Compliance Guide

How to Comply with India's DPDP Act 2023 — Practical SME Guide

India's Digital Personal Data Protection Act 2023 (DPDP) is enforceable as of 2026. Indian businesses (any size) handling personal data must comply with consent, retention, breach notification, and Data Principal rights. Below is the seven-step practical compliance roadmap for Indian SMEs — what to do, in what order, with realistic timelines.

Step 1 — Inventory personal data your business processes: List every system holding personal data: CRM (customer names, emails, phones), HRMS (employee PAN, Aadhaar, bank), payroll, marketing tools (subscriber lists), website (form submissions), and any spreadsheets. Document: what data, who provided it, why you have it, where it's stored, how long. This data inventory is the foundation of DPDP compliance.
Step 2 — Establish lawful basis and consent mechanism: For most personal data, you need consent. Update website forms, signup flows, and customer onboarding to include a clear, unambiguous consent checkbox (not pre-ticked). The consent must specify: who is collecting (your company name), purpose (why you need it), and for how long (retention period). Save consent records — you need to prove consent if challenged.
Step 3 — Update privacy policy and notices: Publish a DPDP-compliant privacy policy on your website covering: (1) what data you collect, (2) why you collect it, (3) how long you keep it, (4) who you share it with, (5) Data Principal rights (access, correction, erasure), (6) contact for grievances. Notices must be available in English and local language where applicable.
Step 4 — Implement Data Principal rights workflow: Data Principals (anyone whose data you hold) can request: access to their data, correction, deletion, withdrawal of consent. Set up a process: dedicated email (e.g., [email protected]), response within 30 days. Document each request. Most Indian SMBs use a simple ticket-based workflow in Zoho Desk or shared inbox.
Step 5 — Set up retention and deletion policies: For each data category, define retention period and auto-delete trigger. Example: customer inquiry data — 2 years; employee data — 8 years post-exit (per income tax); marketing subscriber data — until unsubscribe. Configure your CRM, HRMS, and other systems to enforce retention policies automatically where possible.
Step 6 — Establish breach detection and notification: DPDP requires notification to the Data Protection Board and affected Data Principals "without delay" upon breach. Set up: (1) monitoring for unauthorised data access (logs in CRM, HRMS), (2) incident response playbook (who decides, who notifies, what to say), (3) Data Protection Officer (DPO) contact published on website. For SMBs, the founder/CEO can be the DPO initially.
Step 7 — Vendor due diligence and Data Processing Agreements: For every SaaS vendor processing personal data on your behalf (CRM provider, email tool, HRMS, payment gateway), sign a Data Processing Agreement (DPA). Major vendors (Zoho, Salesforce, AWS, Microsoft, Razorpay) have standard DPAs ready — request them. For smaller vendors, you may need to provide a DPA template for them to sign.

Frequently Asked Questions

Does DPDP Act apply to small Indian businesses?

Yes — DPDP applies to any Indian business processing personal data, regardless of size. Some compliance obligations (mandatory DPO, breach impact assessments) apply only to Significant Data Fiduciaries (likely defined as larger entities by Government notification). But baseline obligations — consent, retention, Data Principal rights — apply to all.

What are the penalties for DPDP non-compliance in India?

Up to ₹250 crore per instance for serious violations. For SMEs, more relevant tiers: ₹50 crore for failure to handle Data Principal rights, ₹200 crore for breach notification failures. Actual enforcement against SMEs is likely to start with warnings and small fines, but the legal exposure is significant.

How long does DPDP compliance take for an Indian SMB?

Initial setup: 4-8 weeks. Phase 1 (week 1-2): data inventory + privacy policy update. Phase 2 (week 3-4): consent mechanism + Data Principal rights process. Phase 3 (week 5-6): retention policies + vendor DPAs. Phase 4 (week 7-8): breach response setup + training. Ongoing: monthly review + new data flow assessment.

Do I need a Data Protection Officer (DPO) for my Indian SMB?

Per DPDP Act, only Significant Data Fiduciaries must appoint a formal DPO. For most SMEs, designating a senior person (CTO, CFO, COO, or founder) as the privacy lead is sufficient. The role: monitor compliance, respond to Data Principal requests, liaise with Data Protection Board, lead breach response.

How does DPDP interact with international data transfer (e.g., to AWS US)?

DPDP allows cross-border data transfer to countries notified by Government. Until notifications, transfer to most major jurisdictions (US, EU, Singapore, Japan) is permitted with proper safeguards: Standard Contractual Clauses, vendor DPAs, and adequate security. For sensitive data, consider Indian data residency: AWS Mumbai, Microsoft 365 India regions, Zoho Indian DC, or Yotta sovereign cloud.

Free DPDP Act 2023 compliance consultation for Indian businesses — practical roadmap.