DPDP Act 2023 — Enterprise Implementation Guide
Executive summary
The Digital Personal Data Protection Act imposes obligations on every Data Fiduciary processing personal data of individuals in India.
Key obligations
- Lawful, consent-based processing
- Notice, purpose limitation, data minimisation
- Rights of Data Principals: access, correction, erasure, grievance
- Significant Data Fiduciary duties (DPO, DPIA, audits)
- Breach notification to the Data Protection Board
Implementation phases
- Data mapping and Record of Processing
- Consent architecture and preference centre
- DPIA methodology and risk register
- Cross-border transfer controls
- Vendor/processor governance
- Breach response runbook
dpdp privacy india