The Digital Personal Data Protection Act
Impact on SMEs
The DPDP Act applies to any business that handles personal data in digital form. Compliance depends on whether the business can explain what data it holds, how it uses it, where it goes, who can access it, and how well it responds to requests about it.
The Act's compliance provisions become enforceable on 13 May 2027. It establishes a Data Protection Board as the enforcement body, which will receive and handle complaints and breach notifications, investigate alleged violations, issue directions, and impose penalties — up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach, and up to ₹50 crore for other breaches of the Act or Rules.
Key terms
Personal data
Any data that can identify a person, directly or indirectly.
Data Principal
The person the data is about. For a child, it's the parent or guardian.
Processing
Almost anything done to data from collection till deletion.
Data Fiduciary
Whoever decides why and how personal data is processed.
Data Processor
Whoever processes personal data on behalf of a fiduciary.
Data Catalog
A DPDP-ready business can answer four questions on demand: what personal data it holds, why it holds it, where it is stored, and who can reach it. Most compliance gaps trace back to nobody in the business being able to answer all four at once.
Can your business answer:
- Whether there's a current list of what personal data the business holds, and why?
- Whether that list covers customer, prospect, employee and vendor information held across email, spreadsheets, messaging apps, finance systems, cloud services and staff devices?
- Which roles and outside providers can access each category of data?
Consent
For most data processing, you need the subject's consent — free from other conditions, specific to the purpose, stated in clear terms, and backed by a clear affirmative action. Consent must be as easy to withdraw as it was to give.
Can your business answer:
- Whether it can produce the notice that was shown, and the record of consent received?
- Whether each consent request matches a defined use of the data?
Time Sensitive Requirement
If a person gave their consent before 13 May 2027, you must be able to show that consent. You must also tell them what data you hold and why, how to exercise their rights, and how to complain to the Data Protection Board. If you do not have consent, you must ask for it and receive it or stop using their data.
People can ask for the notice and consent request in English or any language in the Eighth Schedule to the Constitution.
Purpose
Data collected for one purpose can't be quietly reused for another. A new purpose requires new consent, and data can't be collected for an undefined purpose ("it might be useful one day"). Some purposes are lawful without consent: employment-related processing, legal obligations and court orders, and medical emergencies and public-health measures.
Can your business answer:
- What the purpose is for each use of personal data, and whether everything collected is necessary for it?
- Whether older forms, spreadsheets or system fields still collect information that serves no current purpose?
Data Flows & Sharing
You remain responsible for personal data after handing it to someone else — an accountant, payroll provider, cloud CRM or delivery partner acting on your behalf is a Data Processor.
Can your business answer:
- What data each outside party receives, and why?
- Whether there's a written contract with every processor that covers security, breach reporting and data deletion?
Retention & Data Rights
Once the purpose is served or consent is withdrawn, you must erase the data — and have your processors erase it too — unless a law requires you to keep it. People also have rights: a summary of what you hold and who it's been shared with, correction, updating, erasure, and the ability to file a complaint. You must publish how to make these requests and resolve grievances within 90 days.
Can your business answer:
- How long each category of data is kept, and why?
- Who handles it when someone asks for access, correction or deletion, and whether the change reaches every system and processor holding a copy?
Security
You must take reasonable security safeguards to prevent breaches, including at your processors. At minimum, the Rules call for encryption or masking where appropriate, access control, logs and monitoring to detect unauthorised access, backups, and security terms in processor contracts. Logs must be kept for at least a year — failing here carries the Act's largest penalty, up to ₹250 crore.
Can your business answer:
- Whether key accounts use multi-factor authentication, and whether access is removed the day staff or vendors leave?
- Whether the logs would show who opened or exported customer data last month?
Breach Response
A personal data breach isn't always obvious. It can mean loss of confidentiality, integrity or availability. Once discovered, the Rules require notifying affected Data Principals and the Data Protection Board without delay, with full details to the Board within 72 hours unless the Board grants more time.
Can your business answer:
- Who takes charge of containment, evidence preservation and the first assessment of what data was affected?
- Where are the facts recorded as they become known, and who coordinates the response across the business, IT and service providers?
Ongoing Governance
Data protection work needs an owner inside the business — someone who checks whether privacy arrangements need to change when systems, vendors, marketing practices, staffing or data uses change.
Can your business answer:
- Does the data catalog change when a new system, vendor or collection process is introduced?
- When an activity changes, who checks the consent wording, retention period, access rights and processor arrangements?
- Is there up-to-date guidance for staff, and have the steps for rights requests and breach response been tested?
How long does a review like this take?
Even a small business needs time from people who know how work is done. Sales may know how customer details are collected. Finance may hold another copy. IT may know which systems send data elsewhere. A compact review usually takes several working days, spread over a few weeks while gaps are fixed and new steps go live.