DPDP Act 2023

Introduction: From a Statute on Paper to an Operational Regime

For close to a decade, Indian boards treated data protection as a matter of principle rather than of practice. That indulgence has ended. With the notification of the Digital Personal Data Protection Rules, 2025 on November 14th, 2025, the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) ceased to be an aspirational framework and became an operational regulatory regime, complete with a constituted Data Protection Board of India seated in the National Capital Region and a staggered implementation timeline running through to 2027. The instinct in many boardrooms is to read that timeline as breathing space. In my experience advising corporates on regulatory transitions, that reading is a mistake. The eighteen-month runway that culminates in the coming into force of the substantive obligations is not a grace period during which nothing need be done; it is the window within which a defensible compliance posture must be constructed. Regulators rarely reward organisations that treat a phased commencement as permission to defer. They reward organisations that can demonstrate, at the moment enforcement bites, that governance was already embedded. This is precisely why the conversation has shifted from whether to comply to how to comply strategically — and why sophisticated organisations are engaging specialist counsel early. The demand for experienced Data Protection Lawyers in Delhi has risen sharply, not because compliance is a box-ticking exercise, but because the DPDP Act reallocates legal risk across the enterprise in ways that require careful, sector-aware strategy rather than a template downloaded from the internet. This article sets out how corporate India should approach that strategy: what the law actually requires, where the sharpest risks lie, and how a proactive legal framework can convert a compliance burden into a governance advantage.

Understanding the DPDP Act 2023

A.1. Legislative Background

The DPDP Act is the statutory answer to a constitutional question. In Justice K.S. Puttaswamy v. Union of India (2017), a nine-judge bench of the Supreme Court held that the right to privacy is intrinsic to the right to life and personal liberty under Article 21 of the Constitution. That judgment created an obligation on the State to protect informational privacy through a legal framework. The path from that judgment to enacted law was long — an earlier Personal Data Protection Bill was introduced in 2019 and subsequently withdrawn — but it concluded when the DPDP Act received Presidential assent in August 2023, and it matured with the notification of the DPDP Rules in November 2025. The result is a deliberately lean, principle-driven statute. Unlike the granular prescriptiveness of some foreign regimes, the DPDP Act sets out obligations at a level of generality that the Rules and the Data Protection Board are expected to fill in over time. That architecture places a premium on interpretation, and it is one reason legal judgment matters so much in DPDP compliance.

A.2. Objectives and Core Principles

The Act’s stated purpose is to balance the individual’s right to protect their personal data against the need to process such data for lawful purposes. Beneath that balance sit familiar data-protection principles that any board should internalise: lawful and consent-based processing, purpose limitation, data minimisation, accuracy, storage limitation, reasonable security safeguards, and — critically — accountability. The last of these is the throughline of the entire statute. The DPDP Act does not merely require good outcomes; it requires that an organisation be able to demonstrate the systems, decisions and controls behind those outcomes.

A.3. Rights of Data Principals

The Act confers on the Data Principal — the individual to whom the personal data relates — a defined set of rights: the right to access information about the personal data being processed, the right to correction and erasure, the right to grievance redressal, and the right to nominate another individual to exercise these rights in the event of death or incapacity. These are not abstract entitlements. Each one imposes an operational obligation on the Data Fiduciary to build processes capable of receiving, verifying and actioning requests within reasonable timelines — and to evidence that it has done so.

A.4. Obligations of Data Fiduciaries

A Data Fiduciary — the entity that alone or together with others determines the purpose and means of processing — carries the substantive weight of the Act. Its obligations include issuing a clear, itemised notice; obtaining and maintaining valid consent or relying on a permitted legitimate use; implementing reasonable security safeguards; notifying the Data Protection Board and affected Data Principals in the event of a personal data breach; erasing personal data once the purpose is served or consent is withdrawn; maintaining accuracy where data is used to make decisions affecting the individual; and establishing an effective grievance-redressal mechanism. Where processing is entrusted to a Data Processor, the Fiduciary remains answerable, and may engage a Processor only under a valid contract.

A.5. Significant Data Fiduciaries

The Act creates an elevated category — the Significant Data Fiduciary (SDF) — which the Central Government may notify on the basis of factors such as the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, and considerations of sovereignty, security and public order. An SDF carries enhanced obligations: it must appoint a Data Protection Officer based in India and answerable to the board or its equivalent, engage an independent data auditor, and undertake periodic Data Protection Impact Assessments and audits. For large technology platforms, financial institutions and consumer-facing enterprises, SDF designation is a live possibility that should be planned for now, not reacted to later.

A.6. The Consent Framework

Consent is the operative pivot of the DPDP Act. To be valid, consent must be free, specific, informed, unconditional and unambiguous, and it must be signified by a clear affirmative action. It must be preceded by a notice that is intelligible and itemised — describing the personal data sought and the specific purpose of processing. Consent may be withdrawn as easily as it was given, and the Act contemplates the emergence of registered Consent Managers to mediate this relationship at scale. Running alongside consent is a set of “legitimate uses” — including certain employment-related processing and specified State functions — which permit processing without fresh consent in defined circumstances. Distinguishing lawfully between consent and legitimate use is a recurring point on which organisations benefit from precise legal advice. Children’s data receives special treatment. Processing the data of individuals below eighteen years generally requires verifiable parental consent, and the Act prohibits behavioural tracking and targeted advertising directed at children. For e-commerce, ed-tech and social platforms, this is among the most operationally demanding requirements in the statute.

