India’s DPDP Act is changing how businesses collect, use and protect personal data. With enforcement beginning in November 2026, businesses need to start preparing now. From consent and data security to vendor contracts, retention and breach response compliance requires a structured approach. Understand your data today. Build stronger data protection and reduce regulatory risk tomorrow.
Understanding the DPDP Act: What Businesses Need to Know
India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) marks the country’s first comprehensive data protection law, and it will soon apply in full force. The DPDP Rules were notified in November 2025, enforcement begins in November 2026, and full compliance is required by May 2027. For businesses across sectors, this is no longer a matter to plan for later, it requires action now.
What the Act Covers
The DPDP Act governs how organisations i.e “Data Fiduciaries” collect, process, store, and share the personal data of individuals who are the “Data Principals”. It applies to any business that processes digital personal data in India, regardless of sector from financial institutions and SaaS platforms to schools and healthcare providers.
Core Obligations
At its core, the Act requires businesses to build and maintain the following:
● Notice and consent: clear, itemised consent at the point of data collection, with a genuine ability to withdraw it.
● Purpose limitation: personal data used only for the purpose it was collected for.
● Data Principal rights: mechanisms for individuals to access, correct, or request erasure of their data, along with a grievance redressal process.
● Breach notification: timely reporting to the Data Protection Board and to affected individuals.
● A designated contact point: a Data Protection Officer or equivalent grievance officer.
● Vendor and processor agreements: binding data processing terms with any third party handling personal data on the business’s behalf.
● Data retention and deletion practices: clear rules on how long data is held and when it must be deleted.
● Reasonable security safeguards: including encryption, access controls, and audit trail.
Why This Matters Beyond Compliance
Non-compliance carries significant financial exposure penalties of up to ₹250 crore per instance for failures such as inadequate security safeguards or delayed breach notification. But beyond the penalty risk, DPDP compliance is increasingly a marker of operational maturity. Clients,partners, and investors are beginning to expect it as a baseline, not a differentiator.
Certain organisations who process large volumes of sensitive data, or a high volume of data more generally may also be classified as Significant Data Fiduciaries (SDFs), which brings additional obligations such as periodic audits and Data Protection Impact Assessments.
Determining SDF status early is an important first step in any compliance programme.
Where Businesses Typically Find Gaps
In our experience advising clients across BFSI, EdTech, and SaaS sectors, the most common gaps fall into a few recurring categories:
● Data flowing to third-party vendors and partners without a formal data processing agreement in place.
● Consent mechanisms that don’t clearly separate purposes, or lack a real opt-out.
● No clear ownership of breach response or regulatory notification.
● Retention practices that were never formally defined, especially for data collected but not converted (e.g. rejected applications, inactive accounts)
● Sector-specific obligations such as RBI KYC/AML norms in financial services that overlap with, but are not identical to, DPDP requirements, creating confusion about which standard applies.
Getting Started
A practical DPDP compliance programme typically begins with a data inventory and gap assessment, followed by regulatory overlay mapping (reconciling DPDP with sector-specific rules), and a prioritised remediation roadmap. Businesses that start this process early well ahead of the November 2026 enforcement date are better positioned to implement changes without disrupting ongoing operations.
H & S India Law Firm advises businesses on DPDP Act compliance, from initial gap assessments to ongoing data protection governance. To discuss your organisation’s readiness, get in touch with our team.
