Most of what's been written about India's Digital Personal Data Protection (DPDP) Act is written by lawyers, for lawyers. That's useful. But when a business owner asks me about it, the question is never "what does Section 8(5) say?" It's "what do I actually have to change, and how much work is it?"
None of this is impossible. But almost all of it lives in your technology, not in your privacy policy. And most of it can't be done in the last month.
A note before we start: I'm a CTO, not a lawyer. This guide is about what has to change in your systems. For legal interpretation of how the Act applies to your business, speak to a lawyer.
The timeline
- Rules notifiedData Protection Board set up
- Consent Manager rules startRegistration of Consent Managers
- Main obligations applyConsent, security, breach reporting, people's rights, children's data
The DPDP Rules were notified on 13 November 2025, with obligations phased in over 18 months. The rules on Consent Managers start one year after notification, and the core obligations start eighteen months after it.
In early 2026, the government discussed shortening this window. As of this writing, no change has been notified, but treat May 2027 as the latest date, not the target.
Does this apply to your business?
Almost certainly, yes. The Act covers digital personal data: any information about an identifiable person that you collect or store digitally. That includes data you collected on paper and later typed into a system.
If your business has any of these, you're a "Data Fiduciary" under the Act:
- A website with an enquiry, booking or contact form
- A customer app, a loyalty programme or an online store
- A CRM, ERP or HR system holding customer, dealer or employee details
- WhatsApp or email marketing lists
- An app built for you by an agency, or one you built yourself on an AI tool
It doesn't matter how small the business is. Size changes some obligations: the very largest e-commerce, gaming and social media platforms get extra rules, and the government can name some businesses "Significant Data Fiduciaries" with heavier duties. But the core rules below apply to everyone.
One point that surprises owners: you're responsible for what your vendors do with your customers' data. If your agency, your hosting provider or your CRM tool mishandles it, the obligation still sits with you.
What has to change in your systems
This is the part most guides skip. Here's what each rule means for the technology you already run.
01Consent and notices: your forms, sign-up flows and app onboarding
The Rules say a consent notice must stand on its own, in clear and plain language, and list exactly what data you collect and why. It must also tell people how to withdraw consent, use their rights and complain to the Data Protection Board. Withdrawing has to be about as easy as giving consent.
- Every form that collects personal data needs a clear notice next to it, not just a link to a 4,000-word privacy policy.
- Pre-ticked boxes and "by continuing you agree" banners won't hold up. Consent has to be a clear, separate action, per purpose. Marketing consent can't be bundled with the order.
- You need a consent record: who agreed, to what, when, and through which version of the notice. Most websites and CRMs don't store this today.
- An "unsubscribe" or "withdraw consent" option has to actually flow through to every system that uses the data, including your WhatsApp and email tools.
02Security: your servers, databases and who can log in
The Rules list the safeguards: encryption, masking or tokenisation of personal data, access control, monitoring, backups, and access logs. Logs and the related personal data must be kept for at least one year.
- Shared logins ("admin@company" used by five people) have to go. Each person needs their own access, limited to what their job needs.
- Databases and backups should be encrypted. Customer phone numbers and IDs shouldn't sit in plain text in an Excel export on someone's laptop.
- You need logs of who accessed personal data, kept for a year, and someone who actually reviews them.
- Your contracts with vendors who handle the data must include security obligations.
03Breach response: a plan before you need it
If personal data is breached, you must tell the Data Protection Board without delay, and send a detailed report within 72 hours: what happened, why, what you've done, and how you've informed affected people. Affected people must also be told without delay, in plain language.
- You need to be able to detect a breach. Without monitoring and logs, most small businesses find out weeks later, from a customer.
- Write a one-page breach plan now: who decides, who investigates, who writes to the Board and to customers, and the templates they use.
04People's rights: a way to see, correct and delete their data
People can ask what data you hold, ask you to correct or erase it, and nominate someone to act for them. You must publish how they do this on your website or app, and respond within 90 days.
- A simple "Your data" request page or form, routed to a named person.
- The ability to actually find one person's data across your website, CRM, app database, spreadsheets and marketing tools, and delete it. This is where scattered data gets expensive.
