What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India’s first comprehensive data protection law. The Digital Personal Data Protection Rules, 2025, notified in November 2025, fill in the practical details: what a notice must contain, how consent managers work, how breaches are reported and timelines for answering people.
The law calls a business that decides why and how personal data is used a Data Fiduciary, the person the data is about a Data Principal, and anyone who processes data on your behalf (software providers, call centres, couriers) a Data Processor.
Does it apply to my small business?
Almost certainly yes, if you hold customers’, patients’, students’ or employees’ details in software, Excel, WhatsApp, email or a website form. There is no blanket exemption for small businesses. The government can relieve startups from some extra duties, but the core duties of notice, consent, security and responding to people apply to everyone.
Purely personal or domestic use, and data that a person has made public themselves, fall outside the Act.
Key dates
| Date | What happens |
|---|---|
| 11 August 2023 | DPDP Act receives Presidential assent |
| November 2025 | DPDP Rules 2025 notified; Data Protection Board provisions start |
| November 2026 | Consent manager registration provisions apply |
| 13 May 2027 | Most obligations apply: notice, consent, security, rights, breach reporting, retention |
Your seven core duties
- Give a clear notice before or when you collect data: what you collect, why, how people can use their rights and how to complain to the Data Protection Board. It must be available in English or any of the 22 languages in the Eighth Schedule, so Hindi or your regional language helps.
- Take valid consent. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, for a specified purpose. Pre-ticked boxes and “by using this site you agree” do not count. Some uses (such as data a person gave voluntarily for a specific purpose, or legal requirements) are “legitimate uses” that don’t need consent.
- Make withdrawal as easy as giving consent. When someone withdraws, stop processing and get your processors to stop too.
- Keep data accurate and secure. Use reasonable security safeguards: access control, encryption or masking, backups, and logs of who accessed data. Keep logs for at least a year.
- Delete data you no longer need, once the purpose is served or consent is withdrawn, unless a law requires you to keep it.
- Answer people’s requests and grievances. Publish a contact for data questions and respond to grievances within 90 days.
- Report breaches. Inform the Data Protection Board and affected people without delay, and send the Board a detailed report within 72 hours.
Rights of your customers
- Get a summary of their personal data and how it’s used
- Correct, complete, update or erase their data
- Raise a grievance and get a response
- Nominate someone to act for them on death or incapacity
- Withdraw consent at any time
Children’s data
Anyone under 18 is a child under the Act. You need verifiable consent from a parent or lawful guardian, and you must not track, behaviourally monitor or target ads at children. Schools, coaching centres and ed-tech must plan for this.
What happens if you don’t comply?
The Data Protection Board can impose penalties of up to ₹250 crore per breach for failing to protect data, and up to ₹200 crore for not reporting a breach. See our penalties guide.
A 30-day plan for a small business
- Week 1: list every place you hold personal data (software, Excel, registers, WhatsApp) and why.
- Week 2: publish a privacy notice in English and Hindi, and name a contact person.
- Week 3: add consent to your forms, website and WhatsApp marketing, and start logging it.
- Week 4: set retention periods, tighten access and passwords, sign data terms with vendors, and write a one-page breach plan.
Use our 13-step DPDP checklist to track progress.
Frequently asked questions
Is DPDP compliance mandatory for small businesses?
Yes. There is no blanket small-business exemption. Core duties of notice, consent, security, responding to requests and breach reporting apply to any business processing digital personal data.
What is the DPDP compliance deadline?
Most obligations of the DPDP Rules 2025 apply from 13 May 2027, 18 months after the Rules were notified in November 2025.
Do I need a Data Protection Officer?
Only Significant Data Fiduciaries notified by the government must appoint a DPO based in India. Other businesses must still publish the contact details of a person who can answer questions about personal data.
Does the DPDP Act apply to offline data?
It applies to personal data collected in digital form, and to data collected offline that is later digitised, for example a paper form typed into software or a photo of a register.
Get DPDP-ready without a lawyer’s bill
ConsentKaro writes your privacy notice in English and Hindi, logs consent, and handles customer data requests. 14-day free trial, no card.
Start free trial → Take the free DPDP check