RESOURCES
Understanding the DPDP Act, in plain language
A working reference for teams who need to understand what the law actually requires — not a substitute for advice specific to your organisation.
DPDP Act essentials
What is the DPDP Act, 2023?
The Digital Personal Data Protection Act, 2023 is India's principal law governing how organisations collect, process, and store the personal data of individuals in India. It sets out obligations for organisations (data fiduciaries) and rights for individuals (data principals), backed by an enforcement framework through the Data Protection Board of India.
Data Fiduciary vs. Data Processor
A data fiduciary determines the purpose and means of processing personal data — essentially, the party responsible for compliance. A data processor handles data on the fiduciary's behalf, under its instructions. Many organisations act as both, depending on the relationship in question.
What rights do Data Principals have?
Individuals generally have the right to access information about how their data is processed, request correction or erasure, nominate someone to act on their behalf in case of death or incapacity, and raise grievances directly with the organisation before escalating further.
What happens if an organisation doesn't comply?
The Act provides for financial penalties — potentially reaching up to ₹250 crore per instance for the most serious violations, as determined by the Data Protection Board. Beyond penalties, non-compliance carries real reputational and operational risk.
What is a Significant Data Fiduciary?
Certain data fiduciaries may be designated "Significant Data Fiduciaries" based on factors like the volume and sensitivity of data they process, triggering additional obligations such as appointing a Data Protection Officer and conducting periodic data protection impact assessments.
Does this apply to data collected before the Act?
Generally, yes. The Act applies to the processing of personal data regardless of when it was originally collected, as long as it's processed digitally within its scope — so existing data holdings need review, not just new collection.
Where to start: a compliance checklist
A reasonable first pass for most organisations beginning their DPDP journey. Your actual priorities will depend on a proper assessment.
- 1Identify all personal data your organisation collects and where it's stored.
- 2Determine whether you're a data fiduciary, processor, or both, for each data flow.
- 3Review current consent mechanisms against DPDP's consent standards.
- 4Draft or update your privacy notice in plain, understandable language.
- 5Establish a process for handling data principal requests — access, correction, erasure.
- 6Review contracts with vendors and processors for DPDP-aligned clauses.
- 7Put a data breach response and notification plan in place.
- 8Assess whether your organisation needs to appoint a Data Protection Officer.
- 9Train employees who handle personal data on their obligations.
- 10Schedule periodic reviews — compliance is ongoing, not a one-time task.
More questions
Personal data broadly means any data about an individual who is identifiable by or in relation to that data — names, contact details, identification numbers, and other information that can identify a person, whether directly or in combination with other data.
The Act can apply to processing of digital personal data outside India where that processing relates to offering goods or services to individuals in India. Cross-border applicability depends on the specifics of your operations — worth assessing directly rather than assuming either way.
Consent is the primary basis for processing under DPDP, but the Act also recognises certain "legitimate uses" where processing can occur without explicit consent, within defined limits. Which basis applies depends on the specific processing activity.
DPDP shares some conceptual ground with GDPR — consent, data principal rights, breach notification — but it is a distinct law with its own definitions, thresholds, and enforcement mechanism through the Data Protection Board of India. Organisations already GDPR-compliant still need a India-specific assessment.
The information on this page is provided for general awareness and does not constitute legal advice. For guidance specific to your organisation, book a consultation.