DPDP Act compliance for businesses

The Digital Personal Data Protection Act, 2023 applies to any business that handles personal data in digital form — customer lists, patient records, payroll, student details or CCTV logs. The DPDP Rules, 2025 were notified on 14 November 2025, with an eighteen-month period for phased compliance.

What compliance involves

• Data mapping — what personal data you collect, why, where it is stored and who can access it.
• Notice and consent — clear, specific consent that is as easy to withdraw as to give.
• Security safeguards and access controls proportionate to the data held.
• Retention and erasure — deleting data once its purpose is served, unless a law requires it to be kept.
• Vendor contracts — terms that bind processors handling data on your behalf.
• Breach response — informing the Data Protection Board and affected individuals; the Rules require a detailed report to the Board within 72 hours.
• Data principal rights — access, correction, erasure, grievance redressal and nomination.
• Children's data — verifiable parental consent for anyone under 18.

Penalties under the Act

Who should start now

Clinics, schools and coaching centres, housing societies, retailers with customer databases, fintech and SaaS businesses, and any employer holding staff records. Preparation — mapping data, rewriting notices, changing vendor contracts — usually takes most of the transition period.

Frequently asked questions

This page is general information on the law as it stood when written, not professional advice for any specific case. Rules, forms and due dates change; check the current position before acting.