What the DPDP Act, 2023 means for your business
India's first comprehensive data protection law applies to nearly every business that collects personal data digitally — from a two-person online store to a hospital group. Here's what you need to know, without the legalese.
If you collect names, phone numbers or addresses — yes.
Under the Act you are a Data Fiduciary the moment you decide why and how personal data is processed. There is no turnover threshold and no blanket SME exemption.
- You take orders online or on WhatsAppCustomer names, numbers and addresses are personal data.
- You keep a customer or patient databaseCRMs, spreadsheets, billing software — all count.
- You run marketing campaignsEmail lists, SMS blasts and remarketing need valid consent.
- You employ peopleEmployee data — payroll, IDs, health records — is covered too.
Penalties under the Schedule to the Act
The Data Protection Board of India can impose monetary penalties for each breach of obligations. These are the ceilings:
- ₹250 CrFailure to take reasonable security safeguards to prevent a personal data breach.s.8(5)
- ₹200 CrFailure to notify the Board and affected Data Principals of a breach.s.8(6)
- ₹200 CrBreach of obligations relating to children's personal data.s.9
- ₹150 CrBreach of additional obligations of Significant Data Fiduciaries.s.10
- ₹50 CrBreach of any other provision of the Act or rules made under it.Schedule
- ₹10,000Breach of duties by a Data Principal (yes, users have duties too).s.15
Ceilings as per the Schedule; actual amounts are determined by the Board considering nature, gravity and duration of the breach.
The SME compliance checklist
Every Data Fiduciary must be able to demonstrate these. Each one maps to a BharathDPDP module.
- Give notice & take valid consentClear, itemised notices — in English or any Eighth Schedule language the user chooses. (s.5–6)
- Know your dataWhat you collect, why, where it's stored, who it's shared with, and when it's erased. (s.8)
- Honour user rightsAccess, correction, erasure and grievance redressal within reasonable time. (s.11–14)
- Secure the dataReasonable security safeguards against breaches. (s.8(5))
- Report breachesNotify the Data Protection Board and affected users when a breach occurs. (s.8(6))
- Control your vendorsProcess data through Data Processors only under a valid contract. (s.8(2))
Enforcement is coming in phases — start now.
- August 2023DPDP Act enacted
India's first comprehensive personal data protection law receives Presidential assent.
- 2025DPDP Rules notified
Detailed rules on consent notices, breach reporting, children's data and security safeguards operationalise the Act.
- Phased compliance windowsBusinesses expected to comply
Obligations come into force in phases — consent, notice and security duties apply to businesses of every size.
- Full enforcementData Protection Board active
Complaints, inquiries and penalties begin. Businesses that prepared early face audits calmly; the rest scramble.
Ready before the regulator asks.
Get your compliance baseline in 30 minutes with our guided assessment.