DPDP Act Compliance India.
Know exactly where you stand.

The DPDP Act 2023 applies to all entities (companies, firms, individuals, and government bodies) that process digital personal data of Indian residents in India, or that process data outside India if it involves Indian residents' data. There is no revenue threshold or employee count minimum — a startup with 5 employees that collects customer email addresses is subject to the Act. Certain exemptions exist for processing for personal or household purposes, research/archival/statistical purposes, and certain government processing activities.

DPDP Act penalties are tiered by offence: Failure to implement reasonable security safeguards: up to ₹250 crore; Failure to notify a data breach: up to ₹200 crore; Failure to notify Data Principals of a breach: up to ₹200 crore; Violation of children's data processing rules: up to ₹200 crore; Failure to fulfil Data Principal rights (access, correction, erasure): up to ₹50 crore; Non-compliance with other provisions: up to ₹50 crore. Penalties are per complaint/per incident, not annual — multiple incidents in a year compound. The Data Protection Board, once constituted, will handle adjudication.

Under the DPDP Act, a Data Fiduciary is any entity that determines the purpose and means of processing personal data (equivalent to GDPR's "data controller"). All businesses that collect and process customer, employee, or vendor personal data are Data Fiduciaries. Key obligations: obtain valid consent, provide clear notice of processing purposes, implement reasonable security safeguards, respond to Data Principal rights requests (access, correction, erasure, grievance), notify data breaches to CERT-In within required timelines, and ensure Data Processors (vendors who process data on your behalf) have appropriate contracts.

Significant Data Fiduciaries (SDFs) are entities designated by the Central Government based on factors like volume of data processed, sensitivity of data, national security implications, or risk to rights of Data Principals. SDFs have additional obligations: mandatory appointment of a Data Protection Officer (DPO) based in India, mandatory appointment of an independent Data Auditor, and periodic Data Protection Impact Assessments (DPIAs). The specific SDF designations have not yet been formally notified as of 2026 but are expected to cover large e-commerce platforms, social media, and fintech companies.