The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to processing outside India that is connected with offering goods or services to people in India (section 3). Most businesses that hold customer or employee data are covered.
The hard part is not reading the Act. It is finding out what your organisation actually does with personal data. These questions are grouped by who is most likely to know the answer. Where the honest answer is “we don't know”, that is the gap.
Commencement dates and detailed procedures depend on the Rules made under the Act. This page cites sections of the Act and does not state dates, because they are set by notification. Check the current position on the website of the Ministry of Electronics and Information Technology and in the Gazette.
Know your data
Everything else depends on this. You cannot give notice of, protect or delete data you have not found.
- What personal data do we hold? Customers, employees, candidates, vendors, website visitors.
- Where does it live? Production databases, backups, spreadsheets, email, shared drives, SaaS tools, logs, analytics, support tickets.
- For each category, what is the purpose, and is it written down?
- Which of our vendors receive it, and in which countries?
- Do we collect anything we do not need?
Notice and consent, sections 5 and 6
- Do we give notice at or before collection, saying what data we collect, why, how to exercise rights and how to complain (section 5)?
- Is consent free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose (section 6)?
- Can a person withdraw consent as easily as they gave it?
- For data collected before the Act applied, have we planned to give notice as soon as reasonably practicable (section 5)?
- Where we rely on a “certain legitimate use” under section 7 instead of consent, have we written down which one and why it applies?
Security safeguards, section 8(5)
The Act requires reasonable security safeguards to prevent a personal data breach. What is reasonable is judged by what you could show you did.
- Is personal data encrypted in transit and at rest?
- Who can read production personal data, and is that access approved, minimal and reviewed?
- Do we log access to it, and does anyone look at the logs?
- Are backups protected to the same standard as production?
- When did we last test that we can detect and recover from an incident?
Breach readiness, section 8(6)
- Could we detect a breach, and how quickly?
- Do we know who decides that an incident is a personal data breach, and who tells the Data Protection Board and each affected person?
- Is there a written runbook, and has anyone rehearsed it?
- Do we know our separate duty to report certain incidents to CERT-In, which has its own six-hour window under its 2022 directions?
- Do our vendor contracts oblige them to tell us promptly?
Retention and erasure, section 8(7)
- Do we have a retention schedule, and does it say how long and why?
- When the purpose has ended or consent is withdrawn, can we actually delete the data from every system?
- What happens to it in backups and in logs?
- Can we make our processors delete it too?
Rights and grievances, sections 8(9), 8(10) and 11 to 14
- Can we give a person a summary of the personal data we hold and how we process it (section 11)?
- Can we correct, complete, update or erase it on request (section 12)?
- Have we published the contact details of the person who can answer questions, and set up a grievance process (sections 8(9), 8(10) and 13)?
- Do we know how long the Rules give us to respond?
- Can a person nominate someone to exercise their rights if they die or cannot (section 14)?
Children, section 9
- Do we knowingly collect data from anyone under 18?
- If so, do we obtain verifiable parental consent?
- Do we avoid tracking, behavioural monitoring and targeted advertising aimed at children?
Vendors, transfers and larger fiduciaries
- Do we have written contracts with every processor, covering security, breach notice, sub-processors and deletion (section 8(2))?
- Does any data leave India, and have we checked the current list of restricted countries (section 16)?
- Might we be notified as a Significant Data Fiduciary (section 10)? If so, we would need an India-based Data Protection Officer, an independent data auditor and periodic impact assessments.
Why this is worth doing early
The Schedule to the Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify the Board and affected people of a breach. The amounts are ceilings, and the Board weighs the circumstances, but they show where the Act puts its weight: on security and on breach response.
References
- The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), Ministry of Electronics and Information Technology
- CERT-In, directions under section 70B(6) of the IT Act, 28 April 2022
This is general guidance for engineers and managers, not legal advice. Obligations depend on your sector, your contracts and the rules in force on the day, so confirm the current position with your counsel and the regulator before relying on it.