TRAI 2024
DPDP Act 2023, Schedule
DPDP Act 2023, Section 5
What Is the DPDP Act?
The DPDP Act is India's first comprehensive, standalone data privacy law. Before it, India relied on Section 43A of the IT Act, 2000 — written before smartphones and cloud computing existed. For a country with 850 million internet users, that was never going to be enough.
The Act received Presidential assent in August 2023, and the DPDP Rules were notified by MeitY in November 2025. With the Rules in place, the compliance obligations are no longer theoretical — they are enforceable.
"The Act's core philosophy: personal data belongs to the individual, not the company that collects it. When your user gives you their phone number, they're granting a conditional licence — not ownership."
DPDP draws from the EU's GDPR but is distinctly Indian. Key differences: a Consent Manager infrastructure with no GDPR equivalent, an 18-year threshold for children's data (vs 16 in GDPR), the Data Protection Board of India as the regulator (vs national DPAs in Europe), and a penalty structure denominated in crore rather than percentage of global turnover.
Who Does It Apply To?
Any entity — Indian or foreign — that processes digital personal data of individuals located within India. It doesn't matter where your company is registered or where your servers sit. If you process personal data of Indian users, you are in scope.
✓ In Scope
- Indian startup collecting any user data
- Foreign SaaS with Indian users
- B2B company processing client employee data
- 5-person startup — no size threshold
- App collecting name, email, or phone
✗ Out of Scope
- Processing only anonymised data
- Personal data processed for personal or domestic purposes
- Data of non-Indian users (different rules apply)
Unlike some regulations that exempt small businesses, the DPDP Act has no minimum size or turnover threshold. A 5-person startup collecting user emails for a newsletter is a Data Fiduciary with the same core obligations as a large enterprise. The scale of penalties may differ, but the obligations do not.
Four Terms You Must Know
Before you can understand your obligations, you need to know which role you play. The DPDP Act defines four key parties — and your responsibilities depend entirely on which one you are.
Data Principal
The individual whose personal data is being collected or processed. Your app user, your website visitor, your customer. They are the rights-holder under the Act — with rights to access, correction, erasure, and grievance redressal.
Data Fiduciary
The entity that decides what personal data to collect, why, and how it is processed. Your company. As a Fiduciary you carry the primary compliance obligations — lawful basis, notice, security safeguards, and breach notification.
Data Processor
A third party that processes personal data on your behalf — AWS, your CRM, your analytics tool. Processors carry contractual obligations from Fiduciaries but do not independently determine the purpose of processing.
Consent Manager
A registered intermediary that enables individuals to provide, manage, review, and withdraw consent across multiple platforms through a single interface. No direct GDPR equivalent. Consent Managers must be registered with the Data Protection Board.
The DPDP Act creates a structured relationship between Data Principals (users), Data Fiduciaries (your company), Data Processors (your vendors), and the new Consent Manager infrastructure unique to India.
Your Five Core Obligations
As a Data Fiduciary, these are the five obligations you must satisfy. Each one has a specific failure mode — the trap that catches most organisations who don't plan for it.
The Penalty Schedule
The DPDP Act's penalties are structured by violation type — and critically, they can stack. A single breach incident can simultaneously trigger the security safeguards category, the breach notification category, and if any children's data was involved, the children's data category.
A single breach incident that involves children's data and is not notified on time could simultaneously attract ₹250 Cr (security), ₹200 Cr (notification), and ₹200 Cr (children's data) — a theoretical maximum of ₹650 Cr from one event. The Data Protection Board has discretion on the actual penalty amount, but the stacking mechanism is explicit in the Act.
Your First 30 Days
You don't need to build a complete DPDP compliance programme overnight. But you do need to start moving — and the order matters. Here is the right sequence:
SecComply helps Indian startups and enterprises build DPDP-compliant programmes from scratch — data inventory, consent flow audit, privacy notices in all required languages, vendor DPAs, and Data Protection Board readiness. We run DPDP programmes in parallel with ISO 27001 and SOC 2 to maximise efficiency across your compliance investment.
Frequently Asked Questions
Yes. If you process personal data of Indian individuals — including your clients' employees or end users — you are in scope. B2B SaaS companies are often Data Processors for their clients' Fiduciary obligations, which comes with its own contractual and operational requirements. There is no B2B exemption in the DPDP Act.
No. ISO 27001 is an information security standard — it addresses how you protect data assets. DPDP is a privacy regulation — it addresses your legal right to process personal data and what rights individuals have over it. There is meaningful overlap but one does not substitute for the other. Many organisations run both programmes in parallel efficiently.
The Data Protection Board (DPB) is India's data privacy regulator — equivalent to the UK's ICO or France's CNIL. It can receive user complaints, investigate violations, and levy penalties up to ₹250 crore. It operates with the powers of a civil court and was formally constituted following the notification of the DPDP Rules in November 2025.
A Consent Manager is a registered intermediary that enables individuals to provide, manage, review, and withdraw consent across multiple platforms through a single interface. This is a uniquely Indian concept with no direct GDPR equivalent. Consent Managers must be registered with the Data Protection Board and meet specific technical and operational standards under the DPDP Rules.
The maximum penalty is ₹250 crore for security safeguard failures that lead to a data breach. Failure to notify the Data Protection Board and affected users carries up to ₹200 crore. Violations of children's data obligations also carry up to ₹200 crore. Penalties can stack — a single breach incident can simultaneously trigger the security, notification, and children's data categories.