Introduction to the DPDP Act 2023

India's Digital Personal Data Protection Act 2023 (DPDP Act) received Presidential assent on August 11, 2023, marking a transformational moment for data protection in India. The Act establishes a comprehensive framework for the processing of digital personal data, replacing the earlier IT Act provisions on data protection.

The DPDP Act applies to any business that processes digital personal data of Indian residents — whether the processing happens within India or outside India in connection with offering goods or services to Indian residents. This wide scope means virtually every business with an online presence, digital HR system, CRM or customer database must comply.

Key Definitions

  • Personal Data — Any data about an individual who is identifiable by or in relation to such data (name, phone number, email, biometrics, financial data, location data, etc.)
  • Digital Personal Data — Personal data in digital form (including digitised copies of paper records)
  • Data Principal — The individual whose personal data is being processed (the person)
  • Data Fiduciary — Any person who determines the purpose and means of processing personal data (the business)
  • Data Processor — Any person who processes personal data on behalf of a Data Fiduciary (cloud vendors, HR software providers, etc.)
  • Consent Manager — An entity that enables Data Principals to manage their consent

Core Obligations for Data Fiduciaries

1. Lawful Basis for Processing

Under the DPDP Act, personal data can only be processed for a lawful purpose — primarily with the consent of the Data Principal, or for certain "legitimate uses" listed in the Act (employment, state functions, public interest, research, etc.).

2. Notice Requirements

Before collecting personal data, businesses must provide a clear notice to individuals informing them of:

  • What personal data is being collected
  • The purpose for which it will be processed
  • How to exercise their rights
  • How to contact the Data Protection Officer or grievance mechanism

The notice must be in clear, plain language — or in any language listed in the Eighth Schedule of the Indian Constitution upon request.

3. Consent Requirements

Consent under the DPDP Act must be:

  • Free — Not coerced or conditioned
  • Specific — For a specific, clearly described purpose
  • Informed — The individual must understand what they are consenting to
  • Unconditional — Not bundled with other consents
  • Unambiguous — A clear affirmative action (no pre-ticked boxes)

Consent can be withdrawn at any time, and withdrawal must be as easy as giving consent.

4. Data Principal Rights

Under the DPDP Act, every individual (Data Principal) has the right to:

  • Right to Information — Know what personal data is held and how it is processed
  • Right to Correction and Erasure — Correct inaccurate or update incomplete data; erase data when purpose is completed or consent withdrawn
  • Right of Grievance Redressal — Access a grievance redressal mechanism
  • Right to Nominate — Nominate another individual to exercise rights in case of death or incapacity

5. Data Retention Limitation

Personal data must not be retained beyond the period necessary for the purpose for which it was collected. Once the purpose is completed or consent is withdrawn, data must be deleted (unless retention is required by law).

6. Data Security Obligations

Data Fiduciaries must implement "reasonable security safeguards" to prevent data breaches. The Act does not specify exact technical measures, but businesses should implement ISO 27001-aligned security practices, access controls, encryption and regular security audits.

7. Data Breach Notification

In the event of a personal data breach, the Data Fiduciary must notify:

  • The Data Protection Board of India (to be established)
  • Each affected Data Principal

Notification timelines and formats will be specified in Rules under the DPDP Act.

Significant Data Fiduciaries (SDF)

The government may designate certain Data Fiduciaries as "Significant Data Fiduciaries" based on the volume and sensitivity of data processed. SDFs will face additional obligations including:

  • Appointment of a Data Protection Officer (DPO)
  • Appointment of an independent data auditor
  • Periodic data protection impact assessments

Financial Penalties for Non-Compliance

The DPDP Act provides for significant financial penalties enforced by the Data Protection Board:

  • Failure to implement reasonable security safeguards — up to ₹250 crore
  • Failure to notify breach — up to ₹200 crore
  • Non-fulfilment of additional obligations (SDF) — up to ₹150 crore
  • Breach of data retention obligations — up to ₹150 crore
  • Breach of children's data obligations — up to ₹200 crore

DPDP Act Compliance Steps for Businesses

  1. Data Mapping — Identify all personal data collected, how it is processed, where it is stored and who has access
  2. Consent Mechanism Review — Audit existing consent forms, cookie banners, privacy notices for DPDP Act compliance
  3. Privacy Policy Update — Revise your privacy policy to meet DPDP Act notice requirements
  4. Vendor Agreements — Update contracts with all data processors to include DPDP Act-compliant data processing obligations
  5. Data Retention Policy — Implement a formal data retention and deletion policy
  6. Security Assessment — Conduct a security assessment and implement required safeguards
  7. Breach Response Plan — Develop a data breach notification and response procedure
  8. Employee Training — Train all staff on data protection obligations and procedures
FAQ — DPDP Act 2023
When does the DPDP Act 2023 come into force?+

The DPDP Act received Presidential assent in August 2023. The operative provisions will come into force on dates notified by the Central Government. The Data Protection Board of India and DPDP Rules are being developed. Businesses should begin compliance preparation now to be ready when the Act becomes operative.

Does the DPDP Act apply to small businesses?+

Yes. The DPDP Act applies to all businesses that process digital personal data of Indian residents, regardless of size. However, the government can exempt certain categories of Data Fiduciaries by notification. Small businesses should still implement basic data protection practices to prepare for compliance.

How can MBOSS Lexon LLP help with DPDP Act compliance?+

MBOSS Lexon LLP provides end-to-end DPDP Act compliance services including: data mapping, privacy policy drafting, consent mechanism review, data processor agreement drafting, breach notification procedure, and employee training. We help businesses achieve practical, cost-effective compliance with the DPDP Act.