What is the DPDP Act 2023? Complete Guide for Indian Companies
The Digital Personal Data Protection (DPDP) Act 2023 is India's first comprehensive data privacy legislation. Effective from September 2024, it fundamentally changes how Indian companies collect, process, and store personal data.
What is Personal Data?
Under DPDP, personal data is any information that identifies or can identify an individual. This includes:
Obvious Identifiers:
- Names, email addresses, phone numbers
- Postal addresses, financial account numbers
- Identification document numbers (Aadhaar, PAN, passport)
Sensitive Identifiers (heightened protection):
- Financial data (bank accounts, transaction history, credit scores)
- Health records and medical history
- Biometric data (fingerprints, face, iris, voice)
- Genetic data
- Caste, religion, political affiliation
- Sexual orientation, gender identity
Behavioral Data:
- Website browsing history
- Purchase history
- Location data
- Device identifiers
- Behavioral analytics
Key Requirements Under DPDP
1. Consent is Mandatory
You must collect explicit, informed, written consent before collecting personal data. Consent cannot be a condition for service unless the data is necessary for that service.
What This Means:
- Generic checkbox consent is not enough
- "Agree to our privacy policy" is not enough
- You must explain WHAT data you're collecting, WHY, and HOW you'll use it
- Consent must be given in a clear, granular manner
- Users can withdraw consent anytime
2. Data Minimization
Collect and process only the data you actually need. If you're building a newsletter signup, you don't need:
- Phone numbers (unless you'll SMS)
- Location data (unless necessary for the service)
- Employment history (unless relevant)
3. Purpose Limitation
Once you collect data for a specific purpose, you cannot use it for something else without new consent.
Example: If you collect email for marketing, you can't later use it for credit assessment without asking again.
4. Data Retention Limits
You cannot keep personal data indefinitely. Retention must be:
- Limited to the time needed for the specified purpose
- Defined upfront in your privacy policy
- Subject to user deletion requests
5. User Rights (Right to Data)
Users have a right to:
- Access: Get a copy of their data within 30 days
- Correction: Fix inaccurate data
- Deletion: Have their data erased (with exceptions for legal compliance)
- Portability: Get their data in a machine-readable format
- Grievance Redressal: Appeal if their rights are violated
6. Data Protection Officer (DPO)
You must appoint a DPO (or outsource this role) if you:
- Process large volumes of personal data
- Process sensitive data categories
- Conduct automated decision-making
7. Data Processor Agreements
If third parties process your data (cloud providers, email services, analytics platforms), you must have written agreements specifying:
- What data they process
- How they secure it
- How long they retain it
- Their obligations under DPDP
8. Breach Notification
If personal data is breached, you must notify:
- Affected individuals within 72 hours
- The Data Protection Board (in cases of significant risk)
Documentation is required for audit purposes.
Penalties for Non-Compliance
DPDP enforcement is strict:
| Violation | Penalty |
|---|---|
| General violations | Up to ₹5 crore or 5% of annual revenue (whichever is higher) |
| Serious violations | Up to ₹250 crore or 20% of annual revenue (whichever is higher) |
| Sensitive data mishandling | Up to ₹250 crore |
Criminal penalties (imprisonment) apply in cases involving repeated non-compliance, negligence, or intentional violations.
DPDP vs GDPR: Key Differences
| Aspect | DPDP | GDPR |
|---|---|---|
| Geographic scope | Indian residents' data | EU residents' data |
| Consent | Explicit consent required | Consent + legal basis |
| Fines | Up to ₹250 Cr | Up to €20 million or 4% revenue |
| DPO | Required for specific cases | Required for public authorities & large processors |
| Data breach | 72-hour notification | 72-hour notification |
DPDP is simpler and more prescriptive than GDPR but equally binding for Indian companies.
Who Needs to Comply?
- Indian companies collecting Indian residents' data
- Global companies with Indian users
- Startups even with small user bases
- SMBs processing customer data
Key Takeaway
DPDP is not a future concern—it's already active. Companies found non-compliant face massive fines, forced platform shutdowns, and criminal liability for leadership.
The time to prepare is now.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Consult a qualified data protection lawyer for your specific situation.
Next Step:
