The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's main data-protection law. It applies to almost every organisation that handles digital personal data of people in India – customers, website visitors, students, patients and employees. Its rules, notified in November 2025, give businesses a transition period before most obligations apply. This checklist explains what to do, in plain language.
Key terms
| Term | Meaning |
|---|---|
| Data Principal | The person the data is about – your customer, employee or user. |
| Data Fiduciary | The business that decides why and how data is processed – usually you. |
| Data Processor | A vendor that processes data for you – hosting, CRM, payroll, marketing tools. |
| Data Protection Board | The authority that handles complaints and breaches and can impose penalties. |
The compliance checklist
1. Map your data
- List every place personal data lives: website forms, CRM, spreadsheets, email, HR and payroll, backups
- Record why each item is collected and how long you keep it
- List every vendor that receives the data
2. Notice and consent
- Show a clear notice when collecting data: what, why, and how to withdraw consent or complain
- Ask for consent with an unticked checkbox – no pre-ticked boxes or bundled consent
- Make withdrawing consent as easy as giving it, and stop processing when it is withdrawn
3. Use and keep only what you need
- Use data only for the stated purpose
- Delete data when the purpose is over, unless a law requires you to keep it
4. Security safeguards
- Access control and multi-factor authentication for systems holding personal data
- Encryption, logging, backups and regular vulnerability assessment
- Written contracts requiring vendors to protect the data
5. Breaches
- An incident response plan with named owners
- Notify the Data Protection Board and affected people when a breach occurs
- Remember CERT-In's separate rule: report cyber incidents within 6 hours of noticing them
6. People's rights and grievances
- A simple way to request access, correction and erasure
- A published contact for privacy questions and complaints, with responses on time
- Extra care, including verifiable parental consent, for children's data
Penalties
The Act allows significant financial penalties – up to ₹250 crore for failing to take reasonable security safeguards that leads to a breach. Penalties depend on the nature and seriousness of the failure, so documented, good-faith compliance matters.
Where to start this month
- Make the data map.
- Fix website forms: notice, consent checkbox and privacy policy link.
- Turn on MFA and review who can access customer and HR data.
- Run a vulnerability assessment of your website and apps.
The Tinos cyber security team helps businesses with data mapping, security controls, VAPT and incident readiness.
Frequently asked questions
Does the DPDP Act apply to small businesses?
Yes. It applies based on handling digital personal data, not company size, although the government can exempt some categories of businesses from certain obligations.
Does it cover employee data?
Yes. Employee records in HR, payroll and attendance systems are personal data, though some processing for employment purposes is treated as a legitimate use.
Do we need a Data Protection Officer?
Only organisations notified as Significant Data Fiduciaries must appoint one. Every business should still name a person responsible for privacy and grievances.
