The DPDP Act passed in August 2023 and the central provisions are now operative. Unlike some regulations that arrive with long grace periods, this one is actively being watched. The Data Protection Board of India is being constituted, and enforcement mechanisms are being put in place. The time to build your compliance program is now — before a complaint is filed or an audit is triggered.
This guide walks through the Act's core concepts in plain language. No legal jargon. Practical enough to brief your product and engineering teams.
The Core Concept: Data Fiduciary and Data Principal
The DPDP Act uses two key terms consistently. A Data Fiduciary is any person or organisation that decides why and how personal data is processed — in most cases, this is your company. A Data Principal is the individual whose personal data is being processed — your users, customers, or employees.
If you collect, store, use, or share any personal data about Indian individuals in connection with any activity, you are a Data Fiduciary and the Act's obligations apply to you. There is no revenue threshold, no minimum number of users, no startup exemption.
The Seven Core Obligations for Data Fiduciaries
The Act imposes seven categories of obligation on every Data Fiduciary. Here is what each one requires in practice.
1. Lawful processing with valid consent: Personal data may only be processed for a lawful purpose with the Data Principal's consent, or for certain specified legitimate uses. Consent must be free, specific, informed, unconditional, and unambiguous. A pre-ticked checkbox is not valid consent. Bundling consent for multiple unrelated purposes in a single checkbox is not valid consent. You must be able to demonstrate that valid consent was obtained for every processing activity that relies on it.
2. Notice before or at the time of consent: Before collecting personal data, you must provide a clear notice in English or any of the 22 scheduled languages of India. The notice must describe what personal data is being collected, the purpose for which it will be processed, how the Data Principal can exercise their rights, and how they can file a complaint with the Data Protection Board. Buried privacy policies that require legal expertise to understand do not satisfy this requirement.
3. Purpose limitation: Personal data may only be used for the specific purpose for which consent was obtained. If you collect an email address for account creation, you cannot later use it for marketing campaigns without obtaining fresh consent for that specific purpose.
4. Data minimisation: Only collect data that is actually necessary for the stated purpose. If your product works perfectly well with a user's city but you are collecting their full home address, you are collecting more than you need. The Act requires you to collect only what is genuinely necessary.
5. Data accuracy: You must take reasonable steps to ensure personal data you hold is accurate and kept updated where necessary — particularly when inaccurate data could significantly affect the Data Principal.
6. Storage limitation: Personal data must not be retained longer than is necessary for the purpose for which it was collected. Once the purpose is fulfilled, data must be deleted. You need documented data retention policies specifying how long each category of data is kept and why that retention period is justified.
7. Security safeguards: You must implement reasonable security safeguards to prevent personal data breaches. The Act does not prescribe specific technical standards but reasonable safeguards for a technology company would include encryption at rest and in transit, access controls, regular security assessments, and an incident response plan.
A personal data breach must be reported to the Data Protection Board and affected Data Principals in a form and manner prescribed by the Board. The notification obligation is triggered by any breach — not just large ones. Build your breach response process before you need it, not during an incident.
Rights of Data Principals — What Your Users Can Demand
The Act gives Data Principals four core rights that you must be operationally ready to fulfil. These are not aspirational rights — they are enforceable.
Right to Information: Users can ask you what personal data you hold about them and how it is being processed. You must respond with a summary of that data and the processing activities.
Right to Correction and Erasure: Users can ask you to correct inaccurate personal data or erase data that is no longer necessary for the purpose it was collected for. You must have a process to fulfil these requests — and to communicate that fulfilment to any third parties to whom you have shared that data.
Right to Grievance Redressal: Users must have a readily accessible mechanism to raise grievances about how their data is being handled. You need a designated point of contact and a documented grievance response process with reasonable timelines.
Right to Nominate: Users can nominate another individual to exercise their data rights on their behalf in the event of death or incapacity. This is a uniquely Indian addition to data protection law — few global frameworks include it.
