India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) is no longer a future law. The government notified the DPDP Rules in November 2025, and the Data Protection Board was set up straight away. Most of the duties on businesses, including notices, consent, security safeguards, breach reporting and deleting old data, come into force 18 months after the Rules were published, which means May 2027.
That sounds far away, but it isn’t much time to change how a business collects and handles personal data. And there is no general exemption for small businesses. If you keep customer details in a CRM, collect enquiries through a website form, run payroll, or have a WhatsApp group of clients, the Act applies to you.
This post explains, in plain terms, what a small or mid-sized Indian business actually has to do. It is a practical summary, not legal advice: for your specific situation, speak to your lawyer.
The words the Act uses
- Personal data: any data about an identifiable person, such as a name, phone number, e-mail address, PAN, photo, CCTV footage or purchase history.
- Data Principal: the person the data is about (your customer, employee or website visitor).
- Data Fiduciary: you, the business that decides why and how the data is used.
- Data Processor: a company that processes data on your behalf, such as your CRM provider, payroll provider or cloud host.
The Act covers personal data in digital form, including paper records you later scan or type into a system. It also applies to businesses outside India that offer goods or services to people in India.
What you have to do
1. Know what personal data you hold
You can’t protect or delete what you don’t know about. List every place personal data lives: website forms, CRM, accounting, HR and payroll files, e-mail, shared drives, spreadsheets, CCTV, WhatsApp, and the systems of vendors who process it for you. For each, note what data, why you have it, who can see it, and how long you keep it.
2. Have a valid reason for using it
Most processing needs the person’s consent, which must be free, specific, informed and given by a clear action, such as ticking an unticked box. Pre-ticked boxes and “by using this site you agree” do not count. The Act also allows some legitimate uses without separate consent, for example when someone voluntarily gives you their details for a specific purpose, or for employment-related purposes. People must be able to withdraw consent as easily as they gave it.
3. Give a clear notice
When you ask for consent, you must give a notice that stands on its own and is easy to understand. It should say what personal data you collect and why, how to withdraw consent, how to exercise their rights, and how to complain to the Data Protection Board. People should be able to read it in English or any of the languages in the Eighth Schedule of the Constitution.
4. Protect it with reasonable security safeguards
The Rules spell out the minimum: encryption, masking or similar protection of the data; access control so only the right people see it; logs that let you detect and investigate unauthorised access, kept for at least one year; and backups and continuity plans. You must also have contracts that require your processors to protect the data. Failing to take reasonable security safeguards carries the largest penalty in the Act: up to ₹250 crore.
5. Report breaches
If personal data is breached, you must tell the affected people without delay: what happened, the likely consequences, what you are doing about it and who they can contact. You must also inform the Data Protection Board without delay, with a detailed report within 72 hours. Not reporting can cost up to ₹200 crore. Remember that CERT-In separately requires many cyber incidents to be reported within 6 hours, so you need a plan that covers both.
6. Delete data you no longer need
Once the purpose is served, or consent is withdrawn, you must erase the personal data, and make your processors erase it too, unless another law requires you to keep it (tax and accounting records, for example). Very large e-commerce, social media and gaming platforms have specific inactivity deadlines; for everyone else, the rule is simply: don’t keep personal data “just in case”.
7. Answer people’s requests
People have the right to ask what data you hold about them, to have it corrected or erased, to nominate someone to act for them, and to have their complaints handled. Publish a contact (an e-mail address and a named person or role) who can answer questions about personal data, and decide who handles requests and how quickly.
8. Take extra care with children’s data
Anyone under 18 is a child under the Act. You need verifiable consent from a parent or guardian, and you must not track, behaviourally monitor or target advertising at children. Schools, coaching centres, ed-tech, gaming and children’s retail need to look at this closely.
The penalties
| Failure | Penalty up to |
|---|---|
| Not taking reasonable security safeguards | ₹250 crore |
| Not reporting a personal data breach | ₹200 crore |
| Not meeting the obligations for children’s data | ₹200 crore |
| Other breaches of the Act or Rules | ₹50 crore |
The Board decides the actual amount based on factors such as how serious the breach was and what you did to limit it. Good records of what you did, and when, will matter.
A 90-day starter plan
Month 1: find out. Name one person responsible for data protection. Build the data inventory. List every vendor that touches personal data.
Month 2: fix the front door. Rewrite the privacy notice in plain language. Fix consent on website forms, landing pages and WhatsApp campaigns. Add data-protection clauses to vendor contracts.
Month 3: fix the back office. Turn on multi-factor authentication, tighten who can access what, make sure logs are kept for a year, and test your backups. Write a breach plan that covers both the 6-hour CERT-In report and the 72-hour Board report. Set retention periods and delete what you no longer need.
Doing this well before May 2027 also helps with customers: larger clients are already asking their suppliers how they protect personal data.
How CATEYE can help
Our virtual CISO service gives you a senior security leader who can run your DPDP programme, from the data inventory to breach planning, without a full-time hire. Our IT security audit checks the security safeguards the Rules ask for and gives you a clear fix list. Talk to us about where to start.
