DPDP guide
DPDP Act 2023: a practical guide for Indian businesses
Published 28 October 2026 · Datrova Technologies
India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 set out how businesses must handle the personal data of people in India. This guide explains what they require in plain language, and what to do before the main obligations apply in May 2027.
Who the Act applies to
The Act covers digital personal data processed in India, whether collected online or collected offline and later digitised. It also covers processing outside India when it is connected to offering goods or services to people in India.
- Data fiduciary: the business that decides why and how personal data is processed.
- Data principal: the person the data is about. For children, this includes their parent or guardian.
- Data processor: a vendor that processes data on the fiduciary’s behalf.
- Consent Manager: a platform registered with the Data Protection Board that lets people give, manage and withdraw consent across businesses.
- Significant data fiduciary: a business the government designates because of the volume or sensitivity of its data, with extra duties such as audits and impact assessments.
What businesses must do
DPDP Act s.5
Notice
Tell people what personal data you collect, for which purpose, and how to withdraw consent and complain.
DPDP Act s.6
Consent
Consent must be free, specific, informed, unambiguous, given by a clear action, and as easy to withdraw as to give.
DPDP Act s.7
Legitimate uses
Some processing, such as providing a service the person asked for, does not need consent.
DPDP Act s.8
Retention and security
Erase data once the purpose is served or consent is withdrawn, and keep reasonable security safeguards.
DPDP Act ss.11–14
Rights
Access, correction, erasure, grievance redressal and nomination, answered within set time limits.
Businesses must also notify the Data Protection Board and each affected person when a personal data breach happens, and get verifiable parental consent before processing a child’s personal data.
The compliance timeline
November 2025
DPDP Rules notified
The Data Protection Board of India is set up and the phased rollout begins.
13 November 2026
Consent Managers
Registration and obligations for Consent Managers take effect.
13 May 2027
Full obligations
Notice, consent, rights, retention, security and breach duties apply to every data fiduciary.
Penalties
The Schedule to the Act sets maximum penalties for each kind of breach, imposed by the Data Protection Board:
- Up to ₹250 croreFailing to take reasonable security safeguards against a personal data breach
- Up to ₹200 croreFailing to notify a breach, or breaching the extra duties for children’s data
- Up to ₹50 croreBreaching any other provision of the Act or Rules, such as notice and consent
A readiness checklist
- List every place you collect personal data: website, app, branches, call centre, vendors.
- Write down each purpose, the data it uses, and whether it needs consent or is a legitimate use.
- Publish clear notices in the languages your customers read, with how to withdraw and complain.
- Record every consent against the notice version shown, and make withdrawal as easy as giving consent.
- Make sure a withdrawal reaches every system that uses the data, and that each one confirms.
- Set up a way for people to make rights requests, verify identity, and answer within the deadline.
- Set retention periods per purpose and delete data when they end, keeping proof of deletion.
- Prepare a breach response plan so you can inform the Board and affected people quickly.
- Keep evidence: an audit trail you can show the Data Protection Board or an auditor.
How Veritrail helps
Veritrail covers the record-keeping side of this checklist: multilingual notices, a consent ledger, withdrawal propagation to your systems, a rights request portal, retention and deletion with proof, and evidence reports you can verify.
Common questions
Does the DPDP Act apply to small businesses?
Yes. The Act applies to any business processing digital personal data of people in India. The government can exempt some classes of businesses, such as startups, from certain provisions by notification.
Do we always need consent to process personal data?
No. Section 7 lists legitimate uses, such as processing data a person voluntarily gave for a specific purpose, where consent is not needed. Other processing needs consent.
Is the DPDP Act the same as GDPR?
They share ideas such as notice, consent and rights, but differ in detail. For example, the DPDP Act has no separate category of sensitive data and uses legitimate uses instead of GDPR’s six lawful bases.
This guide is general information, not legal advice. Dates and penalties are taken from the Act and Rules as published; check the Gazette text and speak to your lawyer about your obligations.