Understanding the DPDP Act 2023: A Complete Guide for Small Businesses

What Is the DPDP Act?

The Digital Personal Data Protection Act 2023 (DPDP Act) is India's first comprehensive data privacy law. If you run a business in India that collects, stores, or processes digital personal data — this law applies to you.

Who Does It Apply To?

The short answer: almost every business.

The 7 Core Obligations

1. Lawful Purpose

You can only collect data for a clear, specific, legitimate purpose. "We might use it later" is not a valid reason.

2. Explicit Consent

Users must give free, specific, informed, and unambiguous consent. Pre-ticked checkboxes don't count. Consent buried in terms and conditions doesn't count.

3. Reasonable Security Safeguards

This is deliberately broad — the Act doesn't prescribe specific technologies. But regulators will look at whether you've done due diligence: encryption, access controls, vulnerability assessments, employee training.

4. Data Deletion

Once the purpose for collecting data is fulfilled, you must delete it. Keeping customer data "just in case" is now illegal.

5. Breach Notification

If a breach occurs, you must notify the Data Protection Board without delay. CERT-In additionally mandates notification within 6 hours.

6. Data Principal Rights

Users (called "Data Principals") have the right to:

1. Access their data
2. Correct inaccurate data
3. Erase their data
4. Nominate someone to act on their behalf

7. Grievance Redressal

You must appoint a Data Protection Officer (or a designated contact for smaller businesses) and provide a working grievance mechanism.

The Penalty Structure

The Board considers the size and nature of the business when determining penalty amounts — but relying on leniency is not a compliance strategy.

Practical Compliance Roadmap

Here's a 4-step plan any SMB can follow:

Step 1: Data Audit

Map every piece of personal data your business collects. Most SMBs are surprised to find data scattered across:

1. Spreadsheets (customer lists, sales reports)
2. Email inboxes (customer correspondence)
3. Third-party tools (CRM, analytics, marketing platforms)
4. Databases (application data, user accounts)
5. Cloud storage (Google Drive, Dropbox backups)

Step 2: Fix Your Consent Mechanism

Update your privacy policy and consent forms. Here's what good consent looks like in code:

<!-- ❌ BAD: Pre-ticked, bundled consent -->
<label>
  <input type="checkbox" checked />
  I agree to the terms, privacy policy, and marketing emails
</label>

<!-- ✅ GOOD: Separate, unticked, specific consent -->
<label>
  <input type="checkbox" required />
  I consent to Acme Corp collecting my name and email to process my order.
  <a href="/privacy-policy">Read our privacy policy</a>
</label>

<label>
  <input type="checkbox" />
  I'd also like to receive product updates via email (optional).
</label>

Step 3: Run a Security Assessment

Identify vulnerabilities that could lead to a data breach — because the fastest path to a DPDP penalty is a breach you could have prevented.

# Quick security headers check
curl -sI https://yourdomain.com | grep -iE "strict-transport|content-security|x-frame|x-content-type"

# If you see nothing, your headers are missing — that's a finding.

Step 4: Set Up Breach Response

Have a plan before you need one:

How Bachao.AI Helps

Our platform maps directly to DPDP compliance requirements:

Book Your Free Scan

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.