Services › DPDP

DPDP Act Readiness

India's Digital Personal Data Protection Act, 2023 applies to almost every Indian business handling personal data. Get ahead of it.

India:All customer data is stored and processed in India. Our infrastructure runs in Indian data centre regions, and no customer data is replicated outside the country.

The Situation

The Digital Personal Data Protection Act 2023 applies to almost every business in India that handles personal data, which in practice means almost every business. Unlike GDPR, it arrived without a long run-in during which the market built up expertise, so most organisations are working from summaries rather than the text.

The practical problem is rarely the principles, which are reasonable and familiar. It is that the Act requires things most companies cannot currently do: erase a person's data on request across every system that holds it, show the basis on which it was collected, and notify the Data Protection Board of a breach within a timeframe that assumes you already know what you hold and where.

That is a data-mapping problem before it is a legal one. The companies that struggle are not the ones with bad policies; they are the ones that cannot answer "where is this person's data" without asking four teams.

Who This Is For

Any Indian company processing digital personal data, and Significant Data Fiduciaries facing the additional audit and DPO obligations.

What You Get

  • Applicability assessment, including Significant Data Fiduciary analysis
  • Personal data inventory and processing map
  • Consent architecture and notice design
  • Data principal rights procedure, including grievance redressal
  • Breach notification procedure aligned to the Act
  • Processor contracts and due diligence framework
  • Gap analysis against GDPR where you already hold that

What We Usually Find

Not a list of everything possible — the things that come up again and again, in roughly the order they come up.

  • No record of what personal data is held, where it lives, or which third parties it reaches
  • Consent collected once at sign-up and treated as permanent, with no mechanism to withdraw it
  • Personal data in systems nobody counted: support tickets, analytics, spreadsheets, backups and chat logs
  • No way to erase one person's data without manually touching several systems, so erasure requests go unanswered
  • Processors engaged with no contract covering personal data, which makes the Data Fiduciary liable for their handling
  • Breach response plans that do not account for the notification obligation under section 8(6)
  • No named person responsible for grievance redressal, which section 13 requires you to publish

How the Engagement Runs

  1. ScopeWhat the Act requires of your organisation specifically.
  2. InventoryPersonal data, purposes, consent and retention.
  3. DesignNotices, consent capture and rights handling.
  4. ImplementContracts, procedures and technical safeguards.

Questions We Are Asked

Does the DPDP Act apply to my company?

If you process the personal data of people in India, almost certainly yes, regardless of company size. The Act has no small-business exemption of the kind people expect. It also reaches processing outside India where that processing relates to offering goods or services within India.

What is the penalty for a DPDP breach?

Penalties run up to ₹250 crore for failing to prevent a personal data breach, with other categories attracting lower caps. More practically, the penalty structure rewards being able to show you took reasonable safeguards, which is a documentation problem as much as a technical one.

What is the difference between a Data Fiduciary and a Data Processor?

The Fiduciary decides why and how personal data is processed and carries the obligations. The Processor acts on the Fiduciary's instructions. If you collect customer data and use a SaaS tool to store it, you are the Fiduciary and the vendor is your Processor, and you remain answerable for what they do with it.

How is DPDP different from GDPR?

DPDP is shorter, has fewer lawful bases, and leans heavily on consent and 'legitimate uses'. It has no equivalent of GDPR's legitimate-interests balancing test, no data-protection-officer requirement for most organisations, and different breach-notification mechanics. A GDPR programme is a strong starting point but is not compliance by itself.

We already have ISO 27001. Is that enough?

No. ISO 27001 is about securing information generally; DPDP is about the rights of individuals over their personal data specifically. An ISMS helps you evidence safeguards, but it does not give you consent management, erasure, or grievance redressal.