India's Digital Personal Data Protection Act, 2023 (DPDPA) is the country's first comprehensive law on the processing of digital personal data. It sets out duties for organisations that decide why and how personal data is processed, rights for individuals, and a penalty regime that can reach ₹250 crore for the most serious security failures. The government has since notified rules under the Act with phased implementation timelines. Because details and dates matter, always check the current text of the Act, the rules and any official clarifications before making decisions.

This article gives a practical overview of what readiness looks like.

Key terms

  • Data Principal: the individual to whom the personal data relates. For children and certain persons with disabilities, this includes parents or lawful guardians.
  • Data Fiduciary: the person or entity that determines the purpose and means of processing, similar to a controller under other regimes.
  • Data Processor: an entity that processes personal data on behalf of a Data Fiduciary.
  • Significant Data Fiduciary: a Data Fiduciary designated by the government based on factors such as volume and sensitivity of data and risk to individuals, subject to additional obligations.
  • Consent Manager: a registered entity that enables individuals to manage consent.
  • Data Protection Board of India: the body that adjudicates breaches and imposes penalties.

Who must comply

The Act applies to the processing of digital personal data within India, and to processing outside India if it relates to offering goods or services to individuals in India. Digital personal data includes data collected digitally or non-digital data that is later digitised. It does not generally apply to personal data processed for purely personal or domestic purposes, or to certain publicly available data under specified conditions. Government agencies have particular exemptions under the Act.

If you operate an Indian business, handle customer, employee or user data, or serve Indian users from abroad, assume the Act is relevant and verify specifics.

Core obligations of Data Fiduciaries

Lawful processing. Personal data may be processed only for a lawful purpose, either with the individual's consent or for certain specified "legitimate uses" described in the Act, such as compliance with law, medical emergencies and certain employment-related purposes.

Notice. Before or when requesting consent, provide a clear notice describing the personal data and purpose, how to exercise rights and make complaints to the Board.

Valid consent. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the necessary purpose. Individuals must be able to withdraw consent as easily as they gave it.

Purpose limitation and data minimisation. Collect and use only what is necessary for the stated purpose.

Accuracy. Ensure data is complete, accurate and consistent where it is used to make decisions affecting the individual or disclosed to others.

Reasonable security safeguards. Implement appropriate technical and organisational measures to prevent personal data breaches.

Breach notification. Notify the Data Protection Board and affected individuals of personal data breaches, in the form and timelines prescribed by the rules.

Retention limits. Erase personal data when the purpose is served or consent is withdrawn, unless retention is required by law, and ensure processors do the same.

Children's data. Obtain verifiable consent of a parent or guardian before processing the personal data of a child (under 18), with additional restrictions on tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions the government may notify.

Grievance redressal. Provide an accessible mechanism and respond within prescribed timelines.

Processor management. Engage processors only under valid contracts, and remain responsible for compliance.

Rights of Data Principals

Individuals have the right to access a summary of their personal data and processing activities, to request correction and erasure, to grievance redressal, and to nominate another person to exercise rights in the event of death or incapacity. They also have duties, such as not filing false or frivolous complaints.

Penalties

The Act sets out a schedule of monetary penalties. The highest, up to ₹250 crore, applies to failure to take reasonable security safeguards to prevent a personal data breach. Other penalties apply, for example, for failure to notify the Board and affected individuals of a breach, breaches of obligations relating to children's data, and failures of Significant Data Fiduciaries. Penalties are determined by the Board having regard to factors like nature, gravity and duration of the breach, and mitigation efforts. Consult the Act's schedule for current figures.

A readiness roadmap

1. Map your data. Build an inventory of personal data: what you collect, from whom, where it is stored, who accesses it, which processors and vendors handle it and where it flows. Without this, nothing else is reliable.

2. Identify purposes and lawful bases. For each processing activity, document the purpose and whether you rely on consent or a legitimate use.

3. Redesign notices and consent. Update interfaces and forms so notices are clear and consent is granular and withdrawable. Maintain consent records.

4. Strengthen security safeguards. Align security controls with the risk to personal data: access control, encryption, logging, vulnerability management, backups and incident response. ISO 27001 and similar frameworks provide a recognised structure.

5. Build breach response. Define procedures for detecting, assessing and notifying breaches to the Board and individuals, integrated with CERT-In reporting and sector regulator requirements.

6. Establish rights handling. Create processes to receive, verify, fulfil and log requests for access, correction and erasure.

7. Manage retention and deletion. Define retention schedules and implement deletion routines, including at processors.

8. Update vendor contracts. Ensure processors commit to appropriate safeguards, breach notification, assistance with rights requests and deletion.

9. Address children's data. If you may process children's data, implement age assurance and verifiable parental consent approaches suited to your service.

10. Assign accountability. Appoint a responsible lead or privacy function, train staff, and report to senior management. Significant Data Fiduciaries must appoint a Data Protection Officer based in India and conduct periodic audits and impact assessments.

Common gaps

  • No reliable data inventory.
  • Consent bundled with terms of service or pre-ticked.
  • Notices written in dense legal language.
  • No process for erasure across all systems and backups.
  • Vendor contracts silent on personal data obligations.
  • Security controls not aligned to personal data risk.
  • No tested breach notification workflow.

Start now

Implementation timelines are phased, but practical changes such as data mapping, consent redesign and retention clean-up take months. Starting early reduces cost and risk.

Assess your readiness

F9 Infotech provides DPDPA readiness assessments, data mapping, consent and notice redesign, security safeguard reviews and breach response planning. Start your DPDPA readiness assessment today.

This article is general information and not legal advice. Consult qualified counsel and the official text of the Act and rules.