The shift the Act introduces
The Digital Personal Data Protection Act, 2023 makes the organisation that decides why and how personal data is processed — the Data Fiduciary — accountable for that data end to end, including when processors handle it.
Penalties are significant: failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Implementation is phased through the DPDP Rules, so track the notified timelines closely.
A six-step readiness roadmap
1. Build a personal data inventory
You cannot protect what you have not mapped. For every system, record:
- Categories of personal data and Data Principals (customers, employees, children)
- Purpose and lawful basis for processing
- Where data is stored and which processors touch it
- Retention period and deletion method
2. Fix notices and consent
Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Notices must explain what is collected and why, and how to withdraw consent or complain. Withdrawing must be as easy as giving consent.
3. Implement reasonable security safeguards
The Act does not prescribe a framework, but regulators will expect recognised practice. Encryption, access control, logging, and an ISO 27001-aligned ISMS give you a defensible baseline.
4. Prepare for breach notification
Personal data breaches must be reported to the Data Protection Board and affected Data Principals. Integrate this into the same playbook you use for CERT-In reporting so the two clocks are managed together.
5. Operationalise Data Principal rights
People can request access, correction, completion and erasure, and nominate someone to act for them. Set up a tracked workflow with response timelines and identity verification.
6. Check whether you are a Significant Data Fiduciary
If notified as one, you must appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic Data Protection Impact Assessments.
Children's data needs extra care
Processing data of children requires verifiable parental consent, and tracking, behavioural monitoring or targeted advertising directed at children is restricted.
Who should own what
| Area | Typical owner |
|---|---|
| Inventory and retention | Data owners with the privacy office |
| Notices and consent | Product and legal |
| Safeguards | CISO |
| Breach response | CISO with legal |
Key takeaways
- The Data Fiduciary stays accountable for personal data, including data handled by processors.
- Start with a data inventory, then fix notices, consent and withdrawal.
- Treat breach notification, Data Principal rights and security safeguards as operating processes, not documents.
Frequently asked questions
Does the DPDP Act apply to employee data?
Yes. The Act covers digital personal data of individuals, including employees, though some processing for employment purposes falls under the legitimate uses the Act recognises.
Is consent always required?
Consent is the primary basis, but the Act also allows certain legitimate uses — for example where a person voluntarily provides data for a specified purpose, or for some employment and legal obligations.
What makes an organisation a Significant Data Fiduciary?
The government notifies Significant Data Fiduciaries based on factors such as the volume and sensitivity of data processed and the risk to individuals. They carry extra duties including a DPO, independent audits and impact assessments.
Privacy compliance is a data-management problem first and a legal problem second.
Talk to our GRC team about a DPDP gap assessment.
