What is the DPDP Act 2023?

The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection law, governing how organizations collect, process, and store personal data of Indian residents. Penalties for non-compliance reach ₹250 crore per breach, with the Data Protection Board empowered to investigate and enforce.

Who must comply with the DPDP Act?

Every business processing personal data of Indian residents must comply, regardless of where the business is headquartered. This includes Indian SMBs, SaaS startups, e-commerce sites, payment processors, and foreign companies serving Indian users. Government bodies have limited exemptions; private organizations have none.

When is DPDP Act enforcement starting?

The DPDP Act was notified in August 2023. Phased enforcement began in 2024, with the Data Protection Board fully operational by 2025. By 2026, Indian SMBs are expected to demonstrate consent management, breach notification, and data subject rights workflows during routine compliance audits.

What's the difference between DPDP and GDPR?

DPDP focuses narrowly on personal data of Indian residents with simpler consent rules than GDPR's lawful-basis framework. Penalties are flat-fee (up to ₹250 crore) rather than GDPR's revenue-percentage model. DPDP allows cross-border transfers by default unless blacklisted, the reverse of GDPR's approach.

What is the DPDP Act 2023?

The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection law, governing how organizations collect, process, and store personal data of Indian residents. Penalties for non-compliance reach ₹250 crore per breach, with the Data Protection Board empowered to investigate and enforce.

Who must comply with the DPDP Act?

Every business processing personal data of Indian residents must comply, regardless of where the business is headquartered. This includes Indian SMBs, SaaS startups, e-commerce sites, payment processors, and foreign companies serving Indian users. Government bodies have limited exemptions; private organizations have none.

When is DPDP Act enforcement starting?

The DPDP Act was notified in August 2023. Phased enforcement began in 2024, with the Data Protection Board fully operational by 2025. By 2026, Indian SMBs are expected to demonstrate consent management, breach notification, and data subject rights workflows during routine compliance audits.

What's the difference between DPDP and GDPR?

DPDP focuses narrowly on personal data of Indian residents with simpler consent rules than GDPR's lawful-basis framework. Penalties are flat-fee (up to ₹250 crore) rather than GDPR's revenue-percentage model. DPDP allows cross-border transfers by default unless blacklisted, the reverse of GDPR's approach.

All Articles

compliance

Compliance

Everything Indian businesses need to know about the DPDP Act 2023, SEBI cybersecurity requirements, and regulatory compliance.

33 articles

compliance9 min read

Sectoral CERTs and CSIRT-Fin: India's Incident Reporting Guide

Learn which body to report a cyber incident to in India — CERT-In, RBI, SEBI, CSIRT-Fin, or DoT — and how these reporting obligations stack up by sector.

2 Jul 2026

compliance9 min read

DoT Telecom Cyber Security Rules 2024: India Compliance Guide

A practical breakdown of the DoT Telecom Cyber Security Rules 2024 - who they apply to, key obligations, and what Indian businesses using SMS-OTP must do now.

2 Jul 2026

Compliance

Sectoral CERTs and CSIRT-Fin: India's Incident Reporting Guide

DoT Telecom Cyber Security Rules 2024: India Compliance Guide

Data Localization Under DPDP: What Indian Businesses Must Know

RBI Cyber Security Framework for NBFCs: Compliance Guide

PCI DSS Compliance for Indian Merchants and Payment Aggregators

CERT-In 2022 Directions Compliance: Complete Guide for India

RBI Digital Lending Cybersecurity: Complete Guide for India

ISO 27001 Certification India: Step-by-Step 2022 Roadmap

SEBI Cloud Security Framework for Indian Stock Brokers

RBI Cloud Outsourcing Framework: What Indian Banks Must Do

Data Fiduciary Obligations Under DPDP Act: India Checklist

DPDP Rules 2025: A Practical Guide for Indian Businesses

Data Retention & Deletion Under DPDP: India SMB Guide

SEBI CSCRF: What India's Regulated Entities Must Do

Aadhaar Data Handling: UIDAI Security Rules for Indian Businesses

DPDP Act Privacy Policy and Consent: India Compliance Guide

IT Act Section 43A: Data Security Obligations for Indian Companies

GDPR Compliance Guide for Indian Companies Serving EU Customers

HIPAA vs DPDP for Indian Healthtech: Patient Data Guide

SOC 2 for Indian SaaS: Type I vs Type II Audit Guide

Data Localization in India: RBI, DPDP and Where Data Must Live

PCI DSS 4.0 for Indian Merchants and Payment Aggregators

DPDP Act Data Breach Notification: India 72-Hour Guide

CERT-In 6-Hour Incident Reporting Rule: India Compliance Guide

ISO 27001:2022 for Indian Startups: How to Get Certified

RBI Cyber Resilience Controls: What NBFCs Must Do in 2026

DPDP Act Compliance for Indian SMBs: Penalties, Deadlines and a Practical Checklist

DPDP Act 2023 Compliance Checklist: 47 Controls Every Indian Business Must Implement

CERT-In VAPT Compliance: What the April 2022 Directive Actually Requires (and What It Doesn't)

RBI IT Framework Compliance for NBFCs: Step-by-Step Audit Checklist 2026

SEBI CSCRF Compliance for Stock Brokers and Trading Members: The Complete 2026 Audit Guide

DPDP Act Maximum Penalty: ₹250 Crore — 5 Real Scenarios for Indian Startups

Understanding the DPDP Act 2023: A Complete Guide for Small Businesses