India Finally Has a Data Protection Law
After years of debate, India enacted the Digital Personal Data Protection Act, 2023 (DPDP Act) — the country's first comprehensive data protection legislation. If your business collects, stores, processes, or shares the personal data of Indian citizens, this law applies to you.
This guide explains the DPDP Act in plain language, without the legalese.
Who Does the DPDP Act Apply To?
The Act applies to any entity — Indian or foreign — that processes the "digital personal data" of individuals in India. This includes:
- E-commerce platforms collecting customer data
- SaaS companies processing employee or user data
- Healthcare providers storing patient records
- Banks and financial institutions handling KYC data
- Educational institutions with student information
- Any business with an app, website, or CRM
Key Terms You Must Know
Data Principal: The individual whose data is being processed. Under the DPDP Act, data principals have significant rights.
Data Fiduciary: The entity (your business) that decides the purpose and means of data processing. Data fiduciaries carry the heaviest obligations under the Act.
Significant Data Fiduciary (SDF): Certain large or high-risk data fiduciaries will be designated as SDFs by the government, attracting additional compliance requirements like data audits and Data Protection Officers.
Consent Manager: A new intermediary registered with the Data Protection Board that helps individuals manage their consent across platforms.
Core Obligations for Data Fiduciaries
1. Lawful Basis for Processing
You may only process personal data if you have a valid basis. The DPDP Act recognises two primary bases: consent and "legitimate uses" (which include employment-related processing, state functions, and medical emergencies).
2. Notice Requirements
Before collecting data, you must provide a clear, plain-language notice explaining what data is collected, why it is collected, and how the individual can withdraw consent or exercise rights.
3. Purpose Limitation
You may only use data for the purpose for which consent was obtained. Using customer data collected for delivery services to send unrelated marketing, for example, would violate the Act.
4. Data Minimisation
Collect only the data that is necessary for the stated purpose. Collecting excessive personal data — even with consent — is non-compliant.
5. Data Accuracy
You must make reasonable efforts to ensure that the personal data you process is accurate and complete, particularly where inaccuracy could cause harm to the data principal.
6. Storage Limitation
Personal data must not be retained beyond the period necessary for the stated purpose. Once the purpose is fulfilled, data must be deleted.
7. Security Safeguards
Appropriate technical and organisational measures must be in place to protect personal data from breaches. The Act does not prescribe specific technical standards, but the expectation is that security is proportionate to the sensitivity of the data.
8. Data Breach Reporting
In the event of a personal data breach, data fiduciaries must notify both the Data Protection Board and the affected individuals. Timelines and formats will be specified by rules.
Rights of Data Principals
The DPDP Act gives individuals meaningful rights:
- Right to Access: Know what personal data is held about them
- Right to Correction: Correct inaccurate or incomplete data
- Right to Erasure: Have personal data deleted
- Right to Grievance Redressal: Raise complaints with the data fiduciary
- Right to Nominate: Nominate another person to exercise rights in case of death or incapacity
Penalties for Non-Compliance
The DPDP Act carries some of the steepest penalties in Indian law:
- Failure to implement security safeguards: Up to ₹250 crore
- Failure to notify breach: Up to ₹200 crore
- Breach of children's data obligations: Up to ₹200 crore
- Other violations: Up to ₹50 crore
What Should You Do Now?
DPDP Act compliance is not a one-time checkbox exercise. It requires a systematic review of how your business collects, processes, stores, and deletes personal data. A Clawrity DPDP Act lawyer can help you:
- Conduct a data audit to map all personal data flows
- Draft compliant privacy policies and consent notices
- Build an internal data governance framework
- Prepare breach response procedures
- Advise on Significant Data Fiduciary obligations if applicable
The time to act is now — before a penalty notice arrives.
