DPDP Act 2023 Compliance Guide for Indian Businesses | ISOQAR India

Key definition: Data FiduciaryUnder the DPDP Act, any organisation that determines the purpose and means of processing personal data is a Data Fiduciary. This includes virtually every organisation with employees, customers, or suppliers — making the Act applicable across all sectors without exception.

Who does the DPDP Act apply to?

The DPDP Act applies to any entity — Indian or foreign — that processes the personal data of individuals in India, either in digital form or in non-digital form that is subsequently digitised. There is no minimum size threshold. A startup with 10 employees processes personal data. A large manufacturer with a workforce database processes personal data. A hospital, a bank, an e-commerce platform — all are covered.

Key obligations every organisation must meet:

1. Consent management

Every instance of personal data processing must be backed by clear, specific, informed, and unambiguous consent — or must fall within a defined legitimate use. Consent must be as easy to withdraw as it is to give. This means your organisation needs a consent management framework that captures, records, and manages consent at scale.

2. Data Principal rights

Individuals (called Data Principals under the Act) have the right to access information about their data, correct inaccurate data, erase data, and raise grievances. Your systems must be capable of responding to these requests within defined timeframes.

3. Grievance redressal mechanism

Every Data Fiduciary must appoint a Grievance Officer and publish their contact details in a Privacy Notice. This is one of the most externally verifiable requirements — and one the Board is likely to check first.

4. Data Protection Officer (Significant Data Fiduciaries)

Organisations classified as Significant Data Fiduciaries — based on volume, sensitivity, and potential risk of the data they process — must appoint a Data Protection Officer based in India.

5. Data breach notification

In the event of a personal data breach, Data Fiduciaries must notify the Data Protection Board and affected Data Principals in the manner and within the timeframes prescribed. Failure to notify is one of the most documentable violations.

6. Data retention and deletion

Personal data must not be retained longer than necessary for the purpose for which it was collected. Organisations need defined data retention schedules and documented deletion processes — not just informal understanding.

Important: Children’s data The DPDP Act contains specific and strict requirements around processing personal data of children (those under 18). Verifiable parental consent is required before processing a child’s data. For sectors like education, healthcare, and consumer apps, this is a significant compliance requirement.

The Data Protection Board is now constituted — what changes?

The constitution of the Data Protection Board of India marks a fundamental shift in the DPDP compliance landscape. Previously, enforcement was largely directed through CERT-In breach notification guidance. Now, the formal adjudicatory mechanism is operational. This means:

• Data Principals can formally file complaints against organisations
• The Board can initiate investigations into organisations on its own
• Penalties can be formally imposed — up to ₹250 crore per violation
• The Board can direct organisations to take corrective action

Based on how comparable regulatory bodies have operated globally — from the UK’s ICO to the EU’s data protection authorities — the Board is likely to begin with high-visibility, easily documentable violations before moving to more complex systemic audits.

What the Board will look for first:

1. Consent mechanism failures— visible and verifiable from public-facing systems.
2. Grievance Officer absence— verifiable from the privacy notice.
3. Breach notification failures— verifiable from incident records. These are the easiest to document and the most consistently present across non-compliant organisations.
   

   Is your organisation in a position to demonstrate documented compliance?

   ISOQAR India’s DPDP Readiness Assessment identifies exactly where you stand — and gives you a clear, prioritised roadmap to close the gaps. Free consultation, no obligation.

   Request Your Free DPDP Assessment →

What protects you — documented good-faith effort

The DPDP Act’s enforcement framework is designed to penalise deliberate non-compliance — not genuine, documented effort. This is a critical distinction that many organisations miss when they think about compliance.

An organisation that has conducted a gap assessment, documented its findings, implemented improvements — even if those improvements are incomplete — is in a fundamentally different position before the Board than an organisation that has done nothing. The Board cannot penalise you for processes you have built, documented, and maintained, even if they are imperfect.

• Processes built and documented — even if imperfect — are not penalised
• A documented compliance gap assessment is a good-faith record
• Improvement roadmaps show intent and effort — both matter to regulators
• Organisations that have done nothing are in the most exposed position

The practical implication: starting your compliance journey today — even if you cannot complete it before the first enforcement action — is dramatically better than waiting. Every step you take and document is a step toward a defensible compliance position.

Practical steps to start your DPDP compliance journey

Step 1: Conduct a data mapping and inventory exercise

Before you can comply, you need to know what personal data you hold, where it sits, how it flows through your organisation, and who has access. This data inventory is the foundation of everything else.

Step 2: Review your consent mechanisms and privacy notices

Audit all touchpoints where you collect personal data — web forms, HR systems, customer onboarding, vendor contracts. Are consent mechanisms clear, specific, and withdrawable? Are your privacy notices comprehensive and in plain language?

Step 3: Appoint a Grievance Officer and publish contact details

This is one of the most immediately actionable and externally visible requirements. Appoint a named Grievance Officer, define the grievance process, and ensure contact details appear in your privacy notice.

Step 4: Build a data breach response process

Define what constitutes a breach, who is responsible for identifying and escalating it, and what the notification process looks like. Document this process and ensure the relevant teams are trained on it.

Step 5: Review third-party data processing contracts

Every vendor, partner, or processor that handles personal data on your behalf needs appropriate contractual terms that reflect DPDP Act obligations. Review your existing contracts and update where necessary.

Step 6: Train your teams

DPDP compliance is not an IT project or a legal project — it is an organisation-wide responsibility. Awareness training for all employees, role-specific training for HR, IT, Legal, and Compliance teams, and leadership briefings for senior management are all essential.