- A retention rule for each kind of data: how long you keep it, and what deletes it after that.
05Children's data: age checks and parental consent
Before processing a child's data (under 18), you need verifiable consent from a parent or guardian, including a check that the parent is an adult. Some purposes and sectors, such as healthcare, education and child safety, have specific exemptions.
- If children can use your product, you need an age gate and a parental-consent flow that can be verified, not a checkbox saying "I am over 18".
- Ed-tech, gaming, kids' retail and coaching businesses should treat this as their biggest piece of work.
Your vendors: 8 questions to send this week
Most businesses don't run their own technology. An agency built the app, a freelancer runs the website, and the CRM and WhatsApp tools are SaaS. Since the responsibility stays with you, send these questions to each vendor that touches customer data:
- Where is our customers' personal data stored, and in which country?
- Is it encrypted at rest and in transit? Are backups encrypted too?
- Who on your team can access it, and is that access logged? Can we get the logs?
- Can you keep access logs for at least one year?
- If there's a breach, how quickly will you tell us, and what will you share? (We have 72 hours to report.)
- Can you find and delete one person's data across everything you run for us, on request?
- Does our contract include data protection and security obligations? If not, can we add them?
- Who owns the code and the data, and can we take both with us if we leave?
Vague answers to questions 3, 5 and 6 are the ones to worry about. They usually mean the work hasn't been done yet, and it will land on your budget.
The penalties, briefly
The Act sets maximum penalties per breach, decided by the Data Protection Board:
| What went wrong | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Failing to notify the Board or affected people of a breach | ₹200 crore |
| Breaking the rules on children's data | ₹200 crore |
| Breaking the extra duties of a Significant Data Fiduciary | ₹150 crore |
| Breaking any other provision of the Act or Rules | ₹50 crore |
These are ceilings, not fixed fines, and the Board weighs the nature and impact of each case. I wouldn't plan around the headline numbers. The more practical risk for most businesses is a breach you can't explain, with customers asking questions and no logs to answer them.
A 90-day plan to get ready
May 2027 sounds far away. It isn't, once you count vendor timelines, budget approvals and testing. Here's how I'd run it for a mid-size business:
Find the data.
- List every place personal data lives: website forms, app database, CRM, ERP, HR system, spreadsheets, WhatsApp and email tools, and backups.
- Note what's collected, why, who can access it, and which vendor runs it.
- Send the 8 vendor questions above.
Fix the front door and the locks.
- Rewrite consent notices and forms, and start storing consent records.
- Remove shared logins, switch on encryption and access logging, and set log retention to at least a year.
- Write the one-page breach plan.
Make rights work end to end.
- Launch the "Your data" request page and name the person who handles it.
- Test it: pick one real customer and try to find, export and delete their data everywhere. Fix whatever breaks.
- Set retention rules and automate deletion where you can.
If you're building something new in the meantime, a new app, a portal or an AI tool, build these in from day one. Adding them to a live system later always costs more.
Frequently asked questions
When does the DPDP Act come into force?
In phases. The DPDP Rules were notified on 13 November 2025. The Consent Manager rules start on 13 November 2026, and the main obligations (consent, security, breach reporting, people's rights and children's data) start on 13 May 2027. The government has discussed shortening this window, so don't count on the full time.
Does the DPDP Act apply to small businesses?
Yes. There's no size exemption for the core rules. Only the extra duties for Significant Data Fiduciaries and some retention rules depend on size.
Is a privacy policy enough to comply?
No. A policy describes what you do. The Act asks you to actually do it: record consent, secure the data, log access, report breaches and act on people's requests. Those are changes to your systems.
What is a Consent Manager?
A registered company that lets people give, manage and withdraw consent across businesses from one platform. Consent Managers must be registered with the Data Protection Board and keep consent records for at least seven years. Most businesses won't become one, but your systems may need to work with them.
Do I need to report every data breach?
Yes. Any personal data breach must be reported to the Board and to affected people, with a detailed report to the Board within 72 hours.
We used an AI tool to build our app. Does this apply?
Yes, and it's worth checking closely. Apps built quickly on AI platforms often skip access controls, logging and proper consent records. They work, but they may not be ready for the Act.