Significant Data Fiduciaries — Higher Obligations for Large Players
The central government may designate certain Data Fiduciaries as "Significant Data Fiduciaries" based on the volume and sensitivity of personal data they process, potential risk to data principals, national security considerations, or their impact on the rights of data principals.
Significant Data Fiduciaries face additional obligations beyond the standard framework including mandatory appointment of a Data Protection Officer, periodic Data Protection Impact Assessments, and algorithmic accountability requirements.
For most startups this designation is not immediately relevant — but as you scale, it is worth understanding that increased data processing volume could trigger these higher obligations.
Penalty Framework — The Numbers That Matter
The DPDP Act establishes a tiered penalty structure enforced by the Data Protection Board of India. The penalties are substantial enough that even a single enforcement action could be existential for a mid-sized startup.
Failure to implement reasonable security safeguards resulting in a personal data breach: up to ₹250 crore. Failure to notify the Board or affected data principals of a personal data breach: up to ₹200 crore. Violation of any obligation in relation to children's personal data: up to ₹200 crore. Failure to observe obligations as a Significant Data Fiduciary: up to ₹150 crore. Breach of any other provision of the Act: up to ₹50 crore.
These are maximum penalties — the Board will consider factors including the nature and gravity of the violation, the type and sensitivity of data involved, repetitive nature, and mitigating actions taken. But the scale of the maxima signals the seriousness of legislative intent.
Children's Personal Data — Special Obligations
If your product processes personal data of children — defined as individuals under 18 — you face additional requirements that apply regardless of whether you intend to serve children. You must obtain verifiable parental consent before processing a child's data. You cannot process personal data of children in a manner detrimental to their well-being. You are prohibited from tracking or behavioural monitoring of children. You cannot target advertising at children.
For many B2C products, particularly in education, gaming, and social platforms, children's data provisions require immediate attention.
How DPDP Act Compares to GDPR
If your company has already done GDPR compliance work, good news — there is significant overlap. Both require lawful basis for processing, transparency, individual rights, data minimisation, security safeguards, and breach notification. The conceptual foundations are similar.
Key differences worth noting: DPDP Act consent requirements are in some ways stricter than GDPR — the Act does not recognise legitimate interests as a lawful basis for processing the way GDPR does. GDPR has a richer set of individual rights including right to portability and right to object. DPDP Act penalty maxima are lower than GDPR but still substantial. DPDP Act has the unique right to nominate that GDPR does not.
If you are simultaneously building GDPR and DPDP Act compliance — which most Indian SaaS companies with EU users should be — design a unified program that satisfies both frameworks rather than building separate compliance architectures.
Practical Steps to Start This Week
Step 1 — Map your personal data. Document every type of personal data your product collects, the stated purpose for each, where it is stored, who has access, how long you keep it, and who you share it with. This data map is the foundation of your entire compliance program under both DPDP Act and GDPR.
Step 2 — Audit your consent mechanisms. Review every point in your product where you collect personal data. Is there a clear, specific consent mechanism? Is the user making an informed, active choice? Pre-ticked boxes and implied consent are non-compliant. Fix these first — they are visible to users and auditors alike.
Step 3 — Write or rewrite your privacy notice. It must be plain language, in English or relevant scheduled Indian language, covering all required information. Have someone without a legal background read it — if they cannot understand it, it needs to be rewritten.
Step 4 — Build your rights fulfilment process. Document how a user can request their data, request correction or erasure, and raise a grievance. Assign responsibility for handling these requests. Set response timelines. This process must actually work — not just exist on paper.
Step 5 — Review your data retention periods. For every category of personal data, set a maximum retention period and a deletion process. Data sitting in your database long after it is needed is both a compliance risk and a security risk.
Step 6 — Create a breach response plan. Know who declares a breach, who notifies the Data Protection Board, how you identify what data was affected, and how you communicate with affected users. Practise this plan before you need it.