DPDP Act, 2023: A Simple Compliance Checklist for Businesses in India

ByBase Legal

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s main law on personal data. The Digital Personal Data Protection Rules, 2025 were notified in November 2025. Most duties apply after a transition period. Businesses should use this time to prepare.

Who must follow the DPDP Act?

The Act applies to personal data in digital form. It also applies to paper records that are later digitised. If your business collects names, phone numbers, emails, ID numbers or other personal details of people in India, the Act likely applies to you.

The Act calls your business a Data Fiduciary. A vendor who processes data for you is a Data Processor. The person whose data it is, is the Data Principal.

Key duties of a Data Fiduciary

  • Notice: Tell people, in clear language, what data you collect and why.
  • Consent: Get free, specific and informed consent. Make it as easy to withdraw as to give.
  • Purpose limits: Use data only for the stated purpose. Delete it when the purpose is over.
  • Security: Take reasonable security safeguards to prevent a data breach.
  • Breach reporting: Inform the Data Protection Board and affected people if a breach happens.
  • Rights: Let people access, correct and erase their data, and raise complaints.
  • Children: Get verifiable parental consent before processing a child’s data.

Penalties

The Data Protection Board of India can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards. Other breaches carry lower but still heavy penalties.

A simple checklist to start

  1. Map what personal data you collect, where it is stored and who can see it.
  2. Update your privacy notice and consent forms.
  3. Sign Data Processing Addendums (DPAs) with vendors who handle personal data.
  4. Write a short data breach response plan.
  5. Set up a way for people to exercise their rights and raise complaints.
  6. Train staff who handle customer and employee data.

If you also serve clients in Europe, you may need to follow the EU GDPR as well. Many steps overlap, so one programme can cover both.

To speak to an advocate, call +91 63660 42792 or email contact@baselegal.in. You can also send us a message. Read more about our Technology, Data Protection & AI practice.

This article is for general information only. It is not legal advice. Please speak to an advocate about your own case.