If your business collects, stores, or otherwise processes digital personal data, India’s Digital Personal Data Protection (DPDP) Act, 2023, may affect how you handle that information. Understanding whether the Act applies to your activities and what obligations you will have is the first step towards preparing for compliance.
It is called the Digital Personal Data Protection Act, or DPDP. You may have heard the term without being fully sure what it means for you, whether your business is even covered, or where to start. This is the first post in a series built to walk you through exactly that, one practical piece at a time, and it starts here with the basics.
What DPDP actually is
The Digital Personal Data Protection Act, 2023, is India’s first comprehensive law governing how businesses collect, use, and protect the personal data of individuals.
The DPDP Act, 2023, establishes a framework for processing digital personal data in India. It applies to digital personal data processed within India and, in specified circumstances, to processing outside India connected with offering goods or services to individuals in India. The Act also contains exclusions, so its applicability depends on the nature and circumstances of the processing.
If your business collects a customer’s name, email, phone number, or any other piece of personal data digitally, DPDP has something to say about how you handle it.
That is the short version. Here is what actually matters for you.
Where DPDP came from
In 2017, the Supreme Court of India ruled that privacy is a fundamental right under the Constitution. That single judgment set off a process of drafting, consultation, and revision that took six years and two false starts before India actually had a law.
The first draft of India’s data protection legislation was submitted in 2018 following recommendations from a government-appointed committee. The Personal Data Protection Bill was introduced in Parliament in 2019 but was withdrawn in 2022. The government subsequently introduced the Digital Personal Data Protection Bill, 2023, which was passed by Parliament and received presidential assent in August 2023.
It is worth knowing this, because it tells you something useful: this was not a law rushed into existence. It was deliberately simplified after an earlier, more complicated version failed to gain traction, which is part of why the final version reads more plainly than most legislation. If you want the complete blow-by-blow, including every committee and draft along the way, we have laid it out in the full DPDP timeline.
But a law without operating rules only tells you the general idea, not exactly how it works day to day. That is what the DPDP Rules, notified in November 2025, were for. They turned the Act’s broad principles into specific, actionable requirements: what a valid consent notice must say, how fast a breach must be reported, what additional requirements may apply to Significant Data Fiduciaries.
Where we are right now
As of today, India is in what most compliance experts are calling the “build year.” Here is the phased rollout:
- Phase 1 (November 2025): The Data Protection Board of India, the body that will enforce DPDP, was formally established
- Phase 2 (13 November 2026): Consent Manager registration provisions are scheduled to commence. Eligible entities can apply to register under the DPDP framework, but this does not mean that Consent Manager platforms will automatically be operational on that date. Read our dedicated Consent Manager post
- Phase 3 (May 2027): The remaining major provisions of the Act and Rules are scheduled to commence, including many of the core obligations relating to notices, consent, personal data breach notifications and Data Fiduciary responsibilities
Implementation is phased, so not every provision begins on the same date. Businesses should identify which provisions are already in force and which are scheduled to commence later.
So no, DPDP is not fully “live” in the sense of penalties landing on your desk tomorrow. But the clock is running, and 2026 is the year businesses are expected to actually build their compliance infrastructure, not the year to start thinking about whether they should.
Why “we’ll deal with it later” is a risky bet
According to a PwC India survey, only 16% of Indian consumers understand what the DPDP law actually gives them the right to do, and more than half do not know they have rights over their personal data at all.
That gap will not last. As awareness grows, and as the Consent Manager framework makes it easier for people to see exactly who holds their data, businesses that have not done the groundwork will find themselves catching up in public, not in private. The businesses that get ahead of DPDP now are the ones who will not be scrambling when Phase 3 enforcement begins.
There is also a very concrete number worth remembering: penalties under DPDP can run up to ₹250 crore for the most serious violations, such as failing to maintain reasonable security safeguards. That is not a fine you absorb and move on from. It is a boardroom conversation.
Who actually needs to pay attention
Short answer: If your business handles digital personal data, check whether the DPDP Act applies to you. The rules may vary depending on your activities and applicable exemptions, not just your company size.
DPDP recognises a few core roles, and where you fall changes what you are responsible for:
- Data Principal is simply the individual whose data it is. Your customer, your employee, your website visitor.
- Data Fiduciary is any organisation that decides why and how personal data is processed. For example, when you book a ride through an app like Uber or Ola, the app itself is the Data Fiduciary. It decides what data is collected and why
- Data Processor is an entity that handles data on a Fiduciary’s behalf. If that same ride-hailing app stores your data on a cloud platform like AWS or Google Cloud, the cloud provider is acting as a Data Processor. It processes the data, but does not decide what happens to it
- Significant Data Fiduciary (SDF) is a Data Fiduciary that the Central Government notifies as such under Section 10 of the DPDP Act. The government considers relevant factors, including the volume and sensitivity of personal data processed, risks to individuals, and potential implications for national security and public order. SDFs have additional obligations, including appointing a Data Protection Officer based in India, appointing an independent data auditor, and undertaking periodic assessments and audits as prescribed
For now, the key takeaway is this: if your business handles digital personal data, assess whether the DPDP Act applies to your processing and which obligations or exemptions are relevant.
What to expect from the rest of this series
Over the next few posts, we will unpack the roles and terms in more depth, walk through a practical roadmap for building compliance through 2026, and show how the requirements shift depending on your company’s size and the industry you are in, whether that is healthcare, retail, financial services, IT and technology services, or anything else that touches personal data.
If your business collects, stores, or processes personal data digitally in India, this series is built for you, regardless of size or sector.
Frequently Asked Questions
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023, is India’s primary law governing how organisations collect, process, and protect the personal digital data of individuals in India.
When did the DPDP Act come into effect?
The Act was passed in August 2023. The operating Rules were notified in November 2025, and enforcement is being rolled out in three phases through May 2027.
Does DPDP apply to small businesses?
Yes. DPDP applies to any organisation processing digital personal data of individuals in India, regardless of size. However, some obligations scale differently depending on company size and risk profile. The DPDP Act may apply to small businesses as well as larger organisations, depending on the nature and circumstances of their data processing. Some additional obligations apply to specific categories, including Significant Data Fiduciaries, while statutory exclusions and exemptions may apply in certain circumstances. Businesses should assess their activities rather than assume that their size alone determines whether the Act applies.
What happens if a business does not comply with DPDP?
Penalties vary by violation type and can reach up to ₹250 crore for the most serious failures, such as not maintaining reasonable security safeguards.
Who is a Data Fiduciary under DPDP?
A Data Fiduciary is any organisation that decides why and how personal data is processed, such as a business collecting customer data to run its operations.
What is the Data Protection Board of India?
The Data Protection Board of India is the body established under DPDP to enforce the law, handle grievances, and impose penalties for non-compliance.
What is the difference between a Data Fiduciary and a Consent Manager?
A Data Fiduciary is any business that collects personal data and decides how to use it for its own purposes, such as an app collecting its customers’ details. A Consent Manager is a separate, registered intermediary that individuals use to manage their consents across many different Data Fiduciaries from one place. Most businesses are Data Fiduciaries; very few are Consent Managers.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
