India’s Digital Personal Data Protection Act (DPDPA) is no longer a distant concept. For every company that collects, stores, or uses personal data in India, DPDP compliance is now a core business requirement. And with the Data Protection Board of India now operational, DPDPA compliance is moving from “eventually” to “this year.”
If your business also builds or deploys AI systems, it’s worth reading this alongside our ISO 42001 certification guide — the data governance requirements under DPDP compliance in India overlap significantly with AI governance obligations.
| Area | What the DPDP Act Says |
|---|---|
| Scope | Applies to personal data collected online or digitised later, if the processing is in India or relates to Indian residents. |
| Principles | Lawful purpose, consent or legitimate use, data minimisation, accuracy, storage limits, security, accountability. |
| Roles | Data Fiduciary (controller) and Data Processor. |
| Regulator | Data Protection Board of India. |
There is no turnover threshold. If you handle personal data digitally, DPDP Act compliance is a must.
Below are the practical requirements businesses must meet
1. Lawful processing
2. Valid consent management
3.Transparent privacy notice
4. Honour Data Principal rights
5. Security safeguards
6. Breach notification
7.Cross-border transfers
Tip: Align the above with ISO/IEC 27001 controls for faster DPDP Act compliance. If you’re building out security safeguards from scratch, our ISO 27001 certification guide covers the same underlying controls in more depth.
Use the quick list below to track progress:
| S.No | Action Item |
|---|---|
| 1 | Map personal data flows |
| 2 | Classify data & identify high-risk processing |
| 3 | Draft/update privacy policy & consent forms |
| 4 | Appoint a Grievance Officer (and DPO if Significant Data Fiduciary) |
| 5 | Deploy a consent-management platform |
| 6 | Update contracts with Data Processors |
| 7 | Conduct Data Protection Impact Assessment (DPIA) |
| 8 | Run security gap assessment |
| 9 | Set up breach response playbook |
| 10 | Launch employee awareness programme |
In practice, task number 1 – mapping personal data flows – is the one that tends to be underestimated the most by any team. It may seem formal, but in practice, it turns out to be the one that brings up the most unexpected issues: some marketing tool storing email addresses of its customers secretly, or a support system sending out its data to a shared spreadsheet.
Need a printable copy?
The Act introduces a tiered penalty system under Schedule I, with maximum penalties assessed per instance of violation:
| Violation | Maximum Penalty |
|---|---|
| Failure to take reasonable security safeguards (leading to a data breach) | Up to ₹250 crore |
| Failure to notify the Board / affected individuals of a breach | Up to ₹200 crore |
| Non-fulfilment of additional obligations towards children’s data | Up to ₹200 crore |
| Significant Data Fiduciary failing its additional obligations (DPO, DPIA, audits) | Up to ₹150 crore |
| General/residual non-compliance — any other breach of the Act or Rules not listed above | Up to ₹50 crore |
A few things worth understanding about how this actually works in practice:
Penalties can quickly exceed annual profits for a growing business. Staying DPDP compliant in India is a fraction of the cost of paying even one of these fines.
We found out that the founders are more concerned about the big figure of ₹250 crores and think it is only for the large businesses. The truth of the matter is that the ₹50 crores figure is the residual which tends to affect small firms since it covers almost anything not specifically listed above, including things as ordinary as an outdated privacy notice.
Source: Schedule I, Digital Personal Data Protection Act, 2023 (full text, MeitY)
Follow the roadmap below, especially if you’re starting late.
A quick, honest note before you dive in: most companies underestimate Step 1. It looks like the “easy” part, but it’s usually where the real timeline gets set. You can’t fix what you haven’t found yet.
Step 1 Assessment (Week 1–4)
Step 2 Gap analysis (Week 5–6)
Step 3 Remediation (Week 7–16)
Step 4 Audit & certification (Week 17–20)
Step 5 Ongoing monitoring (Monthly/Quarterly)
Not sure where to start? Get a free DPDP Act gap assessment and get a clear, prioritized starting point instead of guessing.
Manual spreadsheets break down fast, data flows change, consent records go stale, and by the time an audit or a Board inquiry comes around, nobody’s confident the paperwork actually matches reality.
Rather than stitching together separate tools for each function, platforms like SOCLY.io are built to cover multiple pieces of DPDP compliance from one place:
Benefits of automation, generally:
If you’re currently piecing together point solutions for data mapping, consent, and reporting separately, it’s worth asking whether a single platform could replace that stack — see how SOCLY.io automates DPDP compliance →
Unlike when this guide was first drafted, the DPDP Rules are no longer pending — they were formally notified, and the compliance runway is now clearly defined in phases:
| Milestone | Date |
|---|---|
| DPDP Act passed | August 2023 |
| DPDP Rules, 2025 notified; Data Protection Board established | November 13, 2025 |
| Consent Manager registration opens; mandatory DPO for Significant Data Fiduciaries | By November 13, 2026 |
| Full substantive compliance enforceable (consent, notices, safeguards, breach protocols) | May 13, 2027 |
What this means practically: 2026 is the working year. The gap between “the law exists” and “the law is actively enforced” is closing, and the businesses that wait until early 2027 to start will be doing in weeks what should have taken months. Keep an eye on MeitY updates for any further procedural notifications as the Consent Manager framework rolls out.
1. Is DPDP compliance mandatory for small start-ups?
Yes, there are no exceptions with regards to size of companies. However, micro-companies are expected to have slightly less complicated requirements under the Rules in some respects.
2. Do we need a Data Protection Officer?
Only those data fiduciaries who are identified as Significant Data Fiduciaries by the government are mandatorily required to have a DPO. However, most companies choose to do so voluntarily in order to be well-organized.
3. How long can we keep user data?
As long as it is necessary for achieving the initial purpose or until required by law, whichever is shorter.
4.What happens if users withdraw consent?
You will have to cease the processing of their data unless there is any other legal basis, and notify the recipients of such withdrawal.
5. Is anonymised data outside the Act?
Anonymized and irreversibly changed data does not come under the scope of this Act, while pseudonymized data is personal data.
6. What’s the difference between DPDP compliance and DPDPA compliance?
Nothing “DPDP compliance” and “DPDPA compliance” refer to the same thing. Both are shorthand for compliance with the Digital Personal Data Protection Act, 2023.
DPDP compliance is not a one-time project; it’s an ongoing commitment to transparency and accountability. Map your data, close the gaps early, and keep records ready for the Board.
Get your free DPDP Act gap assessment and see exactly where your business stands. Or, if you’re also working on ISO 42001, SOC 2, or ISO 27001, check out our other compliance guides to see how these frameworks overlap.
Stay informed, stay secure, and make DPDP Act compliance your competitive edge in 2026 with SOCLY.io.
Your trusted partner in compliance automation. Turn complex regulations into clear, automated workflows.
By submitting, you agree to our Privacy Policy and Terms of Service
