Quick answer
The Digital Personal Data Protection (DPDP) Act 2023 applies to any organisation processing digital personal data of people in India. Businesses must collect valid consent, protect data with reasonable security safeguards, report breaches and honour user rights, or face penalties of up to ₹250 crore per instance.
What is the DPDP Act 2023?
The DPDP Act was passed by Parliament in August 2023 to protect the digital personal data of individuals (called Data Principals) while allowing lawful processing by organisations (called Data Fiduciaries). It applies to personal data collected digitally, or collected offline and later digitised.
The Act also applies outside India when a foreign company processes data in connection with offering goods or services to people in India. A Data Protection Board of India handles complaints, investigates breaches and imposes penalties.
Who must comply with the DPDP Act?
Almost every organisation that handles customer, employee or vendor data must comply. The Act defines three main roles, each with different responsibilities.
| Role | Who it is | Main responsibility |
|---|---|---|
| Data Principal | The individual whose data is processed | Exercises rights to access, correct, erase and nominate |
| Data Fiduciary | Organisation that decides purpose and means of processing | Full accountability for compliance and security |
| Significant Data Fiduciary | Fiduciary notified by government based on volume and risk | Extra duties: DPO, audits, DPIA |
| Data Processor | Vendor processing data on a fiduciary's behalf | Processes only under a valid contract |
| Consent Manager | Registered platform managing user consent | Lets users give, review and withdraw consent |
What are the key obligations for Data Fiduciaries?
The core of the Act is a set of duties that apply to every Data Fiduciary, regardless of size. These duties should shape your privacy programme.
- Give a clear notice describing the data collected and its purpose
- Obtain valid consent, and make withdrawal as easy as giving it
- Process data only for the stated, lawful purpose
- Keep personal data accurate and complete
- Apply reasonable security safeguards against breaches
- Report personal data breaches to the Board and affected users
- Erase data once the purpose is served or consent is withdrawn
- Get verifiable parental consent before processing children's data
What are the penalties under the DPDP Act?
The DPDP Act does not provide for compensation to individuals but sets heavy financial penalties through the Data Protection Board. Penalties apply per instance, so a single incident can be very expensive.
| Violation | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards | ₹250 crore |
| Failure to notify the Board or users of a breach | ₹200 crore |
| Breach of obligations relating to children's data | ₹200 crore |
| Breach of Significant Data Fiduciary obligations | ₹150 crore |
| Breach of Data Principal duties | ₹10,000 |
DPDP Act compliance checklist: step by step
Use this checklist to move from awareness to readiness. Most organisations complete the first four steps within a few weeks with expert support.
- Map all personal data: what you collect, where it lives, who can access it
- Run a DPDP gap assessment against current policies and controls
- Rewrite privacy notices and consent flows in plain language
- Classify vendors as Data Processors and update contracts
- Strengthen security with VAPT, access control, encryption and logging
- Build a breach detection and notification procedure
- Set up a grievance channel and a process for user rights requests
- Define retention periods and automate deletion
- Train staff who handle personal data
How does DPDP compare with GDPR?
Companies already following the EU's GDPR have a head start, but the DPDP Act differs in important ways.
| Aspect | DPDP Act 2023 | GDPR |
|---|---|---|
| Legal bases | Mainly consent plus listed legitimate uses | Six lawful bases |
| Sensitive data category | No separate category | Special category data |
| Children | Under 18, parental consent | Under 16 (varies by country) |
| Maximum fine | ₹250 crore per instance | 4% of global turnover or €20 million |
How KCyber Experts helps you become DPDP compliant
KCyber Experts is a CERT-In empanelled cybersecurity firm that has supported Indian organisations since 2016. Our DPDP service covers data discovery, gap assessment, consent and notice redesign, vendor reviews, security testing and DPO advisory.
Because we also run VAPT, SOC monitoring and incident response, we can show the Board that your 'reasonable security safeguards' are tested and working, not just written in a policy.
What should a DPDP-ready privacy notice include?
A privacy notice under the DPDP Act must be clear, standalone and available in English or any of the 22 languages in the Eighth Schedule of the Constitution. Keep it short and specific to the purpose of collection rather than a long legal document.
- The personal data collected and the purpose
- How to withdraw consent and exercise rights
- How to file a complaint with the Data Protection Board
- Contact details of the DPO or responsible person
Frequently asked questions
When does the DPDP Act come into force?
The Act was passed in August 2023 and the DPDP Rules bring obligations into force in phases, so businesses should start readiness now rather than wait.
Does the DPDP Act apply to small businesses?
Yes. It applies to any organisation processing digital personal data, though the government may exempt certain startups from some obligations.
Is a Data Protection Officer mandatory?
A DPO based in India is mandatory for Significant Data Fiduciaries. Others must still publish contact details for a person who answers data questions.
Does the DPDP Act apply to employee data?
Yes. Employee personal data is covered, although employment-related processing is a recognised legitimate use in some situations.
How long does DPDP readiness take?
Most mid-size organisations need 3 to 6 months to map data, fix gaps and implement consent and breach processes.