India’s first full data privacy law is here. The Digital Personal Data Protection Act, 2023 (DPDP Act) changes how every business in India must collect, store, and use your personal data. If you run a business, this law applies to you. If you are a customer, this law protects you.
In this guide, we explain the DPDP Act in simple words: what it says, who must follow it, what rights you get, what penalties exist, and what your business should do right now to stay compliant.
What Is the DPDP Act?
The DPDP Act is India’s law for protecting digital personal data. Personal data means any information that can identify you: your name, phone number, email address, location, photos, financial details, or health records. “Digital” means the data is in electronic form, or collected on paper and later digitised.
The Act received the President’s assent on 11 August 2023. The government then released the draft DPDP Rules in January 2025 for public feedback. These rules explain the day-to-day details: how consent should be taken, how fast breaches must be reported, and how the Data Protection Board will work. Enforcement is being rolled out in phases, which is why now is the right time to prepare.
Think of it this way. Earlier, companies could collect your data with a long terms-and-conditions page that nobody read. The DPDP Act flips this. Now the company must ask your clear permission first, tell you exactly why it needs your data, and delete it when the job is done.
Why Was This Law Needed?
Three simple reasons. First, India has over 900 million internet users, and almost every app and website collects personal data. Second, data leaks and fraud calls have become an everyday problem. When your number reaches a spammer, it usually leaked from some database. Third, most large economies already have privacy laws, such as the GDPR in Europe. India needed its own modern law so Indian citizens get the same protection and Indian businesses can trade data safely with the world.
In our work with clients, we see the same pattern again and again: businesses collect far more data than they need, store it in five different tools, and have no record of who gave permission for what. The DPDP Act forces companies to clean up this habit, and that is good for both customers and businesses.
Who Must Follow the DPDP Act?
The law applies to any business that handles digital personal data of people in India. It does not matter where your company is located. If you offer goods or services to people in India and process their data, even from outside India, the Act covers you.
- Startups and apps that collect names, emails, or phone numbers at signup.
- E-commerce stores that store addresses, order history, and payment details.
- Hospitals, schools, and banks that hold health, education, and financial records.
- Marketing teams that run email, SMS, and WhatsApp campaigns.
- Employers that keep employee records, attendance, and salary data.
A small shop that keeps a paper notebook of customer numbers is not covered until that data goes digital. But the moment you save customer details in a phone, Excel sheet, billing software, or website, the Act applies.
Key Players Under the Act (With a Simple Example)
Imagine you order food through an app. You are the customer, the app company uses your data, and a delivery partner also sees your address. The Act gives each role a name:
| Role | Simple meaning | Example |
|---|---|---|
| Data Principal | The person whose data it is (you) | You, the customer |
| Data Fiduciary | The company that decides why and how to use your data | The food delivery app |
| Data Processor | A helper hired by the company to handle data for it | The cloud company storing the app’s data |
| Consent Manager | A registered platform that helps you give or withdraw permission in one place | A consent dashboard app |
| Data Protection Board | The government body that hears complaints and issues penalties | The referee and judge |
The most important idea is the word fiduciary. It means the company must act in your interest while holding your data, the way a bank must protect your money. Your data is not the company’s property. It is your property, given on loan for a stated purpose.
Consent: The Heart of the DPDP Act
Consent is the foundation of the whole law. A company can use your data only if you agree, and the agreement must be free, clear, and specific. Pre-ticked boxes, hidden clauses, and “agree to everything or leave” screens do not count as valid consent.
Before taking your data, the company must share a simple notice that tells you what data it wants, why it wants it, how long it will keep it, how you can withdraw permission, and how to complain. This notice must be available in English and in Indian languages listed in the Constitution, so that ordinary people can actually understand it.
You can withdraw your consent at any time, and withdrawing must be as easy as giving it. If signup took one click, cancellation must also take one click. Once you withdraw, the company must stop using your data and delete it, unless some other law requires it to keep the data, such as tax records.
For example, a shopping app may ask for your phone number to send delivery updates. That is fair. But if the same app refuses to work unless you also share your contact list and photo gallery, that extra demand is not valid consent, because the extra data has nothing to do with delivering your order.
Your 6 Rights as a Citizen
The Act gives every person six clear rights over their own data. Memorise these, because you will use them:
Ask any company what data it holds about you and what it is doing with it.
Get wrong details fixed, completed, or updated without delay.
Ask the company to erase your data when the purpose is over or you withdraw consent.
Raise a grievance with the company first, then with the Data Protection Board if needed.
Choose another person to exercise your rights if you pass away or cannot act.
Take back your permission at any time, as easily as you gave it.
Here is how this works in real life. Suppose a fitness app still sends you offers one year after you deleted your account. Under the Act, you can write to the company and ask what data it still holds, demand deletion, and complain to the Board if it ignores you. The company must respond to grievances within fixed timelines, or face penalties.
