A lot of business owners still treat India’s Digital Personal Data Protection (DPDP) Act, 2023 as something they’ll “get to eventually.” I get why — it reads like dense legal text, and most founders are busy running the actual business. But here’s the thing: this law is already shaping how companies operate, and the businesses that wait until enforcement tightens are the ones that end up scrambling.
I’ve spent a good chunk of the last year working with startups, clinics, fintech platforms, and e-commerce brands trying to sort this out. And honestly, the confusion is usually less about the law itself and more about not knowing where to start. So let’s break it down in plain terms — what DPDP compliance actually means for you, and whether your business is anywhere close to ready.
So, what exactly is the DPDP Act?
In simple terms, it’s India’s rulebook for how companies are allowed to collect, use, store, and share personal data — of customers, employees, website visitors, anyone whose data you touch. The law calls individuals “Data Principals” and calls businesses “Data Fiduciaries” (yes, more legal jargon, but stick with me).
It doesn’t matter if you’re an Indian company or a foreign one. If you’re processing personal data of people located in India — even offline data that gets digitized at some point — the Act applies to you. That catches a lot more businesses than people realize.
Some of the core obligations: getting proper consent before collecting data, not holding on to more data than you actually need, notifying people within a set timeline if there’s a breach, and in some cases, appointing a Data Protection Officer.
Why you probably shouldn’t shrug this off
Here’s what surprises most clients when we first talk — they assume this law is only for big corporations sitting on mountains of sensitive data. Not true. A basic contact form on your website counts. An HR spreadsheet with employee phone numbers counts. A checkout page that stores customer addresses counts.
And the penalties aren’t small — the Act allows for fines up to ₹250 crore for certain violations. That number tends to get people’s attention, but honestly, I’d worry less about the fine itself and more about what non-compliance does day to day: it slows down enterprise deals (a lot of corporates now ask vendors to prove they’re compliant before signing contracts), it chips away at customer trust, and it leaves you exposed the moment regulators start actively enforcing this.
The gaps we run into again and again
After enough of these assessments, you start noticing patterns. Almost every business we look at has at least a few of these:
No real consent mechanism — people’s data gets collected through forms or sign-ups without anyone actually agreeing to it in a legally valid way. Privacy policies that were clearly copy-pasted years ago and never updated for DPDP. Nobody internally “owns” data privacy — it’s nobody’s job until something goes wrong. No clean way for a user to actually withdraw consent if they change their mind. Vendors and third-party tools plugged into the business with zero data processing agreement in place. No breach response plan sitting anywhere, even though the Act expects you to notify people within a specific window. And in many cases, no DPO appointed at all, even where the law technically requires one.
If two or three of these sound familiar, that’s not a reason to panic — but it is a reason to act now rather than after a regulator or a client asks you for proof of compliance you don’t have.
How we actually approach this with clients
Nobody needs to overhaul their entire business in a week to get compliant — that’s not realistic, and honestly it’s bad advice if someone tells you otherwise. What works is doing it in stages.
We usually start with a free consultation, just to understand how your business actually handles data day to day — because no two businesses do it the same way, and templates off the internet rarely fit real operations. From there, we do a readiness assessment to see where things stand right now, followed by a gap analysis report that lays out the specific risks and what to fix first (not a 40-page document full of legal jargon nobody reads). Once that’s clear, we help build out the actual policies, consent notices, and internal processes. And because this isn’t a “set it and forget it” law, we stay on for ongoing advisory — DPO support, periodic reviews, that kind of thing — as enforcement and interpretation of the Act keeps evolving.
It also depends a lot on your industry
DPDP obligations don’t look the same across sectors. A clinic and an e-commerce brand are dealing with very different risks.
If you’re in healthcare, patient records and diagnostic data fall under “sensitive personal data,” which means stricter consent rules and tighter breach notification timelines. FinTech businesses have to think about KYC documents, transaction history, credit data — all of which need solid consent frameworks and a clear plan for what happens if something leaks. EdTech platforms dealing with student data, especially anyone under 18, need parental consent built into the system, not bolted on later. And e-commerce businesses handling payment info and browsing behavior need to be clear about what they’re collecting and why — vague catch-all consent doesn’t really hold up.
Where to start
If you genuinely don’t know whether your business meets DPDP requirements right now, don’t guess — get an actual assessment done. It’s a lot cheaper than finding out the hard way, and it gives you a real answer instead of a gut feeling based on skimming a government notification at midnight.
Compliance is turning into something clients and partners actually check for now, not just a legal formality sitting in a drawer. The businesses sorting this out early are going to have an easier time than the ones who wait for a notice to show up.
Want a clear picture of where your business stands? Book a free consultation with Advocate Nitin Kumar Vashista.