The Digital Personal Data Protection Act, 2023 (the "DPDP Act") is India's first dedicated data-protection law. If your organisation collects or uses the personal data of people in India — customers, employees, patients, users — it applies to you. This guide walks through what the Act requires and a practical path to becoming compliant.
What the DPDP Act governs
The Act sets the rules for how organisations may collect, store, use and share digital personal data — any data about an identifiable individual that is in, or has been converted to, digital form. It gives individuals rights over their own data and creates the Data Protection Board of India to enforce the law.
The key players
- Data Principal — the individual the data is about.
- Data Fiduciary — the organisation that decides why and how data is processed (usually you).
- Data Processor — a third party that processes data on your behalf, such as a cloud host or SaaS tool.
- Significant Data Fiduciary (SDF) — a larger or higher-risk fiduciary notified by the government, with extra duties.
Your core obligations as a Data Fiduciary
- Notice & consent — give a clear, itemised notice and collect free, specific, informed consent for each purpose, with easy withdrawal (Sections 5–6).
- Purpose limitation — use data only for the stated purpose, and delete it when that purpose ends.
- Security safeguards — protect personal data with reasonable technical and organisational measures (Section 8).
- Breach notification — tell the Board and affected individuals of a personal-data breach.
- Honour rights — enable access, correction, erasure, grievance redressal and nomination.
- Processor contracts — engage processors only under a valid contract (a data-processing agreement).
- Children's data — obtain verifiable parental consent for under-18s and avoid tracking or targeted advertising to children.
The rights your customers now have
Every Data Principal can ask for a summary of the data you hold (access), have it corrected or erased, raise a grievance that you must answer within time, and nominate someone to exercise their rights. You need a working process for each.
Are you a Significant Data Fiduciary?
The government can notify certain fiduciaries as SDFs based on data volume, sensitivity, risk and cross-border transfer. SDFs must appoint a resident Data Protection Officer, carry out Data Protection Impact Assessments, and undergo periodic independent audits.
Penalties
The Data Protection Board can impose significant financial penalties — up to ₹250 crore for failing to take reasonable security safeguards, with other substantial amounts for breach-notification and children's-data failures. Beyond the fine, a breach costs you customer trust.
A practical path to compliance
- Discover where personal data lives across your systems.
- Map how it flows and build a Record of Processing Activities (RoPA).
- Identify and protect sensitive identifiers with encryption and masking.
- Rebuild your notices and consent to meet Sections 5–6.
- Stand up rights, grievance and breach processes.
- Put data-processing agreements in place with every vendor.
- Train your team, then audit — and keep evidence you can show.
Where DPDP Bridge fits
DPDP Bridge delivers all of this end to end — legal interpretation by advocates, executed on a platform that handles consent, PII protection, data mapping, breach, DPO services and audit. The result is compliance you can prove, in about 10–12 weeks.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.