The Digital Personal Data Protection Act (DPDP) is India's first comprehensive privacy law. Passed in 2023 and operational from 2024–25, it is fully enforced in 2026. Every Indian business that handles personal data — banks, hospitals, e-commerce, schools, coaching institutes, even small SaaS startups — has obligations under DPDP. Non-compliance can attract penalties up to ₹250 crore. This is the plain-English guide.
What DPDP Actually Regulates
- All "digital personal data" of "data principals" (individuals) inside India
- Applies to all "data fiduciaries" — anyone who decides why & how data is processed
- Applies even to foreign companies if they offer goods/services to people in India
Your Obligations as an Indian Business
- Lawful basis — process personal data only with explicit consent OR for specific "legitimate uses" listed in the Act
- Notice — clearly tell the user what data, why, how long, and how to withdraw consent
- Purpose limitation — can't use data collected for one purpose for another
- Data minimization — collect only what you need
- Security safeguards — "reasonable security" practices (encryption, access control, breach detection)
- Breach notification — to the Data Protection Board AND affected users, in time prescribed by rules
- Grievance redressal — appoint a contact person and respond to user complaints
- Children's data — explicit parental consent for under-18, no targeted ads
Significant Data Fiduciaries — Extra Obligations
The government can designate large companies (banks, telcos, big tech) as "Significant Data Fiduciaries" with additional obligations:
- Appoint a Data Protection Officer (DPO) based in India
- Independent Data Protection Impact Assessment (DPIA)
- Periodic data audits
Penalties — They Are Big
- Failure to safeguard data → up to ₹250 crore
- Failure to notify breach → up to ₹200 crore
- Failure to fulfill children-data obligations → up to ₹200 crore
- Other contraventions → up to ₹50 crore
Practical Compliance Checklist for Indian SMBs in 2026
- Map your data — what personal data you collect, where it is stored, who can access it
- Update your privacy policy in plain English (not legalese)
- Implement consent collection mechanisms for every new sign-up
- Encrypt customer databases at rest (LUKS / Transparent Data Encryption)
- Enable TLS 1.2+ for all customer-facing endpoints
- Implement role-based access control — no shared admin passwords
- Document your breach response plan — who notifies, in what time frame
- Appoint a grievance officer + publish contact details on your website
- Run an annual cyber security audit — see our VAPT services in Haryana
- Train employees — most breaches start with a phishing click
How DPDP Differs from GDPR
- DPDP is shorter and less prescriptive than GDPR
- No explicit "right to portability" — you can request your data but not in machine-readable format
- Stricter rules for children
- Cross-border transfer is governed by a "negative list" — easier than GDPR's adequacy / SCCs
What Cyber Security Teams Should Be Doing
- Document your "reasonable security practices" baseline
- Stand up an incident response runbook with DPDP-specific timelines
- Tabletop-exercise breach notifications quarterly
- Get an annual penetration test mapped to DPDP "security" obligation
- Train developers on privacy-by-design — most data leakage is at the code level
Train at Cyber Defence Academy, Hisar
Hands-on labs, real-world projects, government-of-India trusted institute. Online + offline batches across Haryana. Placement support, lifetime access to materials.
FAQs
Does DPDP apply to my 5-person startup in Hisar?
Yes — if you collect any personal data from Indian users.
Is consent always required?
No — "legitimate uses" (employment, regulatory compliance, medical emergencies, etc.) don't need explicit consent, but you still must follow other obligations.
What about cookies?
Cookie consent expectations are evolving. Be conservative — use a banner with explicit opt-in for non-essential cookies.