DPDP, in plain words.What it asks of a business like yours.
India's Digital Personal Data Protection Act is now law, and its Rules are notified. If your business holds people's details on a computer, it applies to you. This page tells you what that means, by when, and the first three things to do. No legal background needed.
If you hold it digitally, it counts.
DPDP covers personal data in digital form. A membership spreadsheet, a clinic's appointment book, an enquiry form, a payroll file: if it identifies a person and sits on a computer, it is in. Paper records count too once they are typed in or scanned.
01A gym with 400 members on a spreadsheet.
02A clinic with patient appointments in a booking app.
03A shop with customer phone numbers in WhatsApp.
There are exemptions, mostly for personal and household use and some public purposes. If you are selling to customers or employing staff, assume it applies.
It arrives in phases. The clock has started.
- November 2025. The Rules were notified. The Data Protection Board is being set up.
- November 2026. The rules for registered Consent Managers take effect.
- May 2027. The obligations on businesses take effect: notices, consent, people's rights, breach notification, children's data. Penalties apply from here.
Dates are those in the notified Rules. If the government brings them forward, this page changes the same day.
Eighteen months sounds like a lot. Mapping your data, fixing consent and setting up request handling takes most businesses a few months of part-time attention. Start now and May 2027 is a formality.
Six things, not sixty.
- Tell people what you collect and why.A notice in plain words, in a language they understand.
- Ask before you use it for anything optional.Consent that is specific and can be withdrawn.
- Answer people who ask.Access, correction and erasure requests, within set timelines.
- Hear complaints.A grievance route, with someone responsible.
- Keep it only as long as you need it.Retention you can explain.
- Protect it, and say so if it leaks.Reasonable security and breach notification.
A privacy policy and a cookie banner cover part of the first two. The rest is work, and it needs a place to live.
Want the detail? Read our guides to the DPDP Act 2023 and the DPDP Rules 2025, or work through the DPDP compliance checklist.
The first three things.
Find out where personal data lives. Systems, spreadsheets, inboxes, paper. You cannot protect what you have not found.
Fix the front door. Your website's banner and notices, so consent is asked properly and recorded.
Give requests a home. A form, an owner and a clock, so the first “what do you hold about me?” is not a panic.
ComplyZero does all three with you, and keeps the records as you go.
Things people get wrong.
- “We are too small for this.”
- The law applies by what you do with data, not by size. Penalties scale, obligations do not.
- “Our IT vendor handles it.”
- They handle their part. The business that decides what data to collect is responsible.
- “A policy page is enough.”
- It is one of six things.
- “We will wait for enforcement.”
- The Board will exist before the obligations bite. Businesses that start in 2026 will be the ones answering calmly in 2027.
Ready to see what applies to you?
Book a demo and we walk through your business, not a slide deck. Or scan your website now and see what loads before anyone says yes.
This page explains the law in general terms and is not legal advice.