Data Privacy Compliance Guide 2026

DPDP Act 2023 Compliance
for Small Businesses — Complete Checklist

India's Digital Personal Data Protection Act 2023 applies to every business that processes personal data. Penalties reach ₹250 crore. This guide gives you the complete compliance checklist and a 5-step implementation plan.

₹250 Cr

Max penalty for security breach

72 hrs

Breach notification window

Every

Indian business processes personal data

Check DPDP Readiness Talk to a Compliance Advisor

Need Expert Help?

Talk to an IBEAN specialist about applying these insights to your business — personalised advisory, not just information.

WhatsApp Us

Direct line to our advisory team

Fixed-fee diagnostic first. No commitment required.

The Law Explained

What Is the DPDP Act 2023 — and Does It Apply to You?

The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection law. It was passed by Parliament in August 2023 and is being implemented in phases. The Act applies to any entity that processes personal data of individuals in India — regardless of size, sector, or turnover.

If your business has customer records, employee data, vendor contact details, or website analytics — you process personal data, and the DPDP Act applies to you.

Common Misconception

Many Indian SMEs believe data protection laws only apply to large tech companies or businesses with customer portals. The DPDP Act applies to any business that collects personal data — including a standalone shop with a WhatsApp contact list, a manufacturer with an HR database, or a service firm with client email records.

Penalty Structure

DPDP Act 2023 — Penalty Schedule

Penalties are per violation and multiply across incidents

Violation	Maximum Penalty
Failure to implement adequate security safeguards (resulting in breach)	Up to ₹250 crore
Failure to notify Data Protection Board of a data breach	Up to ₹200 crore
Non-compliance with obligations related to children's data	Up to ₹200 crore
Failure to respond to Data Protection Board's directions	Up to ₹150 crore
Breach of any other provision of the Act	Up to ₹50 crore
Repeated non-compliance	Penalties multiply per incident

Compliance Checklist

DPDP Act 2023 — Complete Compliance Checklist for Small Businesses

25 compliance requirements across 7 categories. "Required" items are mandatory obligations for most Data Fiduciaries under the current provisions.

Consent

Obtain free, informed, specific, and unambiguous consent before collecting personal data

Required

Consent request is separate from other terms — not buried in T&C

Required

Provide an easy mechanism for users to withdraw consent at any time

Required

Keep records of consent — who consented, when, and for what purpose

Required

Notice

Privacy notice updated to describe: what data is collected, why, how long it is kept, and who it is shared with

Required

Notice provided in language the data principal (person) understands

Required

Contact details of Data Protection Officer (if applicable) or grievance officer in notice

Required

Data Security

Reasonable security safeguards implemented — encryption at rest and in transit

Required

Access controls — personal data accessible only to employees who need it

Required

Audit logs maintained for access to personal data

Required

Vendor/processor agreements updated to include data security requirements

Required

Data Rights

Process to respond to data access requests (individuals requesting their own data) within 48 hours

Required

Process to respond to data correction requests

Required

Process to respond to data erasure requests ("right to be forgotten")

Required

Grievance redressal mechanism in place with a named contact

Required

Data Breach Notification

Incident response plan covers personal data breaches specifically

Required

Notification to CERT-In / Data Protection Board within 72 hours of breach discovery

Required

Notification to affected data principals (individuals) in the event of a significant breach

Required

Breach register maintained documenting all incidents and response actions

Required

Data Retention & Deletion

Retention policy defined — data not kept longer than necessary for the stated purpose

Required

Deletion process in place — personal data erased when purpose is fulfilled or consent withdrawn

Required

Retention schedule documented and reviewed annually

Cross-Border Data Transfers

Identify if personal data is transferred outside India (e.g., cloud providers, SaaS tools, analytics)

Required

Ensure transfers comply with permitted country list (to be notified by Government)

Data processing agreements with international processors include DPDP Act obligations

Implementation Guide

5-Step DPDP Act Compliance Plan for Indian SMEs

Week 1–2

Data Mapping

Create a personal data inventory. For every category of personal data: What data? Why collected? Where stored? Who has access? How long kept? Who is it shared with? This map is the foundation of everything else.

Week 3–4

Consent Audit

Review every data collection point — website forms, app registration, physical intake forms, email marketing lists, employment contracts. Ensure DPDP-compliant consent is obtained at each point. Update forms and mechanisms where they fall short.

