What is the DPDP Act 2023? Complete Guide for Indian Companies

The Digital Personal Data Protection (DPDP) Act 2023 is India's first comprehensive data privacy legislation. Effective from September 2024, it fundamentally changes how Indian companies collect, process, and store personal data. dpdp penalties explained

What is Personal Data?

Under DPDP, personal data is any information that identifies or can identify an individual. This includes:

Obvious Identifiers:

• Names, email addresses, phone numbers
• Postal addresses, financial account numbers
• Identification document numbers (Aadhaar, PAN, passport)

Sensitive Identifiers (heightened protection):

• Financial data (bank accounts, transaction history, credit scores)
• Health records and medical history
• Biometric data (fingerprints, face, iris, voice)
• Genetic data
• Caste, religion, political affiliation
• Sexual orientation, gender identity

Behavioral Data:

• Website browsing history
• Purchase history
• Location data
• Device identifiers
• Behavioral analytics

Key Requirements Under DPDP

1. Consent is Mandatory

You must collect explicit, informed, written consent before collecting personal data. Consent cannot be a condition for service unless the data is necessary for that service. dpdp vs gdpr

What This Means:

• Generic checkbox consent is not enough
• "Agree to our privacy policy" is not enough
• You must explain WHAT data you're collecting, WHY, and HOW you'll use it
• Consent must be given in a clear, granular manner
• Users can withdraw consent anytime

2. Data Minimization

Collect and process only the data you actually need. If you're building a newsletter signup, you don't need:

• Phone numbers (unless you'll SMS)
• Location data (unless necessary for the service)
• Employment history (unless relevant)

3. Purpose Limitation

Once you collect data for a specific purpose, you cannot use it for something else without new consent.

Example: If you collect email for marketing, you can't later use it for credit assessment without asking again.

4. Data Retention Limits

You cannot keep personal data indefinitely. Retention must be:

• Limited to the time needed for the specified purpose
• Defined upfront in your privacy policy
• Subject to user deletion requests dpdp fiduciary principal processor

5. User Rights (Right to Data)

Users have a right to:

• Access: Get a copy of their data within 30 days
• Correction: Fix inaccurate data
• Deletion: Have their data erased (with exceptions for legal compliance)
• Portability: Get their data in a machine-readable format
• Grievance Redressal: Appeal if their rights are violated

6. Data Protection Officer (DPO)

You must appoint a DPO (or outsource this role) if you:

• Process large volumes of personal data
• Process sensitive data categories
• Conduct automated decision-making

7. Data Processor Agreements

If third parties process your data (cloud providers, email services, analytics platforms), you must have written agreements specifying:

• What data they process
• How they secure it
• How long they retain it
• Their obligations under DPDP

8. Breach Notification

If personal data is breached, you must notify:

• Affected individuals within 72 hours
• The Data Protection Board (in cases of significant risk)

Documentation is required for audit purposes.

Penalties for Non-Compliance

DPDP enforcement is strict:

Violation	Penalty
General violations	Up to ₹5 crore or 5% of annual revenue (whichever is higher)
Serious violations	Up to ₹250 crore or 20% of annual revenue (whichever is higher)
Sensitive data mishandling	Up to ₹250 crore

Criminal penalties (imprisonment) apply in cases involving repeated non-compliance, negligence, or intentional violations.

DPDP vs GDPR: Key Differences

Aspect	DPDP	GDPR
Geographic scope	Indian residents' data	EU residents' data
Consent	Explicit consent required	Consent + legal basis
Fines	Up to ₹250 Cr	Up to €20 million or 4% revenue
DPO	Required for specific cases	Required for public authorities & large processors
Data breach	72-hour notification	72-hour notification

DPDP is simpler and more prescriptive than GDPR but equally binding for Indian companies.

Who Needs to Comply?

1. Indian companies collecting Indian residents' data
2. Global companies with Indian users
3. Startups even with small user bases
4. SMBs processing customer data

Key Takeaway

DPDP is not a future concern—it's already active. Companies found non-compliant face massive fines, forced platform shutdowns, and criminal liability for leadership.

The time to prepare is now.

---

Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Consult a qualified data protection lawyer for your specific situation.

Next Step: Start your free DPDP compliance assessment