India’s digital economy has made personal data one of the most valuable assets for modern businesses. Customer information, employee records, contact databases, financial details and online identifiers are routinely collected and processed. With the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), businesses must now treat data protection as a core legal and governance responsibility, not merely an IT issue.
At Legum Solis, our Technology, Data & Privacy practice helps businesses develop legally resilient data governance frameworks and navigate India’s evolving privacy regime.
What Is the DPDP Act 2023?
The Digital Personal Data Protection Act, 2023 is India’s principal framework for processing digital personal data. It sets out the obligations of organisations that process personal data and recognises the rights of individuals, referred to as Data Principals.
Businesses that determine the purpose and means of processing personal data generally fall within the concept of a Data Fiduciary.
The important point for businesses is straightforward: if your organisation collects or processes personal data digitally, you should assess your DPDP compliance position now.
What Is the DPDP Compliance Timeline?
The DPDP Act and DPDP Rules follow a phased commencement framework rather than a single compliance deadline. The Rules were notified in November 2025, and their provisions come into force in three stages:
- November 2025 (immediately): The foundational provisions, including definitions and the establishment of the Data Protection Board of India.
- November 2026 (after 12 months): The provisions relating to Consent Managers and their registration.
- May 2027 (after 18 months): The substantive obligations on Data Fiduciaries, including notice, consent, Data Principal rights, security safeguards, breach reporting, children’s data and the enforcement and penalty framework.
The phased approach gives businesses time to update their data practices, contracts, privacy notices, security measures and internal processes. It should not be mistaken for permission to postpone compliance planning. A serious compliance programme requires legal, operational and technological changes that cannot be completed overnight, and the Data Protection Board is already in place.
1. Identify What Personal Data Your Business Collects
The first step is a personal data inventory. Businesses should identify:
- What personal data is collected
- Whose data is being collected
- Why the data is being processed
- Where it is stored
- Who can access it
- Which vendors or third parties receive it
- How long it is retained
- When it is deleted
This exercise should cover websites, mobile applications, CRM systems, HR platforms, marketing databases, cloud services and other business applications. Without understanding your data flows, it is difficult to build meaningful DPDP compliance.
2. Review Your Consent Mechanisms
Consent is an important legal basis under the DPDP framework. The Act requires consent to be free, specific, informed and unambiguous, and it provides for the withdrawal of consent. The Act also recognises certain “legitimate uses” for which personal data may be processed without consent, so businesses should map each processing activity to the correct basis rather than assume consent is always required.
Businesses should review their existing:
- Website consent banners
- Privacy notices
- App permissions
- Marketing opt-ins
- Customer registration forms
- Employee data processes
- Email and SMS marketing mechanisms
A generic privacy policy copied from another website is unlikely to be an adequate compliance strategy. Your consent architecture should correspond with the way your organisation actually collects and processes personal data.
Businesses that handle children’s data should also note that the framework requires verifiable parental or guardian consent, subject to the exemptions provided under the Rules.
3. Update Your Privacy Notice
A compliant privacy notice should communicate relevant information to Data Principals in a clear and accessible manner. Businesses should review whether their current privacy policy accurately explains their data-processing activities, their purposes and the mechanisms available to individuals.
The policy should also be consistent with the organisation’s actual internal practices. A legally sophisticated privacy policy cannot protect a company if its employees, systems and vendors operate differently.
4. Establish Data Principal Rights Processes
The DPDP Act gives individuals various rights concerning their personal data, including rights relating to access to information, correction and erasure, grievance redressal and nomination, subject to the statutory framework.
Businesses should establish an internal mechanism for receiving, verifying, tracking and responding to such requests. This means assigning responsibility, creating standard operating procedures and maintaining an auditable record of requests and responses.
5. Strengthen Data Security and Breach Response
Data protection compliance is also a cybersecurity responsibility. The DPDP framework requires Data Fiduciaries to maintain reasonable security safeguards. In the event of a personal data breach, the framework requires notification to the Data Protection Board and to affected Data Principals, within the timelines prescribed under the Rules.
Businesses should therefore maintain a documented data breach response plan covering identification, containment, investigation, notification and remediation. Your legal team and your technology and security teams should know their respective responsibilities before an incident occurs.