What Your Business Must Do: A 10-Point Checklist
If you run a business, compliance is not one big project. It is ten small habits. Go through this checklist with your team:
DPDP Readiness Checklist for Businesses
✅ Map your data: list every personal data field you collect and where it is stored.
✅ Fix your notices: write a short, plain-language notice in English and regional languages.
✅ Take fresh consent: replace pre-ticked boxes with clear yes/no choices.
✅ Add easy withdrawal: one-click opt-out, account deletion, and unsubscribe.
✅ Set deletion rules: auto-delete data when the purpose ends or consent is withdrawn.
✅ Protect children’s data: verify age and take parent consent for users under 18.
✅ Secure your systems: encryption, access control, and regular security checks.
✅ Plan breach response: who informs the Board and customers, and how fast.
✅ Sign processor contracts: written agreements with every vendor touching your data.
✅ Publish grievance contacts: name a person and a clear complaint process with timelines.
From our experience, the two items businesses struggle with most are data mapping and deletion rules. Most teams do not know how many copies of customer data exist across Excel sheets, email inboxes, marketing tools, and old backups. Start there. You cannot protect or delete what you have not listed.
Penalties: What Happens If You Ignore the Law?
The Act sets some of the strictest fines in Indian law. The Data Protection Board can impose penalties of up to ₹250 crore per violation, depending on how serious the failure is and how the company responds.
The Board looks at the type of data involved, whether the failure was repeated, and whether the company fixed the problem quickly. A small business that makes an honest mistake and corrects it fast will be treated very differently from a large platform that ignores repeated breach reports.
Special Rules for Children’s Data
A child under the Act means anyone below 18 years of age. Before processing a child’s data, a company must take verifiable consent from a parent or guardian. In simple terms, a “confirm you are 18” checkbox is not enough. The company must actually check.
The law also bans three things completely for children: tracking their behaviour, showing them targeted advertisements, and any processing that can harm their well-being. So a gaming app cannot build an advertising profile of a 14-year-old, even with consent. Certain companies, such as healthcare or education services, may apply for exemptions for specific safe purposes, but the default rule is strict protection.
Data Breaches: Report Fast, Report Honestly
A breach means personal data was leaked, lost, stolen, or accessed without permission. Examples include a hacker downloading customer records, an employee emailing a customer list to a personal address, or a laptop with unencrypted data being stolen.
When a breach happens, the company must inform the Data Protection Board and also inform each affected person, in simple language, explaining what happened, what data was involved, what the person can do to stay safe, and how the company is fixing the problem. Hiding a breach is treated as a separate and serious violation with its own heavy penalty.
The practical lesson for businesses is to prepare before a breach. Keep an incident contact list ready, decide in advance who speaks to customers, and run a practice drill once a year. Companies that report quickly and help affected users get far more lenient treatment than companies that stay silent.
DPDP Journey So Far: A Quick Timeline
📌 2017: Supreme Court declares privacy a fundamental right (Puttaswamy judgment).
📌 2019–2022: Earlier data protection bills are drafted, debated, and withdrawn for rework.
📌 11 Aug 2023: DPDP Act receives the President’s assent and becomes law.
📌 Jan 2025: Draft DPDP Rules released for public consultation.
📌 2025–2026: Rules being finalised; phased enforcement expected. Businesses are advised to prepare now.
Where VR IT Services Pro Fits In
Reading the law is one thing. Applying it to your website, app, CRM, and marketing tools is another. That is where we help. Our team builds consent banners and preference centres, data-mapping audits, deletion workflows, children’s age-gate screens, and breach-response systems that match what the Act and the draft Rules demand. We also set up grievance redressal pages and multilingual privacy notices, so your compliance is visible to both customers and regulators.
If you are unsure where your business stands, start with a readiness check. List your data, fix your consent screens, and set deletion rules. Small steps now will save you from large penalties later. Talk to our team for a free DPDP readiness consultation.
Frequently Asked Questions
Does the DPDP Act apply to small businesses?
Yes. There is no exemption based on company size. If you handle digital personal data of people in India, the Act applies. Only the volume and risk of your data decide how heavy your duties are, such as whether you qualify as a Significant Data Fiduciary with extra duties like audits.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore per violation for failing to protect personal data and prevent breaches. Separate penalties apply for hiding breaches (up to ₹200 crore) and for mishandling children’s data (up to ₹200 crore).
Is consent needed for every use of data?
Almost always, yes, and it must be free, clear, and specific, with an easy way to withdraw. A few limited uses, such as state functions, legal claims, and emergencies, are allowed without consent. Normal business and marketing uses always need consent.
How can I delete my data from a company?
Contact the company and ask for correction or deletion, or use its in-app delete and opt-out options. If it ignores you, raise a grievance through its published complaint process, and then approach the Data Protection Board if the issue is still unresolved.
When will the DPDP Act be fully enforced?
The Act is law since August 2023. The detailed Rules were released in draft form in January 2025 and are being finalised, with phased enforcement expected after that. Businesses should prepare now rather than wait for the final date.
