What the DPDP Act covers, in plain English
The Digital Personal Data Protection Act, 2023 is India’s law on how organisations handle personal data — anything that identifies a person, from a name and phone number to an order history or a medical report. It covers data collected digitally, and data collected on paper that you later type into a system.
The Act gives everyone a role. Your business is the Data Fiduciary: you decide why and how personal data is used. Your customers are Data Principals. Anyone who handles the data for you — your hosting company, SMS provider, CRM or developer — is a Data Processor, and you stay responsible for what they do with it.
The timeline: what applies when
| When | What applies |
|---|---|
| November 2025 | The DPDP Rules were notified and the Data Protection Board was set up. |
| November 2026 | The rules for consent managers — registered platforms that help people give, review and withdraw consent — come into force. |
| May 2027 | The main duties apply: notices, consent, security safeguards, breach reporting, children’s data and users’ rights. |
Write a notice people can actually read
Before you collect personal data, you must show a notice that makes sense on its own — not a link to a 20-page policy. For a sign-up form, a booking page or a checkout, that means:
- It lists the exact data you collect — name, phone, email, address — not just “your information”
- It says what each item is used for, in plain words
- It explains how to withdraw consent and how to make a complaint, including to the Data Protection Board
- It is shown where the data is collected, not hidden in the footer
- Users can read it in English or in another Indian language listed in the Constitution if they choose
- It links to your full privacy policy for the details
Consent that actually counts
Consent under the Act has to be free, specific, informed and given by a clear action. Several habits that are common on Indian websites don’t meet that bar:
- Pre-ticked boxes. The user has to tick or tap the box themselves.
- Bundled consent. Accepting your terms of service and agreeing to marketing messages are two separate choices.
- Asking for more than you need. A delivery app needs an address. It doesn’t need a date of birth or access to the phone’s contacts.
- Hard-to-find opt-outs. Stopping WhatsApp offers or deleting an account should be as easy as signing up was.
Some uses don’t need consent — the Act calls them “legitimate uses”, such as data someone gives you voluntarily for a specific purpose, or records the law requires you to keep. They are narrower than they sound, so check with a lawyer before relying on one.
Security safeguards to build in
The Rules ask for “reasonable security safeguards”. For a typical business website or app, these are the essentials:
- Personal data encrypted in transit (HTTPS everywhere) and at rest
- Every staff member has their own login, with access limited to what their role needs
- Logs of who viewed or changed personal data, kept for at least a year
- Daily backups, and a restore you have actually tested
- A written contract with every vendor that touches the data
- Data deleted once it is no longer needed for the purpose it was collected for
This is the part of the law with the biggest penalty: failing to take reasonable security safeguards can cost up to ₹250 crore. It also matters for ownership — every account and server holding customer data should belong to your business, as we explain in who owns the source code.
If something goes wrong: breach reporting
- 01
Tell the affected users
Without delay, and in plain language: what happened, which data was involved, the likely effect on them, what you are doing about it and what they can do to protect themselves.
- 02
Report to the Data Protection Board
An initial report straight away, followed by a detailed report. The Rules give 72 hours for the detailed report.
- 03
Fix the cause and learn from it
Close the gap, use your access logs to work out what was touched, and strengthen the safeguards that failed.
Write this plan down now, with names and phone numbers. In the middle of an incident nobody has time to work out who calls whom.
Children’s data needs extra care
Under the Act, a child is anyone under 18. Before processing a child’s data you need verifiable consent from a parent or guardian, and you may not track children’s behaviour or target advertising at them. If you are building for schools, coaching centres or young learners, the parent-consent flow has to be part of the first design, not a later patch.
Turn users’ rights into features
Every right in the Act maps to something in your product. Building them in early is much cheaper than handling each request by hand:
| Right | What to build |
|---|---|
| Access | A screen or email flow where users can see a summary of what you hold about them |
| Correction | Editable profile details, or a simple request form that reaches a real person |
| Erasure | Account deletion that actually removes data you don’t need to keep by law |
| Grievance | A named contact for privacy questions, with replies tracked until resolved |
| Nomination | A way for users to nominate someone to act for them |
Questions people ask
- Does the DPDP Act apply to small businesses?
- Yes. There is no minimum size — if you process the digital personal data of people in India, it applies. The heaviest extra duties fall on “Significant Data Fiduciaries”, large organisations the government names, not on a typical small business.
- Do I need a cookie banner under the DPDP Act?
- The Act doesn’t mention cookies by name. But if cookies collect personal data for advertising or analytics, the consent rules apply to them, so a clear banner with a real “reject” option is the safe approach.
- Can we store Indian users’ data on servers outside India?
- Generally, yes. The Act allows transfers abroad except to countries the government restricts. Some sectors, such as banking and payments, have their own localisation rules, so check what applies to your industry.
- Is this checklist legal advice?
- No. It is a practical checklist from a team that builds websites and apps. For your specific situation — especially in health, finance or education — speak to a lawyer who works on data protection.
Planning something like this?
Tell us what you want to build. You’ll get a written scope and a fixed quote before any work starts.