vendors receive it.
2. Review consent and notices: update website forms, privacy policy and app screens.
3. Set retention rules and delete data you no longer need.
4. Strengthen security: access control, encryption, two-factor authentication and tested backups. Our cybersecurity checklist is a good starting point.
5. Update vendor contracts so processors follow your instructions and protect data.
6. Prepare an incident response plan for breaches, with roles and notification steps; pair it with backup and disaster recovery.
7. Train staff who handle customer and employee data.

5. What it means for your software

CRMs, HR systems and websites should support consent records, role-based access, audit logs, data export and deletion. If you are building or choosing software, include these as requirements — see how to write a software requirements document.

6. Penalties

The Act provides for significant financial penalties for failures such as not taking reasonable security safeguards or not notifying breaches, with the highest penalties running into hundreds of crores of rupees. The amount depends on the nature and seriousness of the breach as assessed by the Board.

Frequently asked questions

Does the DPDP Act apply to small businesses?

Yes, it applies to digital personal data processed by businesses of all sizes, though some exemptions may be notified for certain classes of fiduciaries.

Does it cover employee data?

Yes. Employee personal data is covered, although certain employment-related purposes are treated as legitimate uses.

When do the obligations start?

The Rules were notified in November 2025 with phased timelines; most business obligations apply after about 18 months. Check MeitY’s notifications for exact dates.

Sources

• Ministry of Electronics and Information Technology (MeitY)
• India Code: Digital Personal Data Protection Act, 2023

Need help making your systems DPDP-ready? Contact ATTPL IT Solutions.