For years, how an Indian business handled personal data — a customer's phone number, an employee's Aadhaar copy, a website visitor's email — was largely a matter of internal policy and goodwill. The Digital Personal Data Protection (DPDP) Act changes that. It gives individuals enforceable rights over their personal data and gives regulators real teeth, including significant financial penalties for non-compliance. For most businesses, the honest starting point is: we don't yet have a clear picture of what data we hold, why we hold it, or how we'd respond if it were breached.
This isn't a law that only concerns large tech platforms. Any entity that determines the purpose and means of processing personal data of individuals in India — a clinic, a school, an e-commerce store, a CA firm, a manufacturer with an HR database — is a Data Fiduciary under the Act, with obligations that scale with the sensitivity and volume of data involved.
What the Act actually asks of you
Stripped of legal language, the DPDP Act rests on a handful of practical requirements:
None of this is exotic. Most of it is what a well-run business already tries to do informally. What the Act changes is that it is now a legal obligation with a regulator, a complaint process and financial consequences — not just good practice.
Consent is not a checkbox
The Act is explicit that consent must be 'free, specific, informed, unconditional and unambiguous' — a pre-ticked box or a buried clause in a 40-page terms document does not qualify. Notices have to be understandable on their own, in clear language, before or at the time data is collected, and consent has to be as easy to withdraw as it was to give.
In practice, this means most businesses need to revisit their signup forms, HR onboarding paperwork, vendor data-collection points and website cookie banners — not just the privacy policy buried in a footer link.
Significant Data Fiduciaries face a higher bar
Entities that the government designates as Significant Data Fiduciaries — typically based on the volume and sensitivity of personal data processed, and the risk to individuals or national security — face additional obligations: appointing a Data Protection Officer based in India, conducting periodic Data Protection Impact Assessments, and undergoing independent data audits. Whether or not your organisation crosses that threshold today, building the underlying discipline — knowing your data, documenting your controls — puts you ahead rather than scrambling later.
Breach response is not optional
Under the Act, a personal data breach must be reported — both to the Data Protection Board and to every affected individual. There is no materiality carve-out for 'small' breaches in the way some other frameworks allow. That makes an untested, ad-hoc response ('we'll figure it out if it happens') a real liability. A workable breach plan needs, at minimum: how you detect a breach, who is notified internally and by when, a template for individual and regulatory notification, and someone accountable for the process — decided calmly in advance, not improvised under pressure.
Cross-border transfers get simpler, not stricter
Unlike some global privacy laws, the DPDP Act generally permits transferring personal data outside India by default, restricting transfers only to countries the government specifically notifies as restricted. That is a lighter-touch model than many businesses expect — but it still means tracking where your data actually goes, including via cloud vendors and SaaS tools, so you can confirm you're not inadvertently sending data to a restricted destination.
A practical readiness roadmap
For most organisations, getting from 'we haven't really looked at this' to a defensible position follows four stages:
Why this belongs with your CA, not just your lawyer
Data protection compliance sits at the intersection of legal obligation and operational reality — payroll systems, customer databases, vendor contracts, IT security, audit trails. That's exactly the terrain a technology-first CA firm already works in daily. We combine the compliance discipline of statutory work with the systems and data fluency to actually map your data flows and build controls that hold up — not just a policy document that sits unread in a drawer.
If you haven't yet assessed where your business stands against the DPDP Act, that's the first conversation worth having — before a breach or a complaint forces the issue.