DPDP Act : India’s Data Privacy Era Is Here. Are you Ready?

DPDP Act 2023: India’s Data Privacy Era Is Here. Is Your Business Ready?

Penalties of Up to INR 250 Crore: Why Boards Should Pay Attention

The DPDP framework has a strict penalty regime. Failing to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to INR 250 crore. Other defaults carry penalties of up to ₹200 crore, including failure to notify a breach and failure to meet obligations relating to children’s data.

So DPDP is not only a legal checkbox. It creates governance, operational, technology and reputational risk, and it belongs on the agenda of management and the board.

The Four Core Principles of DPDP Compliance

1. Informed consent. Personal data should be processed on the basis of consent that is free, specific, informed, unconditional and unambiguous, unless a legitimate use recognised under the Act applies. Individuals must be told clearly:

• what data is being collected,
• why it is being collected and how it will be used, and
• how they can withdraw consent.

2. Purpose limitation. Data collected for one purpose cannot be used for an unrelated purpose without fresh consent. For example, customer details collected to deliver a product cannot be used for marketing campaigns unless the customer has agreed to that.

3. Data minimisation. Collect only what you genuinely need for the stated purpose. If you do not need the data, do not collect it. Less data also means lower compliance and cyber-security exposure.

4. Accountability. Responsibility for compliance rests with the organisation that decides how data is processed. It must be able to show proper governance, security safeguards, documented procedures and ongoing monitoring. This applies even when the processing is outsourced.

Does the DPDP Act Apply to Your Organisation?

The scope of the Act is wide.

Digital personal data processed in India. This covers personal data collected in digital form, or collected offline and later digitised. In practice, it reaches:

• websites and mobile apps,
• CRM and customer databases, and
• payroll systems and employee records.

Extraterritorial reach. Organisations outside India are also covered if they process personal data in connection with offering goods or services to individuals in India. Foreign businesses with Indian customers therefore need to assess whether the Act applies to them.

Data Fiduciaries and Significant Data Fiduciaries

An organisation is a Data Fiduciary when it decides the purpose and means of processing personal data.

The Government may designate some entities as Significant Data Fiduciaries (SDFs). This is based on factors such as the volume and sensitivity of the data they handle and the risk their processing poses to individuals. SDFs carry additional obligations:

• appointing a Data Protection Officer based in India,
• appointing an independent data auditor,
• conducting periodic Data Protection Impact Assessments and audits, and
• meeting enhanced governance and verification requirements.

Rights of Data Principals

The Act puts the individual, called the Data Principal, at the centre. Organisations must build mechanisms to honour the following rights:

• Right to access information about the personal data being processed and with whom it has been shared.
• Right to correction, completion and updating of inaccurate or incomplete data.
• Right to erasure once the purpose is served, subject to legal retention requirements. For example, accounting and tax records must be kept for statutory periods.
• Right to grievance redressal through a readily available mechanism, with responses within the prescribed timelines.
• Right to nominate another person to exercise these rights in the event of death or incapacity.
• Right to withdraw consent as easily as it was given.

Two further protections complete the picture. Data Fiduciaries must inform affected individuals of a personal data breach. Individuals who remain dissatisfied after using the organisation’s grievance mechanism can complain to the Data Protection Board of India, and orders of the Board can be appealed to the Appellate Tribunal (TDSAT).

A Practical 10-Step DPDP Compliance Checklist

Step 1: Conduct a data audit. Map what personal data you collect, where it sits, who can access it and how long you keep it.

Step 2: Update privacy notices. Notices should be clear, standalone and written in plain language, free of legal jargon. They should also be available in English and the scheduled Indian languages where relevant.

Step 3: Build a consent management framework. Put systems in place that let users give, review and withdraw consent easily, and that keep a record of consent.

Step 4: Appoint a grievance contact. Designate a responsible person, or a DPO for SDFs, and publish their contact details.

Step 5: Establish internal procedures. Write SOPs for access, correction, erasure and consent-withdrawal requests, with defined timelines.

Step 6: Strengthen vendor compliance. Review contracts and controls for third parties that handle personal data on your behalf. These include cloud providers, payroll processors, CRM vendors and marketing agencies.

Step 7: Enhance data security. Implement:

• multi-factor authentication,
• encryption and access controls,
• logging, and
• regular vulnerability assessments and monitoring.

Step 8: Prepare a breach response plan. Cover detection, investigation, escalation, notification to the Data Protection Board and affected individuals within prescribed timelines, and remediation.

Step 9: Protect children’s data. Where users may be under 18, obtain verifiable parental consent. Avoid tracking, behavioural monitoring and targeted advertising directed at children.

Step 10: Review cross-border transfers. Evaluate where personal data leaves India. Monitor any countries the Government restricts, and any sector-specific localisation rules, such as those of the RBI.

DPDP vs GDPR: Is GDPR Compliance Enough?

Organisations already aligned with the EU’s GDPR have a strong head start, but GDPR readiness does not automatically mean DPDP compliance. India-specific requirements include:

• DPDP-format notices and consent management,
• local grievance redressal and timelines,
• specific rules on children’s data, and
• India’s approach to cross-border transfers and the Data Protection Board’s processes.

Why DPDP Compliance Makes Business Sense

Data protection is now part of corporate governance, cyber-risk management, customer trust, brand reputation and investor confidence. Businesses that build privacy into their processes early can turn compliance into a competitive advantage. Those that delay risk penalties, operational disruption, regulatory scrutiny and reputational damage.

Start Preparing Today

The organisations best placed for DPDP will not be the ones waiting for enforcement. They will be the ones that set up governance now, adopt privacy-by-design, train employees, tighten security and embed a culture of responsible data handling well before the deadline.

DPDP compliance is not just about avoiding penalties. It is about earning trust in a data-driven economy.

Organizations should use this period to strengthen their data governance practices, establish privacy frameworks, review consent mechanisms, implement security safeguards, train employees, and build a culture of responsible data handling. The focus must shift from simply understanding the law to actively implementing a structured compliance programme that ensures readiness well before the May 2027 deadline.

The organizations that act early will not only reduce compliance risks but also gain a competitive advantage by demonstrating their commitment to data privacy, transparency, and customer trust.

 KEY COMPLIANCE REQUIREMENTS FOR BUSINESSES

How IFCCL Can Help? 

Rajput Jain & Associates, Chartered Accountants, is a peer-reviewed firm headquartered in Connaught Place, New Delhi. We help organisations assess and implement DPDP readiness through:

• DPDP gap assessment and data mapping,
• privacy notices, consent frameworks, and SOPs,
• vendor and third-party compliance reviews,
• IT audit and cyber-risk assessment, and
• ongoing compliance audits and staff training.

**********************************************************

If this article has helped you in any way, i would appreciate if you could share/like it or leave a comment. Thank you for visiting my blog.

Legal Disclaimer:
The information / articles & any relies to the comments on this blog are provided purely for informational and educational purposes only & are purely based on my understanding / knowledge. They do noy constitute legal advice or legal opinions. The information / articles and any replies to the comments are intended but not promised or guaranteed to be current, complete, or up-to-date and should in no way be taken as a legal advice or an indication of future results. Therefore, i can not take any responsibility for the results or consequences of any attempt to use or adopt any of the information presented on this blog. You are advised not to act or rely on any information / articles contained without first seeking the advice of a practicing professional.