What Should Enterprises Do to Understand DPDPA Compliance?

MSInfo Privacy Team

MSInfo Services

March 15, 20258 min read

India's Digital Personal Data Protection Act 2023 is now law. Most enterprises are underprepared. Here's where to start.

The Digital Personal Data Protection Act 2023 (DPDPA) represents the most significant development in Indian data protection law in decades. Modeled on principles similar to the GDPR but tailored to the Indian context, the DPDPA creates comprehensive obligations for organizations that process the personal data of Indian citizens — including obligations that many organizations are simply not aware of yet.

Understanding the DPDPA starts with understanding who it applies to. The Act applies to the processing of digital personal data within India, and also to the processing of personal data outside India if it is in connection with any activity related to offering goods or services to Data Principals in India. This extraterritorial scope means that foreign companies with Indian customers are also covered.

The Act introduces several key concepts that organizations need to internalize. The Data Principal is the individual whose data is being processed. The Data Fiduciary is the organization that determines the purpose and means of processing — what GDPR would call the Data Controller. A Significant Data Fiduciary (SDF) is a category of Data Fiduciary that the government can designate based on the volume and sensitivity of data processed, and SDFs face additional obligations including mandatory appointment of a Data Protection Officer and annual data protection impact assessments.

Consent is a central pillar of the DPDPA. Data Fiduciaries must obtain free, specific, informed, unconditional, and unambiguous consent before processing personal data — except in specific legitimate use cases defined in the Act. Existing consent mechanisms — buried checkbox agreements, bundled consent, pre-ticked boxes — will not meet the DPDPA standard.

Data retention is another critical obligation. Organizations may only retain personal data for as long as necessary for the specified purpose. After that purpose is served, the data must be erased. For many organizations, this requires a fundamental rethinking of data lifecycle management practices.

Penalties under the DPDPA are significant — up to ₹250 crore for a data breach resulting from failure to implement reasonable security safeguards, and up to ₹200 crore for failure to notify a data breach to the Data Protection Board within prescribed timelines.

MSInfo Services has developed a proprietary DPDPA compliance product specifically designed to help organizations systematically assess their current data practices, identify gaps against the Act's requirements, and implement the controls and processes needed for compliance.