6. Review Contracts With Vendors and Processors
Many businesses do not directly manage every system in which personal data is stored or processed. Cloud providers, SaaS platforms, payroll companies, CRM providers, marketing agencies and technology vendors may handle personal data on behalf of an organisation.
Companies should therefore conduct a data protection contract review covering confidentiality, security safeguards, breach reporting, data use, retention, deletion and allocation of liability. Vendor due diligence should become part of the organisation’s broader DPDP compliance programme.
Businesses that transfer personal data outside India should also review the applicable cross-border transfer position, as the Act permits transfers subject to such restrictions as the Central Government may notify.
7. Prepare for Higher Compliance Obligations
Certain organisations may be notified as Significant Data Fiduciaries, which brings additional statutory obligations, such as periodic audits and data protection impact assessments.
Businesses operating large-scale digital platforms, or processing substantial volumes or sensitive categories of personal data, should monitor regulatory developments closely and assess whether enhanced governance requirements may apply to them.
A Practical DPDP Compliance Checklist
Before the applicable compliance requirements become enforceable for your business, management should ideally have:
- A documented personal-data inventory
- A data-flow map
- Updated privacy notices
- Proper consent mechanisms
- Data-retention and deletion policies
- Data Principal request procedures
- Vendor and processor agreements
- Security safeguards
- Data-breach response procedures
- Employee data-handling protocols
- Internal compliance ownership and accountability
- Periodic legal and technology audits
Why Legal Advice Matters
DPDP compliance is not simply about drafting a privacy policy. It requires alignment between law, technology, contracts, business processes and corporate governance.
At Legum Solis, our Technology, Data & Privacy practice advises businesses on DPDP Act compliance, data governance, cybersecurity, incident response, technology contracts and SaaS agreements. Our objective is to help organisations build practical compliance frameworks that withstand regulatory scrutiny while remaining commercially workable.
Frequently Asked Questions
- What is the DPDP Act 2023?
The Digital Personal Data Protection Act, 2023 is India’s framework governing the processing of digital personal data. It establishes obligations for Data Fiduciaries and provides rights to individuals, known as Data Principals. - When does the DPDP Act become applicable to businesses?
The DPDP Act and DPDP Rules follow a phased commencement framework rather than a single universal deadline. The Data Protection Board provisions are already in force, the Consent Manager provisions follow at 12 months, and the main obligations on Data Fiduciaries apply from May 2027. Businesses should identify which provisions apply to them and plan accordingly. - Who needs to comply with the DPDP Act?
Businesses and other organisations that determine the purpose and means of processing digital personal data may qualify as Data Fiduciaries and must comply with the applicable obligations. The framework can also apply to entities outside India that process personal data in connection with offering goods or services to individuals in India. - What are the key DPDP compliance requirements for businesses?
Businesses should assess their data inventory, privacy notices, consent mechanisms, Data Principal request procedures, security safeguards, breach response processes and vendor contracts. Compliance should be aligned with the organisation’s actual data-processing practices. - What is a Data Fiduciary under the DPDP Act?
A Data Fiduciary is a person or organisation that determines the purpose and means of processing personal data. Data Fiduciaries are responsible for complying with the obligations applicable to them under the DPDP Act and Rules. - What happens if a business fails to comply with the DPDP Act?
Non-compliance can expose an organisation to regulatory action and significant financial penalties under the Act, which can extend up to ₹250 crore for certain violations such as failure to maintain reasonable security safeguards. Businesses should identify compliance gaps early and implement appropriate legal, technical and organisational measures before the relevant provisions become enforceable.
Conclusion
The DPDP Act 2023 represents a significant shift in how businesses in India must approach personal data. With the DPDP Rules, 2025 notified and the phased enforcement framework moving into operation, businesses should not wait for the final compliance date before beginning implementation.
The right approach is proactive: understand your data, identify your legal obligations, fix contractual and operational gaps, strengthen security controls and establish a repeatable privacy governance framework.
Legum Solis assists businesses in navigating India’s evolving technology and data protection landscape with strategic legal advice tailored to their operational realities.