The Digital Personal Data Protection Act, 2023: What It Means for Businesses

This article is general information only, not legal advice, and not solicitation of work. It should not be relied upon as a substitute for advice on your specific facts.

What the DPDP Act Covers

The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India, applying to organisations, termed data fiduciaries, that determine the purpose and means of processing such data, whether they are based in India or process data of individuals in India in connection with offering goods or services here.

Consent and Notice Obligations

Processing generally requires clear, specific consent from the individual, termed the data principal, given after a notice describing what data is collected and why. Consent must be as easy to withdraw as it was to give, and certain limited processing, such as for specified legitimate uses set out in the Act, does not require consent at all.

Obligations on Businesses as Data Fiduciaries

Businesses must implement reasonable security safeguards, report data breaches to the Data Protection Board and affected individuals, and, for significant data fiduciaries as notified by the government, appoint a data protection officer and undertake periodic audits. Certain uses, particularly those involving children’s data, carry additional restrictions, including a general bar on tracking or targeted advertising directed at children.

Penalties and What Businesses Should Do Now

Non-compliance can attract significant financial penalties, running into hundreds of crores of rupees for serious breaches such as failure to implement reasonable safeguards. Businesses handling personal data are well advised to map what data they collect and why, review consent mechanisms and privacy notices, and put a breach response plan in place well before enforcement intensifies.

This note is prepared by our IP & Technology team. If you are dealing with a related situation, get in touch with us.