Decoding the Digital Personal Data Protection Act 2023

Is the DPDP Act, 2023 Applicable to Your Organisation? A Practical Overview

As India moves into a new era of data governance, the Digital Personal Data Protection (DPDP) Act, 2023 together with the DPDP Rules, 2025, has introduced a structured, principle-driven framework for the responsible use of digital personal data. As organisations prepare for India’s evolving data governance landscape, one question has become increasingly common: “Does the Digital Personal Data Protection (DPDP) Act, 2023 apply to my organisation?”

In most situations, it does. The data protection laws in India are intentionally broad, designed to ensure that any entity handling digital personal data operates with transparency, accountability and purpose limitation.

This article provides a detailed, professionally structured explanation of the key concepts, applicability criteria and operational obligations introduced by the DPDP framework

1. Core Definitions and Their Practical Relevance

Understanding the Act begins with understanding its terminology. The following definitions determine whether your organisation falls within the scope of the law and what obligations follow.

Personal Data

This refers to any information that can identify an individual, directly or indirectly. In practice, the Personal Data Protection Act includes basic details such as names and mobile numbers, but also identifiers like email addresses, customer IDs, employee codes, payment information or any other data that can be linked back to a person.

Digital Personal Data

The Act covers personal data in digital form as well as data collected offline but later digitised. Thus, scanned KYC documents, Excel sheets of customers, CRM entries, HRMS records and digitised onboarding forms fall squarely within this scope. In most modern organisations, personal data is digitised at some stage, making this definition widely applicable.

Processing

Processing covers any automated operation performed on digital personal data. This ranges from collection and storage to analysis, transmission, sharing, erasure and destruction. If an organisation operates systems like applications, SaaS platforms, ERPs, CRMs, HRMS tools or even basic cloud storage solutions, and these systems touch personal data, the organisation is engaged in processing.

Data Principal

The individual whose personal data is being processed. For children, the term extends to parents or guardians. For certain persons with disabilities, a lawful guardian may act on their behalf. This definition reinforces the rights-centric nature of the Act.

Data Fiduciary

The entity that determines the purpose and means of processing personal data. This includes companies, startups, professional firms, NGOs, government bodies and any entity that decides how and why personal data is managed.

Data Processor

A person or organisation that processes personal data on behalf of a Data Fiduciary. Common examples include cloud service providers, payroll processors, IT/BPO vendors and marketing agencies. Importantly, processors act only under the instructions of the Data Fiduciary.

Consent

Consent must be free, specific, informed, unambiguous and unconditional. It must be tied to a clearly defined purpose, provided through affirmative action, and restricted to only the personal data necessary for that purpose.

2. When Does the DPDP Act Apply?

The DPDP Act applies when three conditions come together:

• An organisation handles digital personal data or digitises offline personal data.
• Any level of automated processing is involved, whether fully or partially.
• The processing takes place within India, or outside India but in connection with offering goods or services to individuals located in India.

Given the current business environment where employee records, customer touchpoints, vendor information and user data are routinely stored or managed digitally these conditions are met by most enterprises. This includes startups, platforms, professional service firms, digital marketplaces, D2C brands, technology providers, and even traditional businesses using cloud-based tools.

In effect, the DPDP Act is designed as a broad-based framework, and organisations should assume applicability unless they clearly fall outside these parameters.

3. The Transition to Granular and Purpose-Linked Consent

One of the most significant developments introduced by the DPDP Act and Rules is the shift from generic, blanket consent declarations to itemised and purpose-linked consent. This represents a fundamental transformation in how organisations must seek, record and demonstrate consent.

Under the earlier model, organisations often relied on broad consent statements covering multiple data categories and multiple purposes. Under the new framework, this is no longer permissible. Consent must now:

• Clearly specify which personal data points are being collected.
• Explain the purpose for each data point.
• Distinguish between essential and optional data.
• Be presented in a manner that enables individuals to understand and meaningfully choose.

For example, a single all-purpose statement such as “I consent to the collection of my information for services and marketing” must be replaced with detailed disclosures. Aadhaar may be collected only for statutory KYC; camera access only for video identity verification; contact list access must be justified separately and cannot be bundled with essential services.

This move enhances transparency, reduces over-collection and establishes stronger accountability for organisations.

4. Strengthened Accountability and Enforcement

To ensure that the new data protection regime is not merely declaratory, the DPDP framework introduces clear accountability obligations and enforcement mechanisms.

Data Fiduciaries must be able to demonstrate that consent was properly obtained and that notices were provided in a compliant manner. They must also implement processes for withdrawal of consent, correction and erasure requests and grievance handling.
When Consent Managers become operational, individuals will be able to view, withdraw and manage their consents across platforms through these registered entities, creating a more structured and standardised ecosystem.

Penalties under the Act can go up to ₹250 crore for serious non-compliance, signalling the government’s intent to enforce the law effectively.

5. Privacy Notice Requirements

The privacy notice becomes a central governance tool under the DPDP regime. The Act and Rules require that:

• The notice be written in clear, plain language and be comprehensible on its own.
• It provide an itemised list of the personal data being collected.
• The purpose of processing, and the corresponding goods or services, be clearly described.
• Contact details of the Data Protection Officer or authorised representative be provided.
• Direct mechanisms be included for withdrawal of consent, exercising rights and submitting complaints to the Data Protection Board.
• It be made available in English and optionally in any of the 22 languages listed in the Eighth Schedule.

The Rules also mandate that organisations issue retrospective notices for any personal data processed prior to the commencement of the Act and Rules, ensuring that legacy data is also brought into the compliance framework.

6. Implementation Timelines and Regulatory Roadmap

The combined DPDP framework establishes a phased compliance timeline, enabling organisations to prepare in a structured manner:

• 11 August 2023 – DPDP Act enacted by Parliament.
• 13 November 2025 – DPDP Rules notified; establishment of the Data Protection Board and commencement of foundational provisions.
• 13 November 2026 – Consent Manager registration framework becomes operational.
• 13 May 2027 – Full compliance requirements take effect, including rights of Data Principals, security safeguards, breach intimation obligations and enforcement measures.

Organisations therefore have a clear runway to undertake data mapping, redesign consent journeys, update documentation, strengthen governance controls and ready internal systems.

7. Preparing for Compliance: Key Organisational Priorities

To transition smoothly into the DPDP regime, organisations should focus on the following priority areas:

Data Mapping and Inventory Development

Establish a comprehensive view of what personal data is collected, where it resides, how long it is retained, who accesses it and why it is processed.

Redesigning Consent and Notice Frameworks

Update all consent flows to align with itemised, purpose-specific requirements. Revise privacy notices across websites, applications, onboarding journeys and internal systems.

Governance, Record-Keeping and Documentation

Implement structured processes to record consent, track processing activities, and allocate responsibilities between Data Fiduciaries and Data Processors through updated contracts.

Security and Technical Controls

Adopt safeguards encompassing access control, encryption, retention management, data minimisation, accuracy checks and breach detection and response mechanisms.

This work should be treated as a continuous compliance program rather than a one-time exercise.

Conclusion

The DPDP Act and Rules represent a major step forward for India’s digital economy. They introduce a balanced regulatory environment that enhances individual rights while ensuring that organisations operate with clarity, transparency and accountability. As you refine your internal processes, aligning your data practices with the DPDP framework will also support smoother governance and compliance during Company Registration consultant in india. With full implementation set for May 2027, organisations have a clearly defined window to design, implement and operationalise the required processes.

If you would like, I can also prepare a compliance checklist, a model privacy notice or a purpose-linked consent template tailored to your business profile.