A.7. Cross-Border Data Transfers

The DPDP Act adopts a comparatively permissive, negative-list approach to international transfers: personal data may be transferred outside India except to territories that the Central Government restricts by notification. This is a materially different model from the whitelist-and-adequacy architecture of the European regime, and it interacts with sector-specific data-localisation requirements — most notably in financial services. Global groups moving data between affiliates should map their flows against both the DPDP position and any overlapping sectoral mandate.

Key Corporate Risks Under the DPDP Act

B.1. Financial Penalties

The DPDP Act’s penalty structure is the headline that concentrates board attention, and rightly so. The Schedule prescribes penalties of up to ₹250 crore for a failure to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for a failure to notify a breach or to discharge obligations concerning children’s data, with further tiers for other contraventions. These are per-instance ceilings adjudicated by the Data Protection Board, and they transform data protection from an operational nuisance into a balance-sheet exposure that demands board-level ownership.

B.2. Reputational Damage and Regulatory Scrutiny

Monetary penalties are frequently the smaller cost. A publicised breach or an adverse Board finding erodes customer trust, unsettles investors and, in regulated sectors, invites parallel scrutiny from sectoral regulators. Because the Data Protection Board is constituted within the National Capital Region, organisations headquartered in and around Delhi should expect proximity to enforcement to translate into both accessibility and visibility.

B.3. Data Breaches and Vendor Management

Most personal data breaches originate not at the perimeter of the Data Fiduciary but somewhere in its supply chain. The Act’s insistence that a Fiduciary remains accountable for processing carried out on its behalf makes vendor and processor management a first-order legal risk. Contracts that fail to allocate breach responsibility, mandate security standards, and secure audit and flow-down rights leave the Fiduciary carrying liabilities it did not create.

B.4. Cross-Border Handling and Litigation Exposure

Cross-border data handling introduces both regulatory and contractual risk, particularly where group entities share data under intra-group arrangements drafted for a pre-DPDP world. And while the Act channels much dispute resolution through the Board and appellate mechanisms, the broader exposure — grievances at volume, contractual indemnity claims, and reputational litigation — should not be underestimated. An organisation’s litigation posture is shaped long before any dispute arises, in the quality of the notices, consents and contracts it puts in place today.

Corporate Data Protection Strategy

A credible DPDP strategy is not a policy document; it is an operating system for the responsible handling of personal data, owned at the top and evidenced throughout. The following elements form its spine. B.6. Governance structures and board-level oversight. Data protection accountability should be assigned to a named executive, reported into the board or an appropriate committee, and reflected in the organisation’s risk register. Boards that treat privacy as a standing agenda item, rather than an incident-driven one, are far better placed to demonstrate the accountability the Act demands. B.7. Privacy risk assessments and data mapping. An organisation cannot protect data it has not located. A rigorous data-mapping exercise — identifying what personal data is collected, on what basis, where it flows, who processes it and how long it is retained — is the indispensable foundation of every other control. Data Protection Impact Assessments should be conducted for high-risk processing, and are mandatory for Significant Data Fiduciaries. B.8. Consent and notice mechanisms. Notices and consent-capture flows must be re-engineered to meet the Act’s standards of clarity, specificity and withdrawability, with auditable records of when and how consent was obtained. This is as much a legal-drafting task as a technical one. B.9. Contractual risk allocation and third-party compliance. Processor agreements, vendor contracts and intra-group arrangements should be revisited to embed DPDP-aligned obligations, security warranties, breach-notification timelines, audit rights and indemnities. Third-party compliance is not a procurement afterthought; it is central to the Fiduciary’s own defensibility. B.10. Incident response planning. A tested breach-response protocol — with defined roles, escalation paths, forensic support and Board-notification workflows — is what separates a contained incident from a regulatory crisis. It should be rehearsed before it is needed. B.11. Employee training and compliance audits. Policies that staff have not been trained on are policies that will fail under scrutiny. Periodic training, coupled with independent audits, both reduces the likelihood of contravention and generates the evidentiary record that a regulator will expect to see.

The Role of Legal Counsel in DPDP Compliance

Data protection compliance is often mischaracterised as an IT problem with a legal footnote. The reverse is closer to the truth. The obligations that carry the heaviest penalties — valid consent, lawful basis, breach notification, children’s data, contractual allocation — turn on legal interpretation and drafting, not on software configuration. Experienced counsel adds value across the compliance lifecycle: drafting privacy policies and itemised consent notices that are both compliant and commercially workable; negotiating data-processing agreements and vendor contracts that allocate risk defensibly; framing employee data policies that reconcile the Act’s requirements with labour and employment obligations; managing regulatory correspondence and investigations before the Data Protection Board; and directing breach response in a manner that preserves, where appropriate, legal privilege over sensitive assessments. In an enforcement-driven regime, the difference between a well-advised and a poorly-advised organisation is frequently the difference between a managed exposure and an uncapped one.

Industry-Specific Compliance Considerations

C.1. Financial Services

Banks, non-banking financial companies and fintechs must reconcile the DPDP Act with an existing thicket of sectoral regulation, including data-localisation mandates and customer-confidentiality norms. The overlap is not merely additive; conflicting retention and localisation requirements must be harmonised through careful legal analysis rather than assumed away.

C.2. Healthcare

Health data is among the most sensitive categories an organisation can hold, and the sector’s rapid digitalisation — telemedicine, diagnostics platforms, health apps — multiplies both the volume of processing and the consequences of failure. Consent architecture, retention discipline and breach preparedness deserve heightened attention here.

C.3. Technology Companies

For SaaS providers and platforms, the threshold question is often characterisation: is the entity a Data Fiduciary, a Data Processor, or both across different product lines? That classification drives its obligations. Technology companies are also the most likely candidates for Significant Data Fiduciary designation, and should build to that standard from the outset.

C.4. E-Commerce Businesses

E-commerce platforms sit at the intersection of profiling, targeted advertising, children’s data and prescribed retention schedules. Personalisation engines and marketing practices that were unremarkable a year ago now require re-examination against the consent standard and the prohibitions concerning minors.

C.5. Startups

Early-stage companies should resist both complacency and over-engineering. A proportionate, well-documented compliance build — clean consent flows, sensible retention, sound vendor contracts — is achievable at modest cost and is increasingly a condition of investor and enterprise-customer diligence. Retrofitting compliance after scale is far more expensive.

C.6. Global Companies Operating in India

Multinationals must map the DPDP Act against their global privacy programmes, resolving the interplay between the Indian regime and frameworks such as the GDPR, and reworking intra-group data-sharing arrangements to satisfy Indian requirements. Convergence at the level of principle should not be mistaken for identity at the level of detail; the divergences are exactly where risk accumulates.

Future Regulatory Outlook

The DPDP framework will not remain static. The Data Protection Board’s early adjudications will begin to supply the interpretive detail that the statute deliberately left open, and sectoral guidance is likely to follow. Organisations should anticipate an enforcement posture that hardens as the phased timeline matures towards its 2027 milestones, and should expect the Board to distinguish sharply between those who prepared and those who waited. More broadly, India’s regime forms part of a global movement towards privacy regulation and interoperability. As cross-border data flows come under closer scrutiny worldwide, the pressure towards convergence — and towards demonstrable, auditable compliance — will only intensify. Boards that build robust programmes now will be positioned to treat future regulatory change as an adjustment rather than an overhaul.

Why Businesses Need Experienced Data Protection Lawyers

The case for specialist counsel is not a matter of professional self-interest; it is a matter of risk economics. The DPDP Act concentrates significant liability in a handful of interpretive judgments, and those judgments are precisely where generalist advice and off-the-shelf templates fail. Experienced Data Protection Lawyers bring several advantages that matter in practice. First, regulatory proximity: with the Data Protection Board constituted in the National Capital Region, counsel engaged with the Delhi ecosystem is well placed to advise on the Board’s expectations and to represent organisations in proceedings before it. Second, interpretive depth: reading the Act, the Rules and their sectoral overlaps correctly is a specialist skill, and the cost of misreading a lawful basis or a cross-border restriction is measured in crores. Third, strategic risk mitigation: the best Data Protection Lawyers in Delhi do not simply document compliance; they design programmes that reduce exposure while preserving commercial freedom. The value extends beyond steady-state compliance. When a breach occurs or an investigation opens, organisations need counsel who can manage corporate investigations and Board interactions with composure and privilege in mind. When capital is being raised or a business is being acquired, data-protection diligence has become a deal issue, and Data Protection Lawyers in Delhi are increasingly central to closing transactions cleanly. And as commercial arrangements grow more data-intensive, technology contracting — processor agreements, data-sharing arrangements, cross-border flows — demands drafting that anticipates the DPDP Act rather than reacting to it. For organisations engaged in cross-border transactions in particular, the guidance of specialist Data Protection Lawyers in Delhi is often what allows global data strategies to proceed without regulatory friction.

Conclusion

The DPDP Act has moved data protection from the margins of legal compliance to the centre of corporate governance. It is no longer accurate — or safe — to treat privacy as an operational detail delegated downward. It is a board-level accountability, a balance-sheet risk, and, for the well-advised organisation, a genuine source of competitive trust. The organisations that will emerge strongest from this transition are those that act while the runway remains open: mapping their data, rebuilding their consent and contract architecture, embedding governance, and doing so under the guidance of counsel who understand both the letter of the Act and the realities of enforcement. DPDP compliance is now a business-critical governance issue rather than a mere legal obligation — and it should be treated with the seriousness that description implies.

Frequently Asked Questions