India's Digital Personal Data Protection Act, 2023 sets out how organisations must handle personal data about individuals in India. With the Digital Personal Data Protection Rules notified in November 2025 and most obligations taking effect in phases up to May 2027, now is the time for growing businesses to get ready.
Who it applies to
The Act applies to digital personal data processed in India, and to processing outside India where it relates to offering goods or services to people in India. If you collect customer, employee or website visitor data, it almost certainly applies to you. In the Act's language, your business is a Data Fiduciary.
The core obligations
- Notice: tell people clearly what personal data you collect, why, and how they can exercise their rights.
- Consent: where consent is the basis, it must be free, specific, informed and unambiguous, and as easy to withdraw as to give.
- Purpose and retention: use data only for the stated purpose, and erase it when it is no longer needed.
- Security safeguards: take reasonable measures to protect data, including access controls, encryption and monitoring.
- Breach notification: inform affected individuals and the Data Protection Board if a breach occurs.
- Grievances: publish a contact for data questions and respond to requests and complaints.
Rights of individuals
People can ask for a summary of their data, have it corrected or erased, withdraw consent, nominate someone to act for them and raise grievances. You need a simple, reliable way to receive and respond to these requests.
Practical first steps
- Map what personal data you collect, where it is stored and who can access it.
- Review your website forms, privacy notice and consent wording.
- Set retention periods and automate deletion where you can.
- Check contracts with vendors who process data for you.
- Prepare a simple breach response plan and practise it.
Children's data and special cases
The Act sets stricter rules for personal data about children, defined as anyone under eighteen, including verifiable parental consent and restrictions on tracking and targeted advertising. If your products or services could reach children, review this carefully. Larger organisations may also be designated Significant Data Fiduciaries, with additional duties such as appointing a Data Protection Officer and carrying out regular audits.
Working with vendors
Most businesses rely on other companies to process data on their behalf, such as hosting providers, email platforms, payroll services and software vendors. Under the Act these are Data Processors, and you remain responsible for how they handle your data. Make sure you have written agreements that limit what they can do with it, require appropriate security, and oblige them to tell you about breaches.
Website essentials
- A clear privacy policy written in plain language.
- A short notice on every form explaining what you collect and why.
- Consent checkboxes that are never ticked in advance.
- An easy way for people to withdraw consent and exercise their rights.
- No tracking cookies or analytics without a proper basis.
Why it matters
Penalties under the Act can be substantial, but the bigger benefit is trust. Clients increasingly ask suppliers how they protect data, and a clear answer can win business.
This article is general information, not legal advice. For help assessing and improving your systems, talk to our Cybersecurity Services team.
