India's first comprehensive data privacy law — the Digital Personal Data Protection Act, 2023 — was passed by Parliament on 11 August 2023. If your business collects a name, phone number, email address, or any other information about an Indian resident, this law applies to you. This guide explains everything a business owner needs to know, in plain language.
- What is the DPDP Act 2023?
- Why was it enacted?
- Key terms every business must know
- Who does the law apply to?
- What are the core obligations on businesses?
- What rights do individuals have?
- What are the penalties for non-compliance?
- What should your business do right now?
1. What is the DPDP Act 2023?
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first dedicated data privacy legislation. Enacted on 11 August 2023, it establishes a legal framework governing how businesses and organisations collect, store, process, and share the personal data of Indian residents.
Before the DPDP Act, India's data protection landscape was fragmented — the Information Technology Act, 2000 and its 2011 Rules provided some limited protection, but there was no comprehensive, modern privacy law. The DPDP Act fills that gap and brings India in line with global data protection standards like the European Union's GDPR (General Data Protection Regulation).
In simple terms: If your business collects any personal information about Indian users — their name, email, phone number, location, purchase history, health data, or anything else that can identify them — the DPDP Act sets the rules for how you must handle it.
2. Why Was the DPDP Act Enacted?
India is the world's most populous country and one of the fastest-growing digital economies. With over 900 million internet users and billions of digital transactions occurring daily, the volume of personal data being generated, collected, and processed in India is enormous.
Yet until 2023, Indian residents had almost no legal rights over their personal data. Businesses could collect data without clear consent, use it for undisclosed purposes, share it with third parties freely, and retain it indefinitely — with very little legal consequence.
The DPDP Act was enacted to address this by:
- Giving individuals legal control over their personal data
- Creating binding obligations on businesses that process data
- Establishing a regulatory authority — the Data Protection Board of India — to enforce the law
- Aligning India with global privacy standards, facilitating international business and data flows
- Building digital trust — the foundation of India's digital economy ambitions
3. Key Terms Every Business Must Know
The DPDP Act introduces specific legal terminology. Understanding these terms is essential for every business owner:
4. Who Does the DPDP Act Apply To?
The DPDP Act has a very broad territorial scope. It applies to:
- Any business in India that processes digital personal data of Indian residents
- Any business outside India that processes personal data of Indian residents in connection with offering goods or services to them
This means the law applies equally to:
Important: There is no revenue threshold, employee count minimum, or "small business exemption" under the DPDP Act. Even a sole proprietorship with a website contact form is processing personal data and falls within the law's scope.
5. Core Obligations on Businesses (Data Fiduciaries)
As a Data Fiduciary, your business must meet the following core obligations:
Obtain Valid Consent Before Collecting Data
Before collecting any personal data, you must provide a clear privacy notice and obtain a specific, informed, voluntary consent from the individual. The consent must be for a defined purpose — you cannot collect data for "future unspecified uses."
Use Data Only for the Stated Purpose
Personal data collected for one purpose cannot be used for another without fresh consent. If you collect an email address to send a purchase receipt, you cannot use that same email for marketing campaigns without a separate, specific consent.
Collect Only What You Need (Data Minimisation)
You may only collect personal data that is necessary for the stated purpose. Collecting additional data "just in case it might be useful later" is a violation of the data minimisation principle under the Act.
Implement Reasonable Security Safeguards
You must implement appropriate technical and organisational security measures to protect personal data from breaches, unauthorised access, and accidental loss. The standard is "reasonable security practices" — proportionate to the sensitivity and volume of data you hold.
Delete Data When It Is No Longer Needed
Personal data must not be retained beyond the period necessary for the purpose it was collected. When the purpose is fulfilled and no legal retention obligation exists, the data must be erased — including from backups and vendor systems.
Notify Breaches to the Board and Affected Users
In the event of a personal data breach, you must notify the Data Protection Board and every affected individual within the prescribed timeframe. The notification must contain specific mandatory information — and failure to notify is a separate violation from the breach itself.
Appoint a Grievance Officer
Every Data Fiduciary must designate a Grievance Officer with their contact details published on the website and in the privacy policy. This officer must receive, acknowledge, and resolve user privacy complaints within prescribed timelines.
Special Protections for Children's Data
Processing personal data of children (under 18) requires verifiable parental consent. Businesses must implement age-verification mechanisms and are prohibited from behavioural tracking, targeted advertising, or any processing that may harm children.
6. Rights of Individuals (Data Principals)
The DPDP Act grants every Indian individual a set of legally enforceable rights over their personal data. Your business must have functioning mechanisms to honour all of these rights:
7. Penalties for Non-Compliance
The DPDP Act establishes a tiered penalty structure. The Data Protection Board has the power to investigate complaints and impose financial penalties — and the amounts are significant:
| Violation | Maximum Penalty |
|---|---|
| Failure to take security safeguards leading to a data breach | ₹250 Crore |
| Failure to notify breach to Board or affected individuals | ₹200 Crore |
| Non-fulfilment of obligations for children's data | ₹200 Crore |
| Failure to fulfil additional obligations of Significant Data Fiduciary | ₹150 Crore |
| Breach of any other obligation under the Act | ₹50 Crore |
| Obstruction of the Board's proceedings | ₹10 Crore |
Critical point: These penalties can be imposed per violation — not just per incident. A business that processes data of 10,000 users without valid consent has potentially committed 10,000 separate violations. Penalties are not capped at a single amount per investigation.
8. What Should Your Business Do Right Now?
If you have read this far, you understand that the DPDP Act creates real, enforceable obligations for your business. Here is a practical 8-step action plan to get started:
The Bottom Line
The DPDP Act 2023 is not a future obligation — it is a present legal reality for every business processing personal data of Indian residents. The penalties are severe, the obligations are clear, and the Data Protection Board has the power to investigate and penalise.
The good news: compliance is achievable. With the right legal guidance, most businesses can build a solid DPDP compliance foundation without disrupting their operations — and in doing so, they build the digital trust that is increasingly a competitive advantage.
Book a Free DPDP Consultation →