Month 2

Privacy Notice Update

Rewrite your privacy policy and any data notices to meet DPDP Act requirements. Describe: what data is collected, purpose, retention period, sharing with third parties, individual rights (access, correction, erasure), and grievance officer contact details.

Month 2

Breach Response Protocol

Define and document your incident response procedure for personal data breaches. Who is notified internally? Who contacts CERT-In / the Data Protection Board? Who contacts affected individuals? The 72-hour clock starts from breach discovery — not breach investigation.

Month 3

Vendor & Security Controls

Update contracts with all vendors who process personal data on your behalf (cloud providers, HR software, CRM, accounting tools, marketing platforms). Add DPDP Act obligations. Implement security safeguards: encryption, MFA, access logs, regular security reviews.

Frequently Asked Questions

DPDP Act 2023 — Common Questions from Indian SMEs

Frequently Asked Questions

DPDP Act 2023 — Common Questions from Indian SMEs

7 Questions

The Digital Personal Data Protection Act 2023 (DPDP Act) is India's comprehensive data protection law, passed by Parliament in August 2023. It governs how businesses collect, process, store, and transfer personal data of individuals in India. It replaces the patchwork of data protection provisions scattered across the IT Act 2000 and its rules. Key provisions include: mandatory consent for data collection, individual rights (access, correction, erasure), data breach notification within 72 hours, and penalties up to ₹250 crore for significant violations.

A Data Fiduciary is any person or entity that, alone or with others, determines the purpose and means of processing personal data. In simple terms: if you decide why and how personal data is collected and used, you are a Data Fiduciary. This includes virtually every business — a shop that keeps a customer database, a manufacturer that has employee records, a SaaS company that stores user data. "Significant Data Fiduciaries" (high-risk businesses processing large volumes of sensitive data) have additional obligations.

Penalties are imposed by the Data Protection Board (DPB), a regulatory body to be constituted under the Act. Penalties for significant violations: failure to implement security safeguards resulting in a breach — up to ₹250 crore; failure to notify the DPB of a breach — up to ₹200 crore; non-compliance with children's data rules — up to ₹200 crore; failure to follow DPB directions — up to ₹150 crore; other violations — up to ₹50 crore per violation. Penalties compound across multiple incidents.

A practical 5-step approach: (1) Data mapping — inventory every category of personal data your business collects, where it is stored, who has access, and why it is collected; (2) Consent review — audit every data collection point (website forms, app registration, physical forms) and ensure DPDP-compliant consent is obtained; (3) Privacy notice update — rewrite your privacy policy to comply with DPDP notice requirements; (4) Breach response — put a 72-hour incident response protocol in place for data breaches; (5) Vendor audit — update contracts with every vendor who processes personal data on your behalf. IBEAN's cybersecurity readiness assessment maps your DPDP compliance gaps and builds the remediation plan.

Yes. The DPDP Act applies to any entity (called a "Data Fiduciary") that processes personal data of individuals in India — regardless of business size, turnover, or industry sector. If you have customer records, employee data, vendor contacts, or any other personal data of Indian individuals, the Act applies to you. The Government may notify certain small businesses ("Small Data Fiduciaries") for lighter compliance obligations, but these exemptions have not yet been notified — so all businesses should implement full compliance.

The DPDP Act protects all "personal data" — any data that can identify an individual, directly or indirectly. This includes: names, contact details, email addresses, phone numbers, Aadhaar numbers, PAN, biometric data, financial data, health records, employee data, and IP addresses. The Act has special protections for "sensitive personal data" categories including health, financial information, and biometric data. It also has strict rules for children's data — no processing of data of individuals under 18 without verifiable parental consent.

A Data Protection Officer is mandatory for "Significant Data Fiduciaries" — businesses the Government identifies as processing data at a scale or sensitivity that warrants additional oversight. This designation has not yet been formally notified. However, the Act requires all businesses to designate a Grievance Redressal Officer — a named contact for individuals to raise complaints about their data. This is less onerous than a full DPO but still needs to be in place.

help_outline

Additional questions? Contact the advisory team

Is Your Business DPDP Act Compliant?

IBEAN's Cybersecurity & DPDP Readiness Assessment maps your current compliance posture — consent mechanisms, security safeguards, breach response, and data rights processes — and builds the gap closure plan.

Check DPDP Readiness Talk to a Compliance